Add token manager

[MartinHjelmare]

• Consolidate the token reference and refresh into a class.

• The goal is to avoid having multiple token references when using this library in an application. The existing multiple references are allowing the different references to drift apart. Also make the token refresh code simpler, and also the realtime connection less likely to encounter an expired token.

• I need to test the code live for some days, before it could be merged.

closes #448

[MartinHjelmare]

This review is incorrect.

[MartinHjelmare]

I've tested this overnight ok.

[augmentcode]

🤖 Augment PR Summary

Summary:
This PR centralizes Tibber API token state in a shared TokenManager.
Changes:

• Adds a manager that stores tokens, invokes optional async refresh callbacks, and coalesces concurrent refreshes.
• Routes GraphQL, Data API, user-info, and realtime clients through the shared manager.
• Refreshes the token before outbound HTTP requests and before each websocket handshake.
• Overrides the gql websocket initialization hook so internal reconnects obtain a current token.
• Deprecates Tibber.set_access_token and reconnects active realtime sessions after updates.
• Updates fixtures and adds coverage for refresh coalescing, cancellation, and websocket initialization.

Technical notes: Refresh callback failures retain the last known token, while gql continues to manage websocket retries.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

tibber/data_api.py:41 This replaces the publicly exported TibberDataAPI(access_token=...) constructor contract with token_manager: positional callers now pass a str that later fails at async_get_access_token, while keyword callers fail at construction. Other locations where this applies: tibber/realtime.py:35.

Severity: medium

Other Locations

• tibber/realtime.py:35

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[MartinHjelmare]

I don't think the TibberDataAPI is meant to be instantiated on its own. But if we want to make it backwards compatible, I can address this.

[augmentcode]

tibber/token_manager.py:47 An in-flight async_get_access_token() refresh can complete after set_access_token() and overwrite the manually supplied value, so later HTTP/RT calls silently revert to a stale bearer token. This also affects the still-supported deprecated Tibber.set_access_token() path, which calls this setter.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[MartinHjelmare]

The race is only reachable when a refresh_access_token callback is configured and the caller also pushes tokens via set_access_token — which is contradictory usage. Looking at async_get_access_token:

if self._refresh_access_token is None:
    return self._access_token  # no task, no race

Without a callback there is never an in-flight refresh task, so set_access_token is fully deterministic. With a callback, the callback is the single source of truth by design — a completing refresh writing the callback's token is the intended outcome, not a stale revert. I've added docstring notes to TokenManager.set_access_token, Tibber.set_access_token, and TibberDataAPI.set_access_token making this contract explicit.

[Danielhiversen]

Great 👍