Security & correctness hardening: auth flow, cache, recovery, DCR, docs (#155)

* Audit review (rounds 1-31): fix confirmed issues, remove dead code, harden tests

Security/correctness fixes:
- fail-open token validation preserved with lenient-audience; access token that
  fails verification and has no ID token to corroborate now fails closed
- token_manager blacklist-expiry: fix impossible tautology (x>24h && x<24h)
- constant-time OAuth state compare; clear state/nonce/code_verifier on
  callback token-exchange failure to prevent replay of half-failed flows
- StopAllTasks gated on last-instance close
- background-task panic recovery; remove task-registry counter leak
- circuit breaker half-open: release probe slot; CB + per-session outcome
  recorded once per refresh operation, not once per waiter
- Redis connection pool: handle nil receive when pool closed concurrently
- FileStore: atomic temp-write + rename
- errors_recovery health-check data race -> atomic

Test-isolation / hardening:
- reset helpers for Once-pinned global cache manager and transport pool
- coverage: utils 70->93% (redirect URL security contract); fuzz targets for
  bearer parsers; concurrent ServeHTTP race tests for the shared request path

Dead-code removal (verified orphaned, build+suite green): internal/providers
(30 files, 0 importers), internal/compat, internal/features, input_validation.

Verified: govulncheck, go mod tidy, yaegi-validate, cross-compile (darwin+
linux), golangci-lint (new-from-rev clean), 3x full race+shuffle green.

* Lint: fix real int-truncation bug; document intentional gosec findings

- TransportPool configKey: write conn-count ints verbatim (strconv) instead of
  byte() truncation — a config value >=256 previously truncated and made two
  distinct configs collide on one key, silently sharing a transport with the
  wrong settings (real fix, gosec G115).
- Document design-intentional gosec findings with //nolint:gosec + rationale:
  G117 (clients_secret intentionally marshaled into stored creds JSON),
  G704 (tokenURL is the trusted discovery endpoint), G124 (delete/test cookie,
  Secure set conditionally), G118 (long-lived background refresh) and pool
  utils short-ID rune, testutil mock server redirects.

Result: full-tree golangci-lint now reports 0 issues (was ~12). Build, vet,
and the full test suite remain green.

* Fix singleton ResourceManager data race (unlocked read vs test reset)

GetResourceManager returned the process-global via an unprotected read
(singleton_resources.go:50), while resetResourceManagerForTesting and
ResetResourceManager write it under resourceManagerMutex. A live background
task (graceful-degradation health check started by one test) reading the
singleton while a shuffled test resets it was a data race (found via
-race -shuffle: Write at singleton_resources_test.go:941/942 vs Read at
autocleanup.go:554 / error_recovery.go:910).

Fix: hold resourceManagerMutex around the read, matching the sibling
GetGlobalTaskRegistry (autocleanup.go:414). Added a deterministic
concurrent regression test (GetResourceManager vs reset under -race).

Verified: 4x full -race -count=1 -shuffle=on ./... all exit 0, 0 races,
0 fails; source-order suite green; lint clean.

* Fix 6 issues surfaced by adversarial agent team (round 35)

Concurrency/lifecycle (P1, highest-value):
- singleton_resources.go: RegisterBackgroundTask now REPLACES a stopped
  task instead of reusing it. BackgroundTask.Start is sync.Once-guarded,
  so a task stopped on instance close and re-registered (Traefik
  close+recreate for the same provider) was permanently dead: IsTaskRunning
  returned false (started && !stopped) so callers retried a start that
  was a no-op. Metadata refresh, token cleanup, and health checks now
  resume across a recreate cycle.
- error_recovery.go: the shared graceful-degradation health task was
  bound to the FIRST instance's performHealthChecks (later instances'
  checks never ran) and any instance's Close stopped it for all. Added a
  global live-instance registry; the shared task runs every instance's
  checks and is stopped only when the last instance closes (mirrors the
  singleton-token-cleanup gate).

