Performance [P2]: Defer synchronous Azure token acquisition

[berndverst]

Summary

AccessTokenManager.__init__() acquired an Azure access token eagerly, so constructing a DurableTaskSchedulerClient or DurableTaskSchedulerWorker performed a blocking credential round trip to Entra before any RPC was made. DTSDefaultClientInterceptorImpl.__init__() then called get_access_token() immediately, so the cost was paid even for instances that were never used. SandboxWorker goes through the same construction path.

Token acquisition is now deferred to the first intercepted RPC:

• AccessTokenManager.__init__() no longer calls credential.get_token(); it starts with _token = None / expiry_time = None.
• DTSDefaultClientInterceptorImpl.__init__() no longer primes the token or the authorization header.

The existing double-checked refresh lock in get_access_token() is untouched, so the deferred first acquisition is still single-flight across threads, and refresh-before-expiry behavior is unchanged. _intercept_call() already upserted the authorization header on every call, so no header is missing on the first request. This mirrors what DTSAsyncDefaultClientInterceptorImpl already does.

Behavior change (timing only)

Credential failures — for example an unavailable managed identity or a misconfigured DefaultAzureCredential — now surface from the first request instead of from the constructor. The exception type and message are unchanged; only the timing differs. This is called out in durabletask-azuremanaged/CHANGELOG.md under ## Unreleased.

No public API changed: no signature changes, no renames, no removed symbols, no changed import paths. No warm-up hook was added, to avoid expanding public surface — callers that want fail-fast authentication can call credential.get_token(...) themselves before constructing a client or worker.

Tests

tests/durabletask-azuremanaged/test_durabletask_grpc_interceptor.py:

• Added test_client_construction_does_not_acquire_token — asserts zero credential calls at client construction, exactly one on the first RPC, that the authorization header is present on that request, and that a second request reuses the cached token.
• Added test_worker_construction_does_not_acquire_token — asserts zero credential calls at worker construction.
• Added test_deferred_first_acquisition_performs_single_acquisition — 8 concurrent threads on a freshly constructed manager result in exactly one credential call, proving the deferred first acquisition is single-flight.
• Reworked test_concurrent_refresh_performs_single_refresh — the single-flight-on-expiry assertion is preserved, with the token now primed explicitly instead of relying on constructor acquisition.

All three new tests were verified to fail against the unfixed source and pass with the fix.

Verification

• Provider unit tests: pytest tests/durabletask-azuremanaged/test_durabletask_grpc_interceptor.py tests/durabletask-azuremanaged/test_sandboxes_extension.py -q -> 45 passed (baseline 42; +3 new).
• Core unit tests: pytest tests/durabletask -q --ignore-glob="*_e2e.py" -> 681 passed, 7 skipped. Baseline on this branch had 1 failure in the timing-sensitive test_sync_client_recreate_cooldown_prevents_immediate_repeated_recreation, which is flaky/environmental and passes here.
• flake8 clean on all four changed files.
• pyright (repo pyrightconfig.json, strict): 0 diagnostics in the changed source files.
• pymarkdown -c .pymarkdown.json scan durabletask-azuremanaged/CHANGELOG.md: the two MD013 line-length findings are pre-existing on untouched lines; the added lines introduce none.

Scope was kept strictly to this issue — no changes related to #192 (async single-flight refresh) or #195 (SDK version lookup caching), which live in the same files.

Fixes #187

[Copilot]

Pull request overview

This PR improves cold-start performance for the Azure Managed provider by deferring synchronous Azure access token acquisition until the first intercepted gRPC call, instead of doing a blocking credential round trip during client/worker construction.

Changes:

• Deferred initial token acquisition in AccessTokenManager (sync) by initializing with no token/expiry and relying on the existing double-checked lock path on first use.
• Removed eager token “priming” in DTSDefaultClientInterceptorImpl.__init__(); authorization headers are still upserted per-call in _intercept_call().
• Added/updated unit tests to assert zero credential calls during construction and single-flight behavior on the first concurrent acquisition, and documented the timing-only behavior change in the provider changelog.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
tests/durabletask-azuremanaged/test_durabletask_grpc_interceptor.py	Adds tests ensuring token acquisition is deferred and remains single-flight under concurrency.
durabletask-azuremanaged/durabletask/azuremanaged/internal/durabletask_grpc_interceptor.py	Removes eager token priming; relies on per-RPC interception to acquire/upsert authorization.
durabletask-azuremanaged/durabletask/azuremanaged/internal/access_token_manager.py	Defers initial token acquisition while preserving existing refresh/locking behavior.
durabletask-azuremanaged/CHANGELOG.md	Documents the timing-only behavior change under ## Unreleased.