Mixins

def authenticate(self):
    """Ensure the client is authenticated, triggering a login if needed.

    Returns:
        The login result when a login is performed; otherwise None.
    """
    with AuthClient(self.app_context) as client:
        if client.is_authenticated():
            return

        return client.login()

def call_with_auth_refresh(self, fn: Callable[[], T]) -> T:
    """Run a qlam API call, refreshing credentials once on a 401 or 403.

    If `fn` raises an `APIError` with status 401 (token expired) or 403
    (access denied), a best-effort non-interactive credential refresh is
    attempted via `AuthClient`. When the refresh updates at least one
    provider's credentials, `fn` is invoked again. Any other error, or a
    refresh that produces no fresh credentials, propagates the original
    exception.

    Only one retry is attempted; a second 401/403 is re-raised.

    Args:
        fn (Callable[[], T]): Zero-argument callable that performs the
            qlam API call.

    Returns:
        T: The value returned by `fn`.

    Raises:
        APIError: When `fn` raises an `APIError` whose status is neither
            401 nor 403, when refresh produces no fresh credentials, or
            when the retry also fails.
    """
    try:
        return fn()
    except APIError as e:
        if e.status_code not in (401, 403):
            raise
        with AuthClient(self.app_context) as client:
            refresh_results = client.refresh_credentials()
        if not any(refresh_results.values()):
            raise
        return fn()