mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-11-09 12:49:27 +00:00
Lydia Vilchez
f2d0e714c8
Replace the `ThreadPoolExecutor` + `future.result(timeout=...)` pattern in `verify_client`'s certificate path with a `RequestsTransport` that carries the connection/read deadlines. The executor approach could not cancel a running `credential.get_token`, so timed-out or otherwise failing calls left the underlying worker and network request alive: under Entra ID degradation the API and Celery paths accumulated background workers, and non-timeout exceptions bypassed executor shutdown entirely. Transport-layer timeouts terminate the request itself, so there is no worker to leak and no cleanup path to miss. Translate the resulting `ServiceRequestError` to `AzureCredentialsUnavailableError` to keep the existing contract for `verify_client` and `test_connection`. Update the timeout and leaf-first tests to match the new codepath.