Exchange per-replica token cache #18

New issue

Closed

opened 2026-09-14 17:04:59 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-14 17:04:59 +00:00

Owner

Parent

#11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener)

What to build

The Exchange Flow's per-replica token cache: repeated machine requests with the same subject token don't hammer the IdP token endpoint — the exchanged token is cached per-replica for its lifetime.

Acceptance criteria

A per-replica, TTL-bounded (≤ the access token's exp) LRU cache keyed by (subject_token, scopes, audience).
Two identical Exchange Checks result in the token-endpoint double being hit only once (a cache hit).
A miss/eviction (a different key, or TTL expiry) re-exchanges; a cache miss has no correctness impact.

Blocked by

#15 — Exchange Check

## Parent #11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener) ## What to build The Exchange Flow's per-replica token cache: repeated machine requests with the same subject token don't hammer the IdP token endpoint — the exchanged token is cached per-replica for its lifetime. ## Acceptance criteria - [ ] A per-replica, TTL-bounded (≤ the access token's exp) LRU cache keyed by `(subject_token, scopes, audience)`. - [ ] Two identical Exchange `Check`s result in the token-endpoint double being hit only once (a cache hit). - [ ] A miss/eviction (a different key, or TTL expiry) re-exchanges; a cache miss has no correctness impact. ## Blocked by - #15 — Exchange Check

ginjiruu added this to the Flow-serving bridge (spec #11) milestone

2026-09-14 17:05:35 +00:00

ginjiruu added the

ready-for-agent

label

2026-09-14 17:08:13 +00:00

ginjiruu referenced this issue

2026-09-15 02:03:14 +00:00

Exchange Check (RFC 8693 token exchange, subject-token read, Authorization injection, 401/403/5xx) #24

ginjiruu referenced this issue from a pull request that will close it,

2026-09-15 04:55:31 +00:00

Exchange per-replica token cache (TTL-bounded LRU, (subject_token, scopes, audience) key) #27