refactor: reuse routing and remove unused analysis helpers

scripts/run_operational_worker.py

@@ -90,25 +90,27 @@ class CredentialProvider:
         self.settings = settings
         self._token = ""
         self._expires = 0.0
+        self._refresh_lock = asyncio.Lock()
 
     async def headers(self, client: httpx.AsyncClient) -> dict[str, str]:
         if self.settings.bearer:
             token = self.settings.bearer.removeprefix("Bearer ")
         else:
-            if time.monotonic() >= self._expires:
-                response = await client.post(self.settings.token_url, data={
-                    "grant_type": "client_credentials", "client_id": self.settings.client_id,
-                    "client_secret": self.settings.client_secret,
-                })
-                response.raise_for_status()
-                payload = response.json()
-                self._token = payload["access_token"]
-                if not isinstance(self._token, str) or not self._token:
-                    raise ValueError("identity provider returned no access token")
-                # Product auth also restricts token age, independently of the
-                # provider's exp. Do not cache a long-lived OAuth token for hours.
-                lifetime = min(float(payload.get("expires_in", 60)), self.settings.token_refresh_seconds)
-                self._expires = time.monotonic() + max(1, lifetime - 15)
+            async with self._refresh_lock:
+                if time.monotonic() >= self._expires:
+                    response = await client.post(self.settings.token_url, data={
+                        "grant_type": "client_credentials", "client_id": self.settings.client_id,
+                        "client_secret": self.settings.client_secret,
+                    })
+                    response.raise_for_status()
+                    payload = response.json()
+                    self._token = payload["access_token"]
+                    if not isinstance(self._token, str) or not self._token:
+                        raise ValueError("identity provider returned no access token")
+                    # Product auth also restricts token age, independently of the
+                    # provider's exp. Do not cache a long-lived OAuth token for hours.
+                    lifetime = min(float(payload.get("expires_in", 60)), self.settings.token_refresh_seconds)
+                    self._expires = time.monotonic() + max(1, lifetime - 15)
             token = self._token
         return {"Authorization": f"Bearer {token}", "X-Project-Id": self.settings.project_id}