Improve structure of resource closure in GlobusApp

In order to accurately track resources and `close()` when appropriate, a
new list tracks the resources to close. The client is adapted to this
same pattern for consistency.

Both objects log debug level messages when closing to indicate what is
being closed.

Some indirection is still needed so that the creation flow for
`GlobusApp._token_storage` can determine whether or not
`GlobusApp.token_storage` will be closed.

Author: sirosen

changelog.d/20251110_151006_sirosen_context_manager_clients_and_apps.rst

@@ -0,0 +1,5 @@
+Fixed
+-----
+
+- Fixed a resource leak in which a ``GlobusApp`` would create internal client
+  objects and never close the associated transports. (:pr:`NUMBER`)

src/globus_sdk/_internal/type_definitions.py

@@ -26,3 +26,7 @@ def text(self) -> str: ...
 
     @property
     def binary_content(self) -> bytes: ...
+
+
+class Closable(t.Protocol):
+    def close(self) -> None: ...

src/globus_sdk/client.py

@@ -8,6 +8,7 @@
 
 from globus_sdk import GlobusSDKUsageError, config, exc
 from globus_sdk._internal.classprop import classproperty
+from globus_sdk._internal.type_definitions import Closable
 from globus_sdk._internal.utils import slash_join
 from globus_sdk.authorizers import GlobusAuthorizer
 from globus_sdk.paging import PaginatorTable
@@ -99,6 +100,8 @@ def __init__(
                 f"A {type(self).__name__} cannot use both an 'app' and an 'authorizer'."
             )
 
+        self._resources_to_close: list[Closable] = []
+
         # Determine the client's environment
         # Either the provided kwarg or derived from the app used
         #
@@ -121,10 +124,9 @@ def __init__(
         # if and only if the client creates the Transport
         if transport is not None:
             self.transport = transport
-            self._owns_transport = False
         else:
             self.transport = RequestsTransport()
-            self._owns_transport = True
+            self._resources_to_close.append(self.transport)
 
         log.debug(f"initialized transport of type {type(self.transport)}")
 
@@ -352,9 +354,12 @@ def close(self) -> None:
         This only closes transports which are created implicitly via client init.
         Externally constructed transports will not be closed.
         """
-        if self._owns_transport:
-            log.debug(f"closing transport for {type(self).__name__}")
-            self.transport.close()
+        for resource in self._resources_to_close:
+            log.debug(
+                f"closing resource of type {type(resource).__name__} "
+                f"for {type(self).__name__}"
+            )
+            resource.close()
 
     # clients can act as context managers, and such usage calls close()
     def __enter__(self) -> Self:

src/globus_sdk/globus_app/app.py

@@ -15,6 +15,7 @@
     GlobusSDKUsageError,
     IDTokenDecoder,
 )
+from globus_sdk._internal.type_definitions import Closable
 from globus_sdk.authorizers import GlobusAuthorizer
 from globus_sdk.gare import GlobusAuthorizationParameters
 from globus_sdk.scopes import AuthScopes, Scope, ScopeParser
@@ -67,6 +68,7 @@ class GlobusApp(metaclass=abc.ABCMeta):
     # this allows code during init call into otherwise unsafe codepaths in the app,
     # namely those which manipulate scope requirements
     _authorizer_factory: AuthorizerFactory[GlobusAuthorizer]
+    _token_storage: TokenStorage
     token_storage: ValidatingTokenStorage
 
     def __init__(
@@ -84,6 +86,7 @@ def __init__(
         self.app_name = app_name
         self.config = config
         self._token_validation_error_handling_enabled = True
+        self._resources_to_close: list[Closable] = []
 
         self.client_id, self._login_client = self._resolve_client_info(
             app_name=self.app_name,
@@ -96,27 +99,29 @@ def __init__(
 
         # create the inner token storage object, and pick up on whether or not this
         # call handled creation or got a value from the outside
-        # if creation was done here, then this app "owns" the storage
-        inner_token_storage, token_storage_created_here = self._resolve_token_storage(
+        self._token_storage, token_storage_created_here = self._resolve_token_storage(
             app_name=self.app_name,
             client_id=self.client_id,
             config=self.config,
         )
-        self._token_storage = inner_token_storage
-        self._owns_token_storage = token_storage_created_here
 
         # create a consent client for token validation
         # this client won't be ready for immediate use, but will have the app attached
         # at the end of init
         consent_client = AuthClient(environment=config.environment)
+        self._resources_to_close.append(consent_client)
 
         # create the requisite token storage for the app, with validation based on
         # the provided parameters
+        # if the token storage was created by the app, the validating wrapper is added
+        # to the resources to close when closed
         self.token_storage = self._initialize_validating_token_storage(
             token_storage=self._token_storage,
             consent_client=consent_client,
             scope_requirements=self._scope_requirements,
         )
+        if token_storage_created_here:
+            self._resources_to_close.append(self.token_storage)
 
         # setup an ID Token Decoder based on config; build one if it was not provided
         self._id_token_decoder = self._initialize_id_token_decoder(
@@ -168,6 +173,9 @@ def _resolve_client_info(
                     abstract method: _initialize_login_client``.
             2.  Extract the client_id from a supplied login_client.
 