Storage/cache:
- hybrid.go recordL2Error: Store(now) then immediately compared
  time.Since(t)<1s against its own write => ALWAYS fired, so a single
  transient L2 error flipped the whole cache into fallback (full L2
  bypass -> upstream stampede). Now enters fallback only on a PRIOR
  error within the window (true "multiple errors"). Updated two tests
  that had encoded the old single-error-fallback bug.
- redis_pool.go: ConnectionPool.Put checked closed but sent on
  p.connections without holding p.mu; Close closed it under p.mu.
  Window => 'send on closed channel' panic at shutdown. Put now holds
  p.mu (the lock only Close used).

HTTP/transport:
- jwk.go fetchJWKS: added an explicit >1 MiB guard (was silent partial
  read, could yield a truncated keyset and spurious missing-kid).
- http_client_pool.go configKey: now includes every transport-behavior
  field it actually consumes (compression, HTTP2, keep-alives, timeouts,
  buffer sizes, dial) so behaviorally different configs no longer share
  one transport built with the first config's settings.

Each fix has a regression test. Verified: full source-order suite green,
golangci-lint 0 issues, 3x full -race -count=1 -shuffle=on ./... all exit 0.

* Fix round-36 issues: DCR validation, auth-method default, shared metadata task, replay false-positive

Four verified fixes from the round-36 agent team (each confirmed against source
before acting):

- settings.go: Config.Validate now skips the client-credential block when
  Dynamic Client Registration is enabled and no clientID is pre-provisioned
  (RFC 7591 provides credentials at registration). Previously the
  unconditional 'clientID is required' made DCR unreachable via New.
- dynamic_client_registration.go: default registered token_endpoint_auth_method
  to client_secret_post to match the plugin's runtime default; an enforcing
  IdP would otherwise reject the plugin's token exchange.
- utilities.go: gate the shared per-provider singleton-metadata-refresh task
  stop on lastInstance (matching singleton-token-cleanup) so one instance's
  tear down no longer kills 2h metadata refresh for a surviving sibling.
- token_manager.go: stop self-recording the JTI into the per-instance
  tokenBlacklist on every verify. On the cookie path the same valid token is
  re-presented per request; an LRU eviction of the raw-token cache (MaxSize
  1000 / 5 MiB) then turned a legitimate cache miss into a false 'token
  replay detected'. Replay tracking stays in the shared shardedReplayCache.

Regression tests: new review_r36_regression_test.go (4 tests); updated
dynamic_client_registration_test.go and security_edge_cases_test.go which had
encoded the old defaults.

Verified: full source-order suite, full -race -count=1 -shuffle=on ./...
(all packages), and golangci-lint run ./... (0 issues).

* Fix dead CircuitBreaker.ResetTimeout config (round 39)

error_recovery.go: ResetTimeout was copied into the CircuitBreaker but never
consulted by the state machine (used only for a metric), so the documented
"how long to wait before fully closing the circuit" (reset_timeout, default
30s) had no effect: Open->HalfOpen used Timeout (60s), and a single
half-open success closed the circuit immediately, losing the intended
open -> half-open -> (reset cooldown) -> closed hysteresis and letting a
stray success immediately reopen (bounce).

Now the circuit remains half-open after entering it until resetTimeout has
elapsed; only then can a successful request fully close it. Half-open
requests are still allowed as probes. Default behavior is more
conservative (up to Timeout+ResetTimeout before full close).

Tests: updated TestCircuitBreakerHalfOpenTransition to the corrected
semantics; added TestCircuitBreakerResetTimeoutEnforced (fails on the old
dead-field code, where resetTimeout was ignored).

Verified: full source-order suite, full -race -count=1 -shuffle=on ./...
(all packages), golangci-lint run ./... (0 issues).

