refactor(aicore): inline credential reload, remove transparent TLS feature

Address reviewer feedback on PR #256:

1. Remove reload_aicore_credentials() wrapper — inline set_aicore_config()
   directly in the except AuthenticationError blocks. The wrapper added a
   named function for a single call; inlining is simpler and clearer.

2. Remove transparent TLS feature (AICORE_TRANSPARENT_TLS env var,
   _is_transparent_tls(), conditional client_secret handling in
   set_aicore_config()). This feature is blocked on an upstream LiteLLM PR
   and is not needed for the credential rotation fix. Nicole flagged that
   it belongs in a future secrets-resolver refactor.

Behavior unchanged: AuthenticationError still triggers set_aicore_config()
+ retry, completely transparent to callers.

Author: tiagoek

src/sap_cloud_sdk/aicore/__init__.py

@@ -31,16 +31,6 @@
 
 logger = logging.getLogger(__name__)
 
-# When set, the infrastructure sidecar adds the mTLS certificate transparently.
-# The SDK calls the XSUAA token endpoint over plain HTTPS with only client_id.
-# No client_secret or certificate material is required in the service binding.
-TRANSPARENT_TLS_ENV_VAR = "AICORE_TRANSPARENT_TLS"
-
-
-def _is_transparent_tls() -> bool:
-    """Return True when transparent TLS proxy mode is active."""
-    return os.environ.get(TRANSPARENT_TLS_ENV_VAR, "").strip().lower() in ("1", "true", "yes")
-
 
 def _get_secret(
     env_var_name: str,
@@ -134,15 +124,10 @@ def set_aicore_config(instance_name: str = "aicore-instance") -> None:
 
     File mappings based on the Kubernetes secret structure:
         clientid → AICORE_CLIENT_ID
-        clientsecret → AICORE_CLIENT_SECRET  (skipped in transparent TLS mode)
+        clientsecret → AICORE_CLIENT_SECRET
         url → AICORE_AUTH_URL
         serviceurls (JSON with AI_API_URL) → AICORE_BASE_URL
 
-    When ``AICORE_TRANSPARENT_TLS=true`` is set, the infrastructure sidecar
-    adds the mTLS certificate on the SDK's behalf. In this mode the SDK omits
-    ``AICORE_CLIENT_SECRET`` from the environment — LiteLLM will use plain
-    HTTPS to the token endpoint and the sidecar will attach the certificate.
-
     After credentials are loaded, content filtering is activated on every
     ``sap/*`` LiteLLM call at the configured thresholds (default: severity
     ``MEDIUM`` on all categories + prompt shield enabled). Override via
@@ -151,15 +136,16 @@ def set_aicore_config(instance_name: str = "aicore-instance") -> None:
     to turn filtering off at runtime, or set ``AICORE_FILTER_ENABLED=false``
     to keep it off entirely.
     """
-    transparent_tls = _is_transparent_tls()
-
     # Load secrets
     client_id = _get_secret("AICORE_CLIENT_ID", "clientid", instance_name=instance_name)
     auth_url = _get_secret("AICORE_AUTH_URL", "url", instance_name=instance_name)
     base_url = _get_aicore_base_url(instance_name)
     resource_group = _get_secret(
         "AICORE_RESOURCE_GROUP", default="default", instance_name=instance_name
     )
+    client_secret = _get_secret(
+        "AICORE_CLIENT_SECRET", "clientsecret", instance_name=instance_name
+    )
 
     # Ensure AICORE_AUTH_URL has /oauth/token suffix
     if auth_url and not auth_url.endswith("/oauth/token"):
@@ -177,17 +163,8 @@ def set_aicore_config(instance_name: str = "aicore-instance") -> None:
         os.environ["AICORE_BASE_URL"] = base_url
     if resource_group:
         os.environ["AICORE_RESOURCE_GROUP"] = resource_group
-
-    if transparent_tls:
-        # Remove any stale client_secret — the sidecar provides the mTLS cert.
-        os.environ.pop("AICORE_CLIENT_SECRET", None)
-        logger.info("AI Core transparent TLS mode active — client_secret not required")
-    else:
-        client_secret = _get_secret(
-            "AICORE_CLIENT_SECRET", "clientsecret", instance_name=instance_name
-        )
-        if client_secret:
-            os.environ["AICORE_CLIENT_SECRET"] = client_secret
+    if client_secret:
+        os.environ["AICORE_CLIENT_SECRET"] = client_secret
 
     # Log configuration completion (excluding sensitive information)
     logger.info("AI Core configuration has been set successfully")

tests/aicore/unit/test_aicore.py

@@ -10,7 +10,6 @@
     _get_secret,
     set_aicore_config,
 )
-from sap_cloud_sdk.aicore import _is_transparent_tls
 
 
 class TestGetSecret:
@@ -713,125 +712,3 @@ def test_set_config_decorated_with_record_metrics(self):
             # The actual telemetry recording is tested in telemetry tests
 
