Documentation
¶
Overview ¶
Package tokencache provides a generic LRU-bounded token cache for short-lived access tokens. It is provider-neutral: any credential provider that mints tokens with an expiry (OIDC exchange, GitHub App installation tokens, etc.) can use it directly with an arbitrary string key.
Index ¶
Constants ¶
const (
// DefaultMaxEntries is the default maximum number of entries in the cache.
DefaultMaxEntries = 10000
)
Variables ¶
This section is empty.
Functions ¶
func GenerateCacheKey ¶
GenerateCacheKey creates a cache key from the token endpoint, connector ID, and user ID. The key is a SHA-256 hash of the inputs so it is fixed-length and does not expose sensitive values if the cache is inspected.
The userID MUST come from validated, trusted claims (e.g. the "sub" claim after JWT signature verification), not from raw user input. Untrusted values can cause cache poisoning.
Types ¶
type Cache ¶
type Cache struct {
// contains filtered or unexported fields
}
Cache is a generic LRU-bounded token cache for short-lived access tokens.
It is provider-neutral: any credential provider that mints tokens with an expiry can use it with an arbitrary string key. Keys should be constructed so distinct scopes (endpoint, connector, user; or installationID, permissions) get separate entries.
Thread-safe. When the cache reaches its maximum size, the least recently used entry is evicted. Tokens are considered expired 30 seconds before their actual expiry to account for clock skew and network latency.
func NewWithMaxEntries ¶
NewWithMaxEntries creates a new Cache with a custom maximum entry count. Pass 0 for unlimited (not recommended in production).
func (*Cache) Cleanup ¶
Cleanup removes expired tokens. Call periodically in long-running services to prevent memory growth from accumulated expired entries.
func (*Cache) Get ¶
Get retrieves a cached token by key. Returns nil if the token is absent or expired. A successful lookup moves the entry to the front of the LRU list.
type Stats ¶
type Stats struct {
// CurrentEntries is the number of entries currently in the cache.
CurrentEntries int
// MaxEntries is the maximum allowed entries (0 = unlimited).
MaxEntries int
// TotalEvictions is the number of LRU evictions performed.
TotalEvictions int64
// MemoryPressure is the percentage of max capacity used (0-100).
MemoryPressure float64
}
Stats provides cache statistics for monitoring.
type Token ¶
type Token struct {
// AccessToken is the cached access token value.
AccessToken string
// ExpiresAt is when the token expires (after the 30s buffer).
ExpiresAt time.Time
// IssuedTokenType is the RFC 8693 token-type URN of the cached token.
IssuedTokenType string
}
Token holds a cached token with its expiration.
Source Files