Exchange per-replica token cache (TTL-bounded LRU, (subject_token, scopes, audience) key) #27

Merged

ginjiruu merged 1 commit from feat/exchange-token-cache into master

2026-09-15 17:20:23 +00:00

ginjiruu commented

2026-09-15 04:55:30 +00:00

Owner

Closes #18

Adds the Exchange Flow's per-replica token cache:

A per-replica, hand-rolled (container/list + map + mutex), TTL-bounded LRU (capacity 1024) keyed by (subject_token, scopes, audience) — audience is the App's own clientID; scopes are sorted+joined.
Two identical Exchange Checks hit the token-endpoint double exactly once (the second is a cache hit, served with the same injected Authorization and header removal).
A miss/eviction (a different key dimension, TTL expiry, LRU eviction at capacity) re-exchanges; a failed exchange is never cached; a miss has no correctness impact (the re-exchange serves the fresh token).
TTL = the endpoint's expires_in (bounded ≤ the access token's exp); an absent/zero expires_in falls back to 60s. The clock is injectable (tests advance time without sleeping).

Verified TDD-first: 8 new tests (hit, different subject token, different scopes, different audience, TTL expiry incl. the within-TTL hit, LRU eviction at capacity, never-cached failure, fresh token on a miss), all RED before implementation and GREEN after. Full suite green (-p 1). Two-axis code review: no hard standard violations; noted for follow-up — the 60s expires_in-absent fallback can over-extend a token whose real lifetime is shorter (the backend 401s; not a mis-authorization).

Closes #18 Adds the Exchange Flow's per-replica token cache: - A per-replica, hand-rolled (container/list + map + mutex), TTL-bounded LRU (capacity 1024) keyed by `(subject_token, scopes, audience)` — audience is the App's own clientID; scopes are sorted+joined. - Two identical Exchange Checks hit the token-endpoint double exactly once (the second is a cache hit, served with the same injected Authorization and header removal). - A miss/eviction (a different key dimension, TTL expiry, LRU eviction at capacity) re-exchanges; a failed exchange is never cached; a miss has no correctness impact (the re-exchange serves the fresh token). - TTL = the endpoint's `expires_in` (bounded ≤ the access token's exp); an absent/zero `expires_in` falls back to 60s. The clock is injectable (tests advance time without sleeping). Verified TDD-first: 8 new tests (hit, different subject token, different scopes, different audience, TTL expiry incl. the within-TTL hit, LRU eviction at capacity, never-cached failure, fresh token on a miss), all RED before implementation and GREEN after. Full suite green (`-p 1`). Two-axis code review: no hard standard violations; noted for follow-up — the 60s `expires_in`-absent fallback can over-extend a token whose real lifetime is shorter (the backend 401s; not a mis-authorization).

ginjiruu added 1 commit

2026-09-15 04:55:31 +00:00

add exchange per-replica token cache: ttl-bounded lru, (subject_token, scopes, audience) key

Lint / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details

E2E Tests / Run on Ubuntu (pull_request) Has been cancelled