+        If a new client is created here, it is also added to the set of resources to
+        close when this app is closed.
+
         :returns: tuple of client_id and login_client
         :raises: GlobusSDKUsageError if a single client ID or login client could not be
             definitively resolved.
@@ -195,6 +203,7 @@ def _resolve_client_info(
             login_client = self._initialize_login_client(
                 app_name, config, client_id, client_secret
             )
+            self._resources_to_close.append(login_client)
             return client_id, login_client
 
         else:
@@ -389,11 +398,12 @@ def close(self) -> None:
         Close all resources currently held by the app.
         This does not trigger a logout.
         """
-        # if the app owns the token storage (meaning it was created by this app on init)
-        # then it will close the storage
-        if self._owns_token_storage:
-            log.debug("closing app associated token storage")
-            self.token_storage.close()
+        for resource in self._resources_to_close:
+            log.debug(
+                f"closing resource of type {type(resource).__name__} "
+                f"for {type(self).__name__}(app_name={self.app_name!r})"
+            )
+            resource.close()
 
     # apps can act as context managers, and such usage calls close()
     def __enter__(self) -> Self:

tests/unit/globus_app/test_globus_app.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import logging
 import os
 import time
 from unittest import mock
@@ -606,13 +607,29 @@ def run_login_flow(
         return super().run_login_flow(auth_parameters)
 
 
-def test_closing_app_closes_implicitly_created_token_storage():
-    user_app = UserApp("test-app", client_id="mock_client_id")
+@pytest.mark.parametrize("config", (None, GlobusAppConfig(token_storage="memory")))
+def test_closing_app_closes_implicitly_created_token_storage(config):
+    if config is None:
+        user_app = UserApp("test-app", client_id="mock_client_id")
+    else:
+        user_app = UserApp("test-app", client_id="mock_client_id", config=config)
 
     with mock.patch.object(user_app.token_storage, "close") as token_storage_close:
         user_app.close()
         token_storage_close.assert_called_once()
 
+    user_app.token_storage.close()  # cleanup
+
+
+def test_closing_app_closes_implicitly_created_login_client():
+    user_app = UserApp("test-app", client_id="mock_client_id")
+
+    with mock.patch.object(user_app._login_client, "close") as login_client_close:
+        user_app.close()
+        login_client_close.assert_called_once()
+
+    user_app._login_client.close()  # cleanup
+
 
 def test_closing_app_does_not_close_explicitly_passed_token_storage():
     user_app = UserApp(
@@ -631,3 +648,25 @@ def test_app_context_manager_exit_calls_close():
         with UserApp("test-app", client_id="mock_client_id"):
             app_close_method.assert_not_called()
         app_close_method.assert_called_once()
+
+
+def test_app_close_debug_logs_closure_of_resources(caplog):
+    """Debug logs show both of the internal clients, plus the token storage"""
+    caplog.set_level(logging.DEBUG)
+
+    user_app = UserApp("test-app", client_id="mock_client_id")
+    user_app.close()
+
+    # 3 resources at least: consent_client, login_client, token_storage
+    assert (
+        "closing resource of type AuthClient for UserApp(app_name='test-app')"
+        in caplog.text
+    )
+    assert (
+        "closing resource of type NativeAppAuthClient for "
+        "UserApp(app_name='test-app')"
+    ) in caplog.text
+    assert (
+        "closing resource of type ValidatingTokenStorage for "
+        "UserApp(app_name='test-app')"
+    ) in caplog.text

tests/unit/test_base_client.py

@@ -1,4 +1,5 @@
 import json
+import logging
 import os
 import uuid
 from unittest import mock
@@ -367,6 +368,15 @@ def test_client_close_implicitly_closes_internal_transport(base_client_class):
         transport_close.assert_called_once()
 
 
+def test_client_close_debug_logs_internal_transport_close(base_client_class, caplog):
+    caplog.set_level(logging.DEBUG)
+
+    client = base_client_class()
+    client.close()
+
+    assert "closing resource of type RequestsTransport for CustomClient" in caplog.text
+
+
 def test_client_close_does_not_close_explicitly_passed_transport(base_client_class):
     # test the private _close() method directly
     client = base_client_class(transport=RequestsTransport())