"Cannot re-enter scope: profile:" errors in plugins using ACA-Py 0.12.0rc0 (from injection_context.py)

[loneil]

I've run into an issue in a couple different contexts when testing out using the 0.12.0rc0 ACA-Py image and libraries.

I'm wondering if there's some relation to the changes made here? #2705
Either with multitenancy? Or plugin compatibility? I'm not really sure the root cause...

1. Building and testing multitenant_provider plugin
This is using the plugin from https://github.com/hyperledger/aries-acapy-plugins and the devcontainer and startup/testing instructions there.
Update pyproject aca-py version to 0.12.0rc0 and build in devcontainer.
Unit tests pass
All integration tests failing with

Failed: Failed to create wallet: b'400: Cannot re-enter scope: profile:multitenant_sub_wallet.'

1 example:

2. Updating Traction to 0.12.0rc and running it
Get errors when trying to do anything that creates or accesses a wallet in
Traction Innkeeper plugin
Multitenant provider plugin

Creating wallet on fresh start (Innkeeper plugin):

2024-02-09 13:44:34 Message: "Error creating wallet ('traction_innkeeper')."
2024-02-09 13:44:34 Arguments: (InjectionContextError('Cannot re-enter scope: profile:askar-wallet'),)

Accessing a wallet (Multitenant provider):

raise InjectionContextError("Cannot re-enter scope: {}".format(scope_name))
aries_cloudagent.config.injection_context.InjectionContextError: Cannot re-enter scope: profile:multitenant_sub_wallet

Drilling in more and I find the root cause in

2024-02-09 13:44:34   File "/home/aries/.venv/lib/python3.9/site-packages/aries_cloudagent/core/profile.py", line 40, in __init__
2024-02-09 13:44:34     self._context = context.start_scope(scope)
2024-02-09 13:44:34   File "/home/aries/.venv/lib/python3.9/site-packages/aries_cloudagent/config/injection_context.py", line 82, in start_scope
2024-02-09 13:44:34     raise InjectionContextError("Cannot re-enter scope: {}".format(scope_name))

The aries_cloudagent/core/profile.py", line 40 part is new from what I can tell added from (#2705)
in the 0.12.0rc0 tag at least https://github.com/hyperledger/aries-cloudagent-python/blame/0.12.0rc0/aries_cloudagent/core/profile.py

[loneil]

Hi @dbluhm , @swcurran suggested we check with you about this error I'm seeing.

I haven't tried anything with a plain ACA-Py for this, only involving plugins. So if it's an issue I can't confirm if it's multi-tenancy specific or plugin specific.

[swcurran]

Also flagging @andrewwhitehead on this to see if he might have some insights...

[dbluhm]

I'll spend some time looking into this -- seems likely that this stems from that change I made in #2705

[Ennovate-com]

I am having the same issue with 0.12.0rc0. It seems to be just about every API call, only in an agent configured as multitenant (no plug-ins).

Traceback, with a few messages prior:

2024-02-13 11:50:38,037 aiohttp.access INFO 35.208.48.40 [13/Feb/2024:11:50:37 -0600] "POST /multitenancy/wallet/758add5f-3094-4b7f-a3f9-dbf2be02566a/token HTTP/1.1" 200 345 "-" "Python/3.10 aiohttp/3.8.4"
2024-02-13 11:51:26,263 aries_cloudagent.askar.profile INFO Ledger support is disabled
2024-02-13 11:51:26,270 aries_cloudagent.admin.server ERROR Handler error with exception: Cannot re-enter scope: profile:tenant_wallet
=================
Traceback (most recent call last):
  File "/app/aries_cloudagent/admin/server.py", line 181, in ready_middleware
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/app/aries_cloudagent/admin/server.py", line 218, in debug_middleware
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/dist-packages/aiohttp_apispec/middlewares.py", line 45, in validation_middleware
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/app/aries_cloudagent/admin/server.py", line 386, in check_multitenant_authorization
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/app/aries_cloudagent/admin/server.py", line 404, in setup_context
    profile = await self.multitenant_manager.get_profile_for_token(
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/aries_cloudagent/multitenant/base.py", line 382, in get_profile_for_token
    profile = await self.get_wallet_profile(context, wallet, extra_settings)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/aries_cloudagent/multitenant/askar_profile_manager.py", line 104, in get_wallet_profile
    return AskarProfile(
           ^^^^^^^^^^^^^
  File "/app/aries_cloudagent/askar/profile.py", line 48, in __init__
    super().__init__(context=context, name=opened.name, created=opened.created)
  File "/app/aries_cloudagent/core/profile.py", line 40, in __init__
    self._context = context.start_scope(scope)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/aries_cloudagent/config/injection_context.py", line 82, in start_scope
    raise InjectionContextError("Cannot re-enter scope: {}".format(scope_name))
aries_cloudagent.config.injection_context.InjectionContextError: Cannot re-enter scope: profile:tenant_wallet

[ianco]

Yes weird the integration tests pass, specifically I just re-tested:

AGENT_PORT_OVERRIDE=8030 ./run_bdd -t @T001-RFC0586 -t @GHA -t ~@WalletType_Askar_AnonCreds

... which all pass. Could be related to some difference between how aca-py is configured, e.g. sqlite vs postgres database (integration tests use sqlite), or some other parameter

[ianco]

I suspect there are a limited number of aca-py endpoints affected and they are not included in any of the integration tests.

For example none of the tests do this: POST /multitenancy/wallet/758add5f-3094-4b7f-a3f9-dbf2be02566a/token HTTP/1.1

[jamshale]

I don't understand this profile scope stuff yet, but seems like worse case reverting the change shouldn't be a problem. I haven't ran into it yet doing some multitenant work recently.

[jamshale]

@loneil @Ennovate-com

The revert of the problem got merged. I tested it with the scenario Lucas described but any other testing would be appreciated. You can use the main branch as your aries-cloudagent library in poetry with.

aries-cloudagent = { git = "https://github.com/hyperledger/aries-cloudagent-python.git", branch = "main" }

[swcurran]

I’ll do an 0.12.0rc1 release so that the testing will be easier from a published image.