 
-class TestIsTransparentTls:
-    """Test suite for _is_transparent_tls helper."""
-
-    def test_returns_true_for_value_true(self):
-        with patch.dict("os.environ", {"AICORE_TRANSPARENT_TLS": "true"}):
-            assert _is_transparent_tls() is True
-
-    def test_returns_true_for_value_1(self):
-        with patch.dict("os.environ", {"AICORE_TRANSPARENT_TLS": "1"}):
-            assert _is_transparent_tls() is True
-
-    def test_returns_true_for_value_yes(self):
-        with patch.dict("os.environ", {"AICORE_TRANSPARENT_TLS": "yes"}):
-            assert _is_transparent_tls() is True
-
-    def test_returns_true_case_insensitive(self):
-        with patch.dict("os.environ", {"AICORE_TRANSPARENT_TLS": "TRUE"}):
-            assert _is_transparent_tls() is True
-
-    def test_returns_false_when_absent(self):
-        with patch.dict("os.environ", {}, clear=True):
-            assert _is_transparent_tls() is False
-
-    def test_returns_false_for_value_false(self):
-        with patch.dict("os.environ", {"AICORE_TRANSPARENT_TLS": "false"}):
-            assert _is_transparent_tls() is False
-
-
-class TestSetAICoreConfigTransparentTls:
-    """Test suite for set_aicore_config in transparent TLS mode."""
-
-    def _base_secrets(self):
-        return {
-            "AICORE_CLIENT_ID": "test-client-id",
-            "AICORE_AUTH_URL": "https://auth.example.com",
-            "AICORE_RESOURCE_GROUP": "default",
-        }
-
-    def test_transparent_tls_does_not_set_client_secret(self):
-        """In transparent TLS mode, AICORE_CLIENT_SECRET must not be written to env."""
-        with (
-            patch("sap_cloud_sdk.aicore._get_secret") as mock_get_secret,
-            patch("sap_cloud_sdk.aicore._get_aicore_base_url", return_value="https://api.example.com"),
-            patch("sap_cloud_sdk.aicore.set_filtering"),
-            patch.dict("os.environ", {"AICORE_TRANSPARENT_TLS": "true"}, clear=True),
-        ):
-            mock_get_secret.side_effect = lambda name, file_name=None, default="", instance_name="aicore-instance": (
-                self._base_secrets().get(name, default)
-            )
-
-            set_aicore_config()
-
-            assert "AICORE_CLIENT_SECRET" not in os.environ
-
-    def test_transparent_tls_removes_stale_client_secret(self):
-        """Any pre-existing AICORE_CLIENT_SECRET is cleared in transparent TLS mode."""
-        with (
-            patch("sap_cloud_sdk.aicore._get_secret") as mock_get_secret,
-            patch("sap_cloud_sdk.aicore._get_aicore_base_url", return_value=""),
-            patch("sap_cloud_sdk.aicore.set_filtering"),
-            patch.dict(
-                "os.environ",
-                {"AICORE_TRANSPARENT_TLS": "true", "AICORE_CLIENT_SECRET": "stale-secret"},
-                clear=True,
-            ),
-        ):
-            mock_get_secret.side_effect = lambda name, file_name=None, default="", instance_name="aicore-instance": (
-                self._base_secrets().get(name, default)
-            )
-
-            set_aicore_config()
-
-            assert "AICORE_CLIENT_SECRET" not in os.environ
-
-    def test_transparent_tls_sets_other_credentials(self):
-        """Non-secret credentials are still set in transparent TLS mode."""
-        with (
-            patch("sap_cloud_sdk.aicore._get_secret") as mock_get_secret,
-            patch("sap_cloud_sdk.aicore._get_aicore_base_url", return_value="https://api.example.com"),
-            patch("sap_cloud_sdk.aicore.set_filtering"),
-            patch.dict("os.environ", {"AICORE_TRANSPARENT_TLS": "true"}, clear=True),
-        ):
-            mock_get_secret.side_effect = lambda name, file_name=None, default="", instance_name="aicore-instance": (
-                self._base_secrets().get(name, default)
-            )
-
-            set_aicore_config()
-
-            assert os.environ["AICORE_CLIENT_ID"] == "test-client-id"
-            assert os.environ["AICORE_AUTH_URL"] == "https://auth.example.com/oauth/token"
-            assert os.environ["AICORE_BASE_URL"] == "https://api.example.com/v2"
-
-    def test_standard_mode_still_sets_client_secret(self):
-        """Regression: without transparent TLS, client_secret is still written."""
-        with (
-            patch("sap_cloud_sdk.aicore._get_secret") as mock_get_secret,
-            patch("sap_cloud_sdk.aicore._get_aicore_base_url", return_value=""),
-            patch("sap_cloud_sdk.aicore.set_filtering"),
-            patch.dict("os.environ", {}, clear=True),
-        ):
-            mock_get_secret.side_effect = lambda name, file_name=None, default="", instance_name="aicore-instance": (
-                {**self._base_secrets(), "AICORE_CLIENT_SECRET": "my-secret"}.get(name, default)
-            )
-
-            set_aicore_config()
-
-            assert os.environ["AICORE_CLIENT_SECRET"] == "my-secret"
-
-    def test_transparent_tls_does_not_call_get_secret_for_client_secret(self):
-        """_get_secret should not be called for clientsecret in transparent TLS mode."""
-        with (
-            patch("sap_cloud_sdk.aicore._get_secret") as mock_get_secret,
-            patch("sap_cloud_sdk.aicore._get_aicore_base_url", return_value=""),
-            patch("sap_cloud_sdk.aicore.set_filtering"),
-            patch.dict("os.environ", {"AICORE_TRANSPARENT_TLS": "true"}, clear=True),
-        ):
-            mock_get_secret.return_value = ""
-
-            set_aicore_config()
-
-            called_names = [c.args[0] for c in mock_get_secret.call_args_list]
-            assert "AICORE_CLIENT_SECRET" not in called_names