stacklok / toolhive / 33774081341

70%

Build Type

push

github

Committed by web-flow

Commit Message

Release per-issuer JWKS refresh workers on auth-server shutdown (#6493)

* Release JWKS refresh workers on auth-server close

MultiIssuerTokenValidator started one jwk.Cache per trusted issuer, each
with an httprc worker pool rooted at context.Background() and stopped by
nothing — so every auth-server reconstruction in a long-lived process
leaked roughly three goroutines per configured issuer, unbounded. This
is the goroutine half of #6479; #6480 fixed only the HTTP-connection
half.

Implements changes for issue #6482:
- Add MultiIssuerTokenValidator.Close, which shuts down each per-issuer
  jwk.Cache (waiting for its workers to drain) and cancels the
  validator-scoped context the pools are now rooted in
- Root the caches in that validator-scoped context instead of
  context.Background()
- Clean up already-started caches on a partial construction failure
- Build the shared validator up front in buildProvider whenever trusted
  issuers exist, return it, and hold it on the server so Close and
  newServer's deferred error path both release it
- Update the CloseIdleConnections Scope note: Close now releases the
  workers; that function deliberately does not, to stay safe on a live
  server

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Address code review feedback

- Close the validator in the newMultiValidator test helper via t.Cleanup
  so the suite no longer leaks a JWKS worker pool per issuer across its
  call sites (the leak class this change fixes in production)
- Cancel the validator-scoped context first in Close, then drain each
  cache, so a slow-draining pool is already unwinding before its Shutdown
  is reached and Close no longer serializes on each pool's full timeout;
  this also matches the construction-failure path's ordering

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Require a shared validator for trusted-issuer factories

The exported tokenexchange.Factory and JWTBearerIssuanceFacto... (continued)

Coverage Stats

57 of 87 new or added lines in 4 files covered. (65.52%)

11 existing lines in 4 files now uncovered.

77663 of 111082 relevant lines covered (69.92%)

92.24 hits per line