fix: handle TLS 1.3 post-handshake auth errors in _loopback_for_cert_thread (closes #209)

[botbikamordehai2-sketch]

What

When a client uses the TLS 1.3 post_handshake_auth extension and authentication fails, the server can receive an SSL error after the handshake is complete. This exception is currently unhandled in the _loopback_for_cert_thread function, causing a traceback that propagates to the communicate method and breaks request parsing.

Fix

Wrap the wrap_socket call inside _loopback_for_cert_thread in an additional try/except block that catches ssl.SSLError exceptions specifically related to post-handshake authentication failures (e.g., decrypt errors, TLSv1 alert). The existing suppress context manager continues to handle connection/OS errors. The new handler only suppresses known post-handshake TLS 1.3 errors and re-raises unexpected ones.

Closes #209

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 78.15%. Comparing base (2ffb0ba) to head (eea7790).
⚠️ Report is 16 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #824      +/-   ##
==========================================
- Coverage   78.32%   78.15%   -0.17%     
==========================================
  Files          41       41              
  Lines        4788     4792       +4     
  Branches      547      548       +1     
==========================================
- Hits         3750     3745       -5     
- Misses        900      906       +6     
- Partials      138      141       +3     

[read-the-docs-community]

Documentation build overview

📚 cheroot | 🛠️ Build #33074856 | 📁 Comparing eea7790 against latest (2ffb0ba)

  🔍 Preview build  

3 files changed

± history/index.html
± pkg/cheroot.server/index.html
± pkg/cheroot.ssl.pyopenssl/index.html

[avinashkamat48]

The new except ssl.SSLError branch does not actually preserve unexpected SSL errors because it is nested inside the existing outer with suppress(ssl.SSLError, OSError): block. Even when _assert_ssl_exc_contains(...) returns false and the code does
aise, that re-raised SSLError is immediately swallowed by the surrounding suppress, so behavior remains 'suppress every SSLError'. To make the filter meaningful, the selective ry/except needs to live outside the broad suppress or the outer suppress needs to stop including ssl.SSLError.