* Apply configured conn limits in pooled transport (round 41)

http_client_pool.go SharedTransportPool.GetOrCreateTransport built the shared
http.Transport with hardcoded MaxConnsPerHost=5, MaxIdleConnsPerHost=2,
MaxIdleConns=10, IdleConnTimeout=30s while HTTPClientConfig's versions of
those fields drove configKey (cache identity) and were validated and tuned
per preset (Default: 20/10/50/30s; OIDCProvider: 50/25/100/90s). The
config was thus valid, keyed, and validated but silently ignored in the
transport used by main.go (CreatePooledHTTPClient) - dead config that left
OIDC-provider connection tuning without effect. The sibling factory path
(http_client_factory.go) already applied these values.

Now the pooled transport derives MaxConnsPerHost, MaxIdleConnsPerHost,
MaxIdleConns, and IdleConnTimeout from the config, consistent with the
factory path and with configKey.

Test: added TestSharedTransportPoolAppliesConfigLimits, which fails on the
old hardcoded code (fixed values) and passes now.

Verified: full source-order suite, full -race -count=1 -shuffle=on ./...
(all packages), golangci-lint run ./... (0 issues).

* Harden redirect-count accessors against pooled-session data race (round 44)

* Fix bearer Authorization template strip order + nonce constant-time compare (round 45)

* Sanitize claim-derived identifier on auth-bypass headers (round 48)

* R51: guarantee openid scope in buildAuthURL when filter drops it

* R53: enforce 2048-bit minimum RSA key size on verify

* R54: refresh JWKS on unknown-kid to pick up key rotation

* R55: blacklist session tokens on user logout

* R56: honor RateLimit config as sustained req rate

* R57: FIFO eviction; keep fresh replay JTIs in cache

* R58: idempotent RefreshCoordinator Shutdown; no close-close

* R59: honor backend TTL on cache repopulation

* R60: accept single-string groups/roles; fix mem over-evict

* R61: detect truncated chunked token via stored total

* R62: drain queued tasks on goroutine pool shutdown

* R63: Shutdown waits for in-flight refresh goroutines

* R64: cap metadata cache grace by configured limits

* R65: validate ES client-assertion key curve matches alg

* R66: check expiry on lenient-audience token path

* R67: apply allowedRolesAndGroups gate to SSE/WS bypass

* R68: cache expiry TOCTOU, logout open-redirect, session max-age

* R69: fix double pool-return on session-timeout path

* R70: pooled-client cookie jar, refresh Save-failure cleanup

* R71: SSE/WS allowlist, session max-age, sec headers

* R72: validate combined cookie chunk metadata

* R73: logout jti replay, expired ajax, no-value

* R74: recv handler panics, cache TTL race fix

* R75: azure unauth copy-paste, dcr guard, cookie domain

* R76: dcr singleflight, L1 no-resurrect, TLS loopback

* R77: bearer allowedUsers gate, session inUse CAS

* R78: hybrid Clear flush, reauth reacquire, pool CAS

* R79: invalidation ttl tracks maxage, empty tpl hdr

* R80: req secret for introspection, pool conn on panic

* R81: reject empty access token on callback+refresh

* R82: req discovery endpoints, single-use code retry

* R83: DCR require client_secret for confidential auth, validate redirect_uri scheme; reject callback query/fragment

* R86: atomic SetIfAbsent for replay cache; close double-accept and singleton-read race

* R87: validate backchannel logout token exp; live-refresh JWKS for logout kid-miss

* R88: make StopAllTasks cover ResourceManager singleton tasks

TaskRegistry.CreateSingletonTask delegates to ResourceManager.RegisterBackgroundTask
and stores the task in the ResourceManager's registry, not TaskRegistry.tasks.
TaskRegistry.StopAllTasks previously iterated its own (always-empty) registry,
silently leaking every process-global singleton task's ticker goroutine past the
last Close (memory-monitor, replay-cache-cleanup) — tasks kept running real
periodic work with no instance to serve.

Add ResourceManager.StopAllTasks (stops all rm-owned tasks) and have
TaskRegistry.StopAllTasks stop both its own RegisterTask-direct tasks and the
ResourceManager-owned singletons.

