Exception in application code does not clear the idempotency key

[shalabhc]

The idempotency key is cleared when a response flows through the send_wrapper here:

asgi-idempotency-header/idempotency_header_middleware/middleware.py

Line 75 in 8f89a5c

await self.backend.clear_idempotency_key(idempotency_key)

and here:

asgi-idempotency-header/idempotency_header_middleware/middleware.py

Line 83 in 8f89a5c

await self.backend.clear_idempotency_key(idempotency_key)

However if the underlying application raises an exception, it does not flow through the send_wrapper so the key is not cleared. The self.app() call can be wrapped in a try/finally to handle that case:

asgi-idempotency-header/idempotency_header_middleware/middleware.py

Line 95 in 8f89a5c

await self.app(scope, receive, send_wrapper)

If there is an exception converted to a 500 or another response by an outer middleware, the idempotency key for that request will not be cleared.

Wrapping the app() in a middleware is a common pattern, eg:

https://github.com/steinnes/timing-asgi/blob/2a0dd6535b740481f4354831a37b92b47a70d4c2/timing_asgi/middleware.py#L70
https://github.com/DataDog/dd-trace-py/blob/6d98a05ff80b572b265fac3562e207f17c2d9adb/ddtrace/contrib/asgi/middleware.py#L291

The change is simple but I am unable to set up a working test environment so I wasn't able to write a test.

[violetta98]

Disclosure first: I maintain a different library in this space, so weigh accordingly. But this one's a genuine design fork and worth spelling out.

When the handler raises, you have to pick: keep the key claimed (so the client can't retry) or release it (so a retry runs the handler again). Neither is right for every case. Transient errors want release. Deterministic ones want the failure replayed, otherwise every retry burns work to fail identically.

I release on exception, on the grounds that transient failures are the common case, and it means a crashed process doesn't wedge the key either. Worth noting the crash case is separate: if the process dies rather than raising, no finally block runs, so cleanup can't be exception-based at all. That needs a lease that expires on its own.

If you want to fix it in place, the shape is: claim on entry, release in finally, plus a TTL on the claim so a hard crash still frees it.

idemkit does this if you'd rather not maintain it: https://github.com/idemkit/idemkit