async_validate_access_token ran a full HMAC-SHA256 signature verify plus
claims validation on every authenticated request, even though the
signature of a given token string never changes. Only the exp claim is
time-dependent.
Cache the (refresh_token_id, exp) of each successfully validated token in
a bounded LRU. On a repeat request the hot path becomes a dict lookup, an
exp comparison and the existing refresh-token lookup, skipping the HMAC
verify entirely.
Security is unchanged:
- Only tokens that pass the full signature/issuer/iat verification are
ever cached, so a forged token can never enter the cache.
- The refresh token is re-fetched from the store on every call, so a
revoked or removed token (its refresh token is gone) is still rejected,
and an inactive user is still rejected.
- The exp claim is rechecked against the same leeway on every cache hit,
so an expired token is still rejected (and evicted).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PXQwLpKCf8FvhWoSc2Jw61
* Cache construction of is_admin
This has to be checked for a lot of api calls and the websocket
every time the call is made
* Cache construction of is_admin
This has to be checked for a lot of api calls and the websocket
every time the call is made
* Cache construction of is_admin
This has to be checked for a lot of api calls and the websocket
every time the call is made
* modernize
* coverage
* coverage
* verify caching
* verify caching
* fix type
* fix mocking
* Upgrade pytest-aiohttp
* Make sure executors, tasks and timers are closed
Some test will trigger warnings on garbage collect, these warnings
spills over into next test.
Some test trigger tasks that raise errors on shutdown, these spill
over into next test.
This is to mimic older pytest-aiohttp and it's behaviour on test
cleanup.
Discussions on similar changes for pytest-aiohttp are here:
https://github.com/pytest-dev/pytest-asyncio/pull/309
* Replace loop with event_loop
* Make sure time is frozen for tests
* Make sure the ConditionType is not async
/home-assistant/homeassistant/helpers/template.py:2082: RuntimeWarning: coroutine 'AsyncMockMixin._execute_mock_call' was never awaited
def wrapper(*args, **kwargs):
Enable tracemalloc to get traceback where the object was allocated.
See https://docs.pytest.org/en/stable/how-to/capture-warnings.html#resource-warnings for more info.
* Increase litejet press tests with a factor 10
The times are simulated anyway, and we can't stop the normal
event from occuring.
* Use async handlers for aiohttp
tests/components/motioneye/test_camera.py::test_get_still_image_from_camera
tests/components/motioneye/test_camera.py::test_get_still_image_from_camera
tests/components/motioneye/test_camera.py::test_get_stream_from_camera
tests/components/motioneye/test_camera.py::test_get_stream_from_camera
tests/components/motioneye/test_camera.py::test_camera_option_stream_url_template
tests/components/motioneye/test_camera.py::test_camera_option_stream_url_template
/Users/joakim/src/hass/home-assistant/venv/lib/python3.9/site-packages/aiohttp/web_urldispatcher.py:189: DeprecationWarning: Bare functions are deprecated, use async ones
warnings.warn(
* Switch to freezegun in modbus tests
The tests allowed clock to tick in between steps
* Make sure skybell object are fully mocked
Old tests would trigger attempts to post to could services:
```
DEBUG:aioskybell:HTTP post https://cloud.myskybell.com/api/v3/login/ Request with headers: {'content-type': 'application/json', 'accept': '*/*', 'x-skybell-app-id': 'd2b542c7-a7e4-4e1e-b77d-2b76911c7c46', 'x-skybell-client-id': '1f36a3c0-6dee-4997-a6db-4e1c67338e57'}
```
* Fix sorting that broke after rebase
Claude
Ariel Ebersberger
Franck Nijhof
Paulus SchoutsenandClaude Opus 4.7
renovate[bot]andRobert Resch
epenet
Abílio Costa
Marc Mueller
Erik Montnemery
J. Nick Koston
Whitney Young
Joost Lekkerkerker
MichaelandJ. Nick Koston
Jan-Philipp Benecke
Patrick Li
Joakim Plate