fix: retry LookupAccountName with exponential backoff to prevent ERROR_NONE_MAPPED on fresh EC2 instances (#262)

* fix: avoid LookupAccountName for SYSTEM user in named pipe security attributes

When CodeBuild Windows integration tests run with LOGNAME=SYSTEM, getpass.getuser()
returns "SYSTEM" and the subsequent LookupAccountName("", "SYSTEM") call fails with
ERROR_NONE_MAPPED (1332) on freshly started reserved-fleet EC2 instances because the
LSA service hasn't finished initializing.

SYSTEM (S-1-5-18) is a well-known SID constant that never varies across Windows
machines. Use ConvertStringSidToSid("S-1-5-18") to bypass the LSA lookup entirely,
consistent with how the network SID (S-1-5-2) is already handled in the same method.

Fixes intermittent Windows integration test failures in deadline-cloud-for-cinema-4d
and 6 other DCC repos that share the LOGNAME=SYSTEM CodeBuild workaround.

Signed-off-by: leon-li-inspire <2182521+leon-li-inspire@users.noreply.github.com>

* style: fix black formatting in test_named_pipe_helper.py

Signed-off-by: Leon Li <2182521+leon-li-inspire@users.noreply.github.com>

* fix: use real PySID in tests to prevent TypeError on Windows

LookupAccountName mock must return a real PySID object (not a string)
because downstream code passes it to dacl.AddAccessAllowedAce() which
validates the type on Windows.

Signed-off-by: Leon Li <2182521+leon-li-inspire@users.noreply.github.com>

* chore: remove CHANGELOG entry, will be auto-generated at release

Signed-off-by: Leon Li <2182521+leon-li-inspire@users.noreply.github.com>

---------

Signed-off-by: leon-li-inspire <2182521+leon-li-inspire@users.noreply.github.com>
Signed-off-by: Leon Li <2182521+leon-li-inspire@users.noreply.github.com>

Author: leon-li-inspire

src/openjd/adaptor_runtime_client/named_pipe/named_pipe_helper.py

@@ -128,13 +128,23 @@ def create_security_attributes():
         # Get the username of the current user
         username = getpass.getuser()
 
-        # Get the SID for the current user
-        user_sid, _, _ = win32security.LookupAccountName(
-            "",  # systemName: The name of the system or server where the account resides.
-            # Search for the account on the local computer.
-            # If Domain/User Format is used here, it will fetch the Name from the AD.
-            username,
-        )
+        # Retry with exponential backoff to handle ERROR_NONE_MAPPED (1332) which occurs
+        # when the LSA service hasn't finished initializing on freshly started EC2 instances.
+        _LOOKUP_MAX_RETRIES = 3
+        for attempt in range(_LOOKUP_MAX_RETRIES):
+            try:
+                user_sid, _, _ = win32security.LookupAccountName(
+                    "",  # systemName: The name of the system or server where the account resides.
+                    # Search for the account on the local computer.
+                    # If Domain/User Format is used here, it will fetch the Name from the AD.
+                    username,
+                )
+                break
+            except pywintypes.error as e:
+                if e.winerror == 1332 and attempt < _LOOKUP_MAX_RETRIES - 1:
+                    time.sleep(2**attempt)
+                    continue
+                raise
 
         # Users who log on across a network. "S-1-5-2" is a group identifier added to the token of a process
         # when it was logged on across a network.

test/openjd/adaptor_runtime/unit/named_pipe/test_named_pipe_helper.py

@@ -100,3 +100,43 @@ def test_failed_to_generate_pipe_name(self, mock_check_named_pipe_exists, mock_g
             match="Cannot find an available pipe name.",
         ):
             named_pipe_helper.NamedPipeHelper.generate_pipe_name("AdaptorTest")
+
+    @patch("getpass.getuser", return_value="regularuser")
+    def test_create_security_attributes_uses_lookup(self, mock_getuser):
+        win32security = pytest.importorskip("win32security")
+        fake_sid = win32security.ConvertStringSidToSid("S-1-1-0")
+        with patch.object(
+            win32security, "LookupAccountName", return_value=(fake_sid, None, None)
+        ) as mock_lookup:
+            named_pipe_helper.NamedPipeHelper.create_security_attributes()
+            mock_lookup.assert_called_once_with("", "regularuser")
+
+    @patch("time.sleep")
+    @patch("getpass.getuser", return_value="regularuser")
+    def test_create_security_attributes_retries_on_lsa_not_ready(self, mock_getuser, mock_sleep):
+        # ERROR_NONE_MAPPED (1332) is raised when LSA hasn't finished initializing on a
+        # fresh EC2 instance. The lookup should retry with exponential backoff and succeed.
+        win32security = pytest.importorskip("win32security")
+        fake_sid = win32security.ConvertStringSidToSid("S-1-1-0")
+        lsa_error = pywintypes.error(
+            1332, "LookupAccountName", "No mapping between account names and security IDs was done."
+        )
+        with patch.object(
+            win32security, "LookupAccountName", side_effect=[lsa_error, (fake_sid, None, None)]
+        ) as mock_lookup:
+            named_pipe_helper.NamedPipeHelper.create_security_attributes()
+            assert mock_lookup.call_count == 2
+            mock_sleep.assert_called_once_with(1)  # 2**0 = 1s after first failure
+
+    @patch("time.sleep")
+    @patch("getpass.getuser", return_value="regularuser")
+    def test_create_security_attributes_raises_after_max_retries(self, mock_getuser, mock_sleep):
+        # After exhausting all retries, the original error should be re-raised.
+        win32security = pytest.importorskip("win32security")
+        lsa_error = pywintypes.error(
+            1332, "LookupAccountName", "No mapping between account names and security IDs was done."
+        )
+        with patch.object(win32security, "LookupAccountName", side_effect=lsa_error):
+            with pytest.raises(pywintypes.error) as exc_info:
+                named_pipe_helper.NamedPipeHelper.create_security_attributes()
+            assert exc_info.value.winerror == 1332