Unleash / unleash / 32378987277

87%

master: 91%

Build Type

push

github

Committed by web-flow

Commit Message

fix(tokens): replace linear token scan with a Map lookup

_Stacked on
[feat/revision-probe-metrics](https://github.com/bricks-software/unleash-enterprise/pull/1544),
will merge that one first._

### Issue:

Token lookup was a O(n) scan over every active token:

```ts
	this.activeTokens.find(t => constantTimeCompare(t.secret, secret))
```

Every req walked the whole array. If the token had an alias, that was
twice.


### 🔨 What changed:

Now we have two maps, one for secret and one for alias, so lookup is
O(1).

We keep two maps because the store only queries `tokens.secret`. 
An alias is unqueryable in SQL, so it resolves from memory or not at
all.

What we discovered on the way: The scan compared the presented secret
against every other token, which is what timing attacks target, thus the
`constantTimeCompare` call.

But, as now we have a `map`, it never does that: the key is the secret,
so a hit is already an exact match and the compare could only ever
return true. So, there's no point to keep the `constantTimeCompare`
validation.

### What is 🆕 

- now a token that expires inside the 60s refresh stops authenticating
right away, instead of living until the next refresh
- refactored `getTokenWithCache` - it was 4 nested ifs
- now a token created between refreshes doesn't hit the db on every
request
- added unit tests `token-lookup.test`: scenarios of read-through
indexing, expiry check, etc.

### 🧪 Testing 

From ~28µs to  ~0.0004µs per lookup at 2000 tokens

---------

Co-authored-by: irstavr <irini.stavrakantonaki@getunleash.io>
Co-authored-by: irstavr <irstavr@gmail.com>

Coverage Stats

3865 of 5031 branches covered (76.82%)

54 of 59 new or added lines in 1 file covered. (91.53%)

5 existing lines in 3 files now uncovered.

15924 of 18212 relevant lines covered (87.44%)

752.59 hits per line