Performance [P1]: Single-flight async Azure token refresh

[berndverst]

Summary

AsyncAccessTokenManager.get_access_token() checked expiry and awaited
refresh_token() with no synchronization. Because
DTSAsyncDefaultClientInterceptorImpl._intercept_call() awaits it on every
RPC, a burst of concurrent grpc.aio calls arriving while the token was
missing or inside its renewal window would each independently hit the
credential — a thundering herd of Entra/credential requests, added latency, and
avoidable throttling pressure. The synchronous AccessTokenManager already
guards this with double-checked locking; the async path did not.

This change mirrors that design for the async manager:

• get_access_token() now re-checks token validity after acquiring a
  refresh guard, so only one coroutine calls the credential per refresh window
  and the rest reuse the result.
• The guard is an asyncio.Lock created lazily per running event loop
  (kept in a small map guarded by a threading.Lock). An asyncio.Lock binds
  itself to the loop it is first awaited on, so a single lock created in
  __init__ would raise if the manager outlived a loop or was shared across
  loops. Locks belonging to closed loops are pruned so the map cannot grow
  without bound.
• The fast path is unchanged: when a cached token is still valid, the outer
  check short-circuits and no lock is touched, so there is no added per-RPC
  overhead.

Failures propagate unchanged — the guard is released via async with, so a
credential error surfaces to the caller and a later attempt can still succeed.

Backwards compatibility

No public API changes. Method signatures, return values, the expiry/renewal
margin behavior, exception propagation, logging, and sync-path thread-safety
are all preserved. The only new members are private (_get_refresh_lock,
_refresh_locks, _refresh_locks_guard).

Scope

Deliberately narrow, limited to this issue. It does not touch deferred sync
token acquisition (#187) or SDK version lookup caching (#195), which are being
addressed separately in these same files.

Verification

• New tests in tests/durabletask-azuremanaged/test_durabletask_grpc_interceptor.py,
  modeled on the existing sync test_concurrent_refresh_performs_single_refresh:
  • 16 concurrent cold-start callers result in exactly 1 credential call.
  • 16 concurrent callers after expiry result in exactly 1 refresh.
  • A valid cached token is returned without contacting the credential.
  • A credential failure propagates to waiters and does not deadlock; a
    subsequent attempt succeeds.
  • The manager is reusable across two distinct event loops (guards against
    binding the lock to a dead loop).
• Confirmed the tests catch the bug: with the source change reverted, the
  two single-flight tests fail with 1 != 16 and 2 != 17 — exactly the
  duplicate acquisition described in the issue.
• Provider unit tests: test_durabletask_grpc_interceptor.py +
  test_sandboxes_extension.py — 47 passed (42 at baseline, +5 new).
• Core unit tests: tests/durabletask excluding *_e2e.py — 681 passed,
  7 skipped, identical to baseline.
• flake8 clean on both changed Python files; pyright reports 0 errors
  on the changed source; pymarkdown introduces no new findings (the two
  MD013 hits on the changelog are pre-existing lines).
• test_dts_batch_actions.py fails identically with and without this change
  (11 failures on a clean baseline); it requires a live Durable Task Scheduler
  endpoint.

Fixes #192

[Copilot]

Pull request overview

This PR improves the Azure Managed provider’s async token acquisition path by adding single-flight synchronization to AsyncAccessTokenManager, preventing concurrent grpc.aio RPC bursts from triggering duplicate credential refresh calls.

Changes:

• Added per-event-loop asyncio.Lock guarding with double-checked refresh logic in AsyncAccessTokenManager.get_access_token().
• Added async concurrency/unit tests covering cold-start, refresh-window behavior, failure propagation, and cross-event-loop reuse.
• Documented the user-visible concurrency improvement in the provider changelog.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tests/durabletask-azuremanaged/test_durabletask_grpc_interceptor.py	Adds async single-flight and event-loop binding tests for AsyncAccessTokenManager.
durabletask-azuremanaged/durabletask/azuremanaged/internal/access_token_manager.py	Implements per-event-loop refresh locking with a double-check to avoid duplicate async refreshes.
durabletask-azuremanaged/CHANGELOG.md	Notes the improved async refresh concurrency behavior under ## Unreleased.

[berndverst]

Thanks for the review. Addressing the two automated comments here, since one of them rests on a claim I was able to check directly.

Blank line after the copyright header — declining

The suggestion was to add a blank line between the license header and the first import. I checked main before acting, and access_token_manager.py already has no blank line there:

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.
from datetime import datetime, timezone

This PR adds import asyncio as the first import and removes nothing, so it preserves the file's existing style rather than introducing a deviation. The repo's "header, then blank line" convention applies to new files; reformatting this one would be an unrelated style change to a file that was already like this.

Happy to fix it as a separate cleanup if you would prefer the convention applied retroactively across existing files, but it seems out of scope here.

Comprehension readability — agreeing, with a correction to the reason

The comment on the list comprehension in _get_refresh_lock said the formatting "violates flake8." That part is not accurate — I ran python -m flake8 against the changed files and it exits 0 with no output, so there is no lint violation to fix.

The underlying readability point is fair, though, so it is being applied on its own merits: the comprehension is hoisted into a named local and then iterated. No behaviour change.

Also in this update

This branch is being merged up to latest main, which now includes #199 (0f316cc). That PR rewrote AccessTokenManager.__init__ to defer the initial token acquisition, touching the same constructor this PR modifies, so the merge keeps both: main's deferred first acquisition and this PR's single-flight async refresh. The interaction is worth a look on re-review, since the deferred first acquisition now also flows through the refresh lock that this PR made single-flight for the async path.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

durabletask-azuremanaged/durabletask/azuremanaged/internal/access_token_manager.py:4

• The module-level copyright header is no longer followed by a blank line before imports, which is inconsistent with the standard header formatting used across the repo (e.g., durabletask_grpc_interceptor.py starts imports after a blank line).

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.
import asyncio
from datetime import datetime, timedelta, timezone