go-pkgz / auth / 32195636696

86%

Build Type

push

github

Committed by web-flow

Commit Message

fix: cache Apple public keys and close response bodies promptly (#306)

* Cache Apple public keys and close response bodies promptly

Previously, every Apple login fetched the JWK set from Apple's key service,
so a slow or unavailable endpoint turned each login into a 500 even when the
key had already been fetched. The key set is now cached per handler, refreshed
when an id_token names an unknown kid, and kept in use for a bounded window
while the key service is down.

Response bodies in the JWK fetch and the token exchange were closed only after
the read or decode returned, leaking the body on every failure; the close is
now deferred right after the request completes.

The example configured ResponseMode "query", which Apple rejects together with
the non-empty scope the provider sets, so its Apple login returned 500.

* Add coverage for Apple key verification paths

* Reject failed and empty Apple key responses

Apple answers a failing key request with a JSON object, which parses into a
key set holding no keys, so the cache accepted it as a successful refresh and
rejected every login until the entry expired. The fetch now requires a 2xx
response and at least one key, which keeps the previously cached set in use.

Coverage Stats

51 of 52 new or added lines in 2 files covered. (98.08%)

1 existing line in 1 file now uncovered.

3184 of 3701 relevant lines covered (86.03%)

8.91 hits per line