auth_budget

Give-up policy for EHR requests the server keeps rejecting as unauthenticated.

A single place decides how many patients in a row may fail authentication before a run is abandoned, so the worker algorithms and the DAG query steps cannot disagree about it.

This is a give-up policy, not a retry policy: FHIRClient already force-refreshes its token and retries once per request, so a failure that reaches the budget has already survived a fresh token. A run of them means the credentials themselves are wrong, and continuing produces one warning per patient — tens of thousands for a large cohort — followed by an empty result set that reads as "this cohort has no EHR data" rather than "the EHR rejected us".

Classes

AuthFailureBudget

class AuthFailureBudget(limit: int = 3):

Tracks consecutive EHR authentication failures across patients.

Arguments

• limit: How many consecutive failures are tolerated before the budget is exhausted.

Variables

• consecutive_failures : int - Failures recorded since the last success.

Methods

---

record_failure

def record_failure(self, cause: BaseException | None = None) ‑> None:

Record an authentication failure, aborting once the budget is spent.

Arguments

• cause: The authentication error, chained onto the raised EHRConnectionError so the original response survives.

Raises

• EHRConnectionError: If this failure exhausts the budget.

record_success

def record_success(self) ‑> None:

Reset the budget after a patient the EHR did answer.

Call this for any outcome that is not an authentication failure — including "patient not found" and unrelated errors — since those prove the credentials are still being accepted.

---