Make invalidate() a no-op for now

Author: arandito

packages/aws-credentials-http/src/aws_credentials_http/resolvers.py

@@ -82,8 +82,7 @@ async def get_identity(
         return self._credentials
 
     async def invalidate(self) -> None:
-        """Discard cached credentials so the next resolution re-queries the endpoint."""
-        self._credentials = None
+        """No-op until the rejected identity is passed in to expire selectively."""
 
     async def _resolve_uri_from_env(self) -> URI:
         if self.ENV_VAR in os.environ:

packages/aws-credentials-imds/src/aws_credentials_imds/resolvers.py

@@ -68,5 +68,4 @@ async def get_identity(
         return self._credentials
 
     async def invalidate(self) -> None:
-        """Discard cached credentials so the next resolution re-queries IMDS."""
-        self._credentials = None
+        """No-op until the rejected identity is passed in to expire selectively."""

packages/aws-credentials-imds/tests/unit/test_resolvers.py

@@ -104,29 +104,6 @@ async def test_resolver_refreshes_expired_credentials() -> None:
     assert imds_client.get.await_count == 4
 
 
-async def test_resolver_invalidate_forces_refresh() -> None:
-    http_client = AsyncMock()
-    config = IMDSConfig()
-    imds_client = AsyncMock()
-    resolver = IMDSCredentialsResolver(http_client, config)
-    resolver._imds_client = imds_client
-
-    future = (datetime.now(UTC) + timedelta(minutes=10)).strftime(ISO8601)
-    imds_client.get.side_effect = [
-        "test-profile",
-        json.dumps({**_CREDS, "Expiration": future}),
-        "test-profile",
-        json.dumps({**_CREDS, "Expiration": future}),
-    ]
-
-    await resolver.get_identity(properties={})
-    await resolver.invalidate()
-    await resolver.get_identity(properties={})
-
-    # Both the profile lookup and the credential fetch run again after invalidate
-    assert imds_client.get.await_count == 4
-
-
 async def test_resolver_requires_access_key_and_secret() -> None:
     http_client = AsyncMock()
     config = IMDSConfig()

packages/aws-credentials-sts/src/aws_credentials_sts/resolvers.py

@@ -125,10 +125,7 @@ async def get_identity(
             return self._credentials
 
     async def invalidate(self) -> None:
-        """Discard assumed credentials and invalidate the source resolver."""
-        async with self._refresh_lock:
-            self._credentials = None
-        await self._source_resolver.invalidate()
+        """No-op until the rejected identity is passed in to expire selectively."""
 
     async def _assume_role(self) -> AWSCredentialsIdentity:
         from aws_sdk_sts.client import AsyncSTSClient
@@ -215,9 +212,7 @@ async def get_identity(
         return await self._delegate.get_identity(properties=properties)
 
     async def invalidate(self) -> None:
-        """Invalidate assumed credentials if resolution has been initialized."""
-        if self._delegate is not None:
-            await self._delegate.invalidate()
+        """No-op until the rejected identity is passed in to expire selectively."""
 
     async def _create_assume_role_resolver(
         self,

packages/aws-credentials-sts/tests/unit/test_resolvers.py

@@ -293,27 +293,6 @@ async def test_role_session_name_stable_across_refreshes() -> None:
     assert first.args[0].role_session_name == second.args[0].role_session_name
 
 
-async def test_invalidate_clears_cache_and_source() -> None:
-    source_resolver = AsyncMock()
-    resolver = AssumeRoleCredentialsResolver(
-        source_resolver=source_resolver, role_arn=ROLE_ARN
-    )
-    sts_client = _mock_sts_client(
-        resolver,
-        _valid_output(access_key_id="test-access-key-1"),
-        _valid_output(access_key_id="test-access-key-2"),
-    )
-
-    identity_one = await resolver.get_identity(properties={})
-    await resolver.invalidate()
-    identity_two = await resolver.get_identity(properties={})
-
-    assert identity_one.access_key_id == "test-access-key-1"
-    assert identity_two.access_key_id == "test-access-key-2"
-    assert sts_client.assume_role.call_count == 2
-    source_resolver.invalidate.assert_awaited_once()
-
-
 # ---------------------------------------------------------------------------
 # ProfileAssumeRoleCredentialsResolver
 # ---------------------------------------------------------------------------
@@ -840,18 +819,3 @@ async def test_get_identity_creates_and_reuses_delegate(
     assert delegate.get_identity.await_count == 2
 
 
-async def test_invalidate_delegates_when_initialized(
-    merged_config: Callable[..., MergedConfig],
-) -> None:
-    config_file = merged_config(
-        {"role": {"role_arn": ROLE_ARN, "source_profile": "base"}}
-    )
-    resolver = ProfileAssumeRoleCredentialsResolver(
-        profile_name="role", config_file=config_file
-    )
-    delegate = AsyncMock()
-    resolver._delegate = delegate
-
-    await resolver.invalidate()
-
-    delegate.invalidate.assert_awaited_once()