feat: [aiohttp] Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads - #18224

max_allowed_time=max_allowed_time resets the timer on each retry instead of limiting total runtime.

prefix in url searches the entire URL, so paths or query parameters can trigger certificate rotation on standard hosts. Parse and normalize urlsplit(url).hostname, then match only exact hostnames or subdomains of documented mTLS endpoints.

Closing the 401 response before credentials refresh returns an unreadable response if RefreshError occurs. Also, StaticCredentials and AnonymousCredentials raise uncaught InvalidOperation errors during refresh. Close the response only after refresh succeeds. Return the open original response if refresh fails or is unsupported.

Initial setup can use client_cert_callback, but check_parameters_for_unauthorized_response always checks application default credentials. This mismatch can replace custom certificates or skip rotation. Save the initial certificate source, and reuse it for all fingerprint checks and reconfiguration.

configure_mtls_channel closes the active ClientSession, which aborts in-flight concurrent requests. Keep old sessions open until their requests finish, or close them in AsyncAuthorizedSession.close(). Add a concurrency regression test for this case.

self._mtls_rotation_lock = asyncio.Lock() runs in synchronous __init__. In Python 3.8 and 3.9, calling asyncio.Lock() outside an active event loop grabs asyncio.get_event_loop(). If someone creates the session in a sync factory, background thread, or test fixture that runs before the loop starts, Python throws RuntimeError: There is no current event loop in thread. If the session is used across different test loops, it fails with RuntimeError: Task got Future attached to a different loop. Set self._mtls_rotation_lock = None in __init__, then create the lock lazily inside an async helper on first use.

The warning log on line 362 says we proceed with the original response, but the block never actually returns it. Code falls straight through to line 400, refreshes credentials, and retries the request twice on the unrotated transport. Add return response inside this except Exception as e: block so parameter check errors stop execution immediately.

Raising MutualTLSChannelError here escapes before the code reaches response.close() on line 394. The 401 response socket stays open and leaks on the rotation failure path. Close the response before raising the error.

assert mock_check.call_count >= 1 masks the fallthrough retry bug. If checking parameters fails, the session should abort on the first attempt without calling credentials refresh or retrying the request. Change this to mock_check.assert_called_once(), and assert that mock_creds.refresh was not called.

None of the new tests check lock contention under load. The mocked configure_mtls_channel never updates _cached_cert, so the double-checked lock skip check on line 346, if self._cached_cert != stale_cert:, is never exercised. Add a test with asyncio.gather where multiple concurrent requests receive 401s at the same time, confirming the channel is reconfigured once and following tasks take the skip branch.

The refresh and retry logic on lines 399 to 417 sits outside the mTLS check, which ends on line 391. Every 401 response across all endpoints now triggers credentials refresh and retries up to two times. While this matches the behavior of the synchronous session, the async session did not do this before, and the PR description frames this change purely around mTLS certificate mismatch. If this behavior change is intentional, please mention it in the PR description and add a test confirming that non-mTLS 401s refresh and retry.