Cherry-picked from #194.

Purpose of the PR

• Replace per-operation sign-in/sign-out calls with a single shared AuthenticationObj that both muxed providers (framework + sdkv2) receive at configure time and hold for the entire plugin lifetime.

Linked JIRA issue(s)

• BIPS-38082

Summary of changes

New providers/utils/session.go introduces three functions that own the shared session lifetime:

• InitSharedAuth(cacheKey, build) — lazily builds the AuthenticationObj, calls GetPasswordSafeAuthentication once, and caches both the object and the SignAppinResponse. Subsequent callers with the same key hit the cache; a changed key (e.g., acceptance tests rotating mock servers) signs the old session out first.
• ShutdownSharedAuth() — called from main() after tf5server.Serve returns; signs out and clears the cache. Safe to call multiple times.
• ResetSharedAuthForTest() — test-only helper to clear cache state between acceptance-test cases without making an HTTP round-trip.

providers/utils/methods.go — removed ~77 lines: the package-level globals SignInCount, AuthMu, signAppinResponse, and the Authenticate, SignOut, DeleteAssetByID functions that used them. The refcount-based session management is no longer needed.

main.go — imports utils and calls utils.ShutdownSharedAuth() between tf5server.Serve returning and log.Fatal, because log.Fatal calls os.Exit and would skip any deferred cleanup.

providers/provider_sdkv2/provider.go and providers/provider_framework/provider.go — both providerConfigure/Configure functions now call InitSharedAuth with a deterministic cache key (pipe-joined url|apiVersion|apiKey|clientId|clientSecret|accountName|verifyca|certName). Both providers produce the same key from identical provider-block config, so the second one to configure hits the cache and pays no network cost.

providers/provider_sdkv2/common.go — removed the authenticate() and signOut() wrapper functions; introduced providerMeta struct holding authObj *auth.AuthenticationObj and signAppin entities.SignAppinResponse. providerConfigure now returns *providerMeta instead of a bare *AuthenticationObj.

All sdkv2 resources (folders.go, safes.go, managed_account.go, secrets.go) — replaced m.(*auth.AuthenticationObj) casts with m.(*providerMeta) and removed every authenticate(d, m) / signOut(d, m) call pair.

All framework resources and data sources (assets_resource.go, databases_resource.go, workgroups_resource.go, functional_accounts_resource.go, managed_account_ephemeral.go, secrets_ephemeral.go, and all *_datasource.go files) — removed the per-handler utils.Authenticate + deferred utils.SignOut blocks. The APISignOut helper in managed_systems_by_database_resource.go is also deleted.

assets_resource.go — DeleteAssetByID (the utils helper that wrapped Authenticate+SignOut) replaced with an inline assets.NewAssetObj + assetObj.DeleteAssetById call, since auth and signout are no longer the caller's responsibility.

providers/utils/methods_test.go — rewrote the auth/session test suite against the new API surface (TestInitSharedAuth_*, TestShutdownSharedAuth_*); removed TestAuthenticate, TestSignOut, TestSignOutError, TestDeleteAssetByID. Net result: ~363 lines vs ~600 before.

providers/provider_sdkv2/provider_test.go — added newSignInMockServer helper and utils.ResetSharedAuthForTest() calls so TestProviderConfigureWithApiKey / TestProviderConfigureWithCredentials can exercise the full providerConfigure path end-to-end. Tests now point at a real TLS mock server instead of the fake constant URL.

All sdkv2 test files (folders_safes_test.go, managed_account_test.go, secrets_test.go) — updated call sites from authenticate (bare *AuthenticationObj) to &providerMeta{authObj: authenticate}.

Net change: -519 lines across 33 files.

Checklist

Release

• Priority release required due to Hot fix / Escalation / Critical bug
• Priority release not required (can be released later with other stories or bugs fixes)

Testing

• dev
• automation (required for feature branch merges and significant changes)
• manual (required for feature branch merges and significant changes)

Automation

• no changes are required
• existing tests have been updated
• new tests have been added
• further changes are required by the automation team