supabase / auth / 22579487526

69%

Build Type

push

github

Committed by web-flow

Commit Message

feat: cache OIDC discovery documents for providers (#2389)

## Summary
- Add `OIDCProviderCache` with TTL-based expiry, singleflight dedup, and
invalidation support
- Wire cache through all OIDC-based providers (Apple, Azure, Google,
LinkedIn OIDC, Vercel Marketplace, custom OIDC) and the ID token grant
flow
- Make TTL configurable via `GOTRUE_EXTERNAL_OIDC_PROVIDER_CACHE_TTL`
(default: `1h`)


This caches the `oidc.Provider` structs, which avoids re-fetching the
OIDC discovery document (`.well-known/openid-configuration`) on every
request. JWKS caching is handled separately by the `go-oidc` library, it
lazy-loads the key set on the first `Verify` call and manages its own
cache internally.

  ## Test plan
- [x] Unit tests for cache hit/miss, TTL expiry, singleflight dedup,
invalidation, clear, multiple issuers, error handling
- [ ] Verify with live OIDC providers (Apple, Google, custom oidc
providers etc.)

Run Details

100 of 186 new or added lines in 13 files covered. (53.76%)

3 existing lines in 1 file now uncovered.

15805 of 22992 relevant lines covered (68.74%)

78.26 hits per line