review fixes apr 2026 (#130)

* Multiple fixes

- refresh coordinator dedup + memory pressure wire
- middleware sse consolidation + timer leak + claim cache
- universal cache sync backfill + isDebug gate
- lazy background task race
- memory monitor stw cached + refresh() api

* fix(auth): suppress OIDC redirects on non-navigation requests

- [x] Add isNonNavigationRequest using Sec-Fetch-Mode and Accept headers
- [x] Add comprehensive TestIsNonNavigationRequest
- [x] Update ServeHTTP to 401 non-navigation and AJAX requests

Fixes #129

* feat(config): add custom CA and insecure skip verify for OIDC TLS

- [x] Add CACertPath, CACertPEM, InsecureSkipVerify to Config
- [x] Implement loadCACertPool for CA bundle loading
- [x] Update HTTPClientConfig with RootCAs and InsecureSkipVerify
- [x] Apply CA pool and skip verify to pooled HTTP clients
- [x] Enhance configKey to distinguish TLS configs
- [x] Add comprehensive ca_cert_test.go

Fixes #125

* feat(oidc): add custom CA certificate support for private OIDC providers

- [x] Add caCertPath, caCertPEM, insecureSkipVerify config options
- [x] Update traefik.yml with new OIDC client config fields
- [x] Add configuration schema descriptions for new options
- [x] Update README table and add Custom CA Certificates section

* Fix the documentation.

* test(redis): add oversized argument rejection test

- [x] Add TestRedisConn_RejectOversizedArgumentBytes
- [x] Import strings package

* Dependencies cleanup

settings.go

@@ -1,6 +1,7 @@
 package traefikoidc
 
 import (
+	"crypto/x509"
 	"fmt"
 	"io"
 	"log"
@@ -70,6 +71,46 @@ type Config struct {
 	EnableFrontchannelLogout  bool                             `json:"enableFrontchannelLogout,omitempty"`
 	BackchannelLogoutURL      string                           `json:"backchannelLogoutURL,omitempty"`
 	FrontchannelLogoutURL     string                           `json:"frontchannelLogoutURL,omitempty"`
+	// CACertPath is an optional filesystem path to a PEM-encoded CA bundle used
+	// to verify the OIDC provider's TLS certificate. Use this when the provider
+	// is signed by an internal/private CA that is not in the system trust store.
+	CACertPath string `json:"caCertPath,omitempty"`
+	// CACertPEM is an optional inline PEM-encoded CA bundle, equivalent to
+	// CACertPath but supplied directly in the middleware configuration. Both
+	// may be set; certificates from both sources are combined.
+	CACertPEM string `json:"caCertPEM,omitempty"`
+	// InsecureSkipVerify disables TLS certificate verification for the OIDC
+	// provider. Intended ONLY for local development against self-signed
+	// providers. Enabling this in production is a security hole — prefer
+	// CACertPath/CACertPEM. Emits a loud warning at startup.
+	InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"`
+}
+
+// loadCACertPool assembles an x509.CertPool from CACertPath and CACertPEM.
+// Returns (nil, nil) when neither is configured — callers should fall back to
+// the system trust store. Returns a descriptive error if a PEM source is
+// configured but contains no parseable certificates, so misconfigurations
+// surface at startup rather than as unexplained TLS failures at runtime.
+func (c *Config) loadCACertPool() (*x509.CertPool, error) {
+	if c.CACertPath == "" && c.CACertPEM == "" {
+		return nil, nil
+	}
+	pool := x509.NewCertPool()
+	if c.CACertPath != "" {
+		data, err := os.ReadFile(c.CACertPath)
+		if err != nil {
+			return nil, fmt.Errorf("read caCertPath %q: %w", c.CACertPath, err)
+		}
+		if !pool.AppendCertsFromPEM(data) {
+			return nil, fmt.Errorf("caCertPath %q: no valid PEM certificates found", c.CACertPath)
+		}
+	}
+	if c.CACertPEM != "" {
+		if !pool.AppendCertsFromPEM([]byte(c.CACertPEM)) {
+			return nil, fmt.Errorf("caCertPEM: no valid PEM certificates found")
+		}
+	}
+	return pool, nil
 }
 
 // RedisConfig configures Redis cache backend settings for distributed caching.
@@ -734,6 +775,16 @@ func (l *Logger) Errorf(format string, args ...interface{}) {
 	l.logError.Printf(format, args...)
 }
 
+// IsDebug reports whether debug-level logging is enabled.
+// Callers should use this to avoid expensive format-string expansion
+// (e.g. on hot paths under yaegi) when debug output would be discarded.
+func (l *Logger) IsDebug() bool {
+	if l == nil || l.logDebug == nil {
+		return false
+	}
+	return l.logDebug.Writer() != io.Discard
+}
+
 // newNoOpLogger creates a logger that discards all output.
 //
 // Deprecated: Use GetSingletonNoOpLogger() instead for better memory efficiency.