Regression TestR88StopAllTasksStopsResourceManagerOwnedTasks (review_r88_test.go):
fails on old code (task still running after StopAllTasks), passes on new.

* R89: normalize excluded-url paths; apply defaults to pooled HTTP clients

Two verified defects from R89 scout round:

1. Excluded-URL dot-segment traversal widening (P1, auth bypass).
   shouldBypassAuth passes req.URL.Path raw (middleware.go:54); Go's server
   leaves '..' in URL.Path (url.ParseRequestURI does not normalize), so an
   exclusion for /public also matched /public/../admin, letting a real
   sibling (/admin) reach the backend unauthenticated. pathExcluded now
   path.Clean()s the request path ('.' -> '' to preserve root semantics)
   before boundary matching. Regression TestR89ExcludedPathDotTraversal
   fails on old (all 4 traversal cases wrongly excluded), passes on new.

2. Pooled HTTP client had no zero-value defaults (P2, unbounded stall).
   CreateHTTPClient applies defaults; CreatePooledHTTPClient and
   GetOrCreateTransport did not, so a partial config yielded Timeout=0 and
   ResponseHeaderTimeout=0 (a hanging upstream stalls forever). Extracted
   applyHTTPClientDefaults (single source of truth) and applied it in all
   three construction paths; pool cache key now reflects normalized values.
   Regression TestR89PooledClientAppliesDefaults fails on old, passes on new.

R89 clean/declined: session max-age IS absolute-and-enforced-every-request
(verified, review_r68 already locks it); AllowedUserDomains fail-closed (P2
'*' not a wildcard, P3 TrimSpace — declined as config-scoped).

* R92: validate all time claims on lenient-audience access tokens

On the lenient-audience path (validateStandardTokensRS), jwt.Verify
short-circuits at the aud check before reaching exp/iat/nbf validation,
leaving every time claim unvalidated. accessTokenUnexpired previously
re-patched only 'exp' (the R66 fix), so a token with a not-yet-reached
'nbf' but a valid exp was trusted for authorization before it was valid.

accessTokenUnexpired now re-applies the full main-path time validation:
verifyExpiration, verifyIssuedAt (iat required), and verifyNotBefore when
present — all clock-skew-aware. Regression TestR92LenientPathRejectsFutureNbf
(plus valid control) fails on old code (future-nbf token accepted), passes on
new.

R92 clean/declined: bearer auth (aud enforced, full claims — clean);
refresh rotation (correctly bound to session; no local reuse detection =
design); logout cookie completeness (all chunk names cleared, no revive;
two P3 non-security notes declined).

* fix(auth): harden OIDC flow, token validation, session, and bearer handling

- replay entry covers exp + clock-skew window; callback GET-only (RFC 6749)
- callback rate-limit returns 429 + Retry-After; panic-recovery sets no-store
- cross-chunk integrity for chunked tokens; bounded chunked-token read scan
- HTTPError classification so 5xx/429 token-endpoint responses retry
- redaction of token/code/state in logs; per-source external auth gate

* fix(cache): harden cache backends, resilience, recovery, and transports

- RESP -ERR no longer closes healthy conn / aborts batch; global cap replacement-aware
- global health-check pass serialized (latent data race); MemoryMonitor via ResourceManager
- token-exchange retry, open-circuit rejections counted as failures
- TLS-posture matching transport reuse (no silent InsecureSkipVerify handoff)

* fix(config,dcr): env fallbacks, DCR self-heal, per-source auth gate

- implement documented OIDC_* env fallbacks; hold metadataMu for clientAssertion write
- re-register client when client_secret expires; require secret for confidential
- add opt-in per-source external auth rate limiting (PerSourceLoginRateLimit)

* docs: complete config reference and config examples

- CONFIGURATION.md: add 11 previously-omitted optional parameters
- README: document 6 implemented-but-undocumented options
- fix example config (raw .env block made invalid YAML)

* build: pin toolchain to go1.26.6 (resolves 5 reachable stdlib CVEs)

- net/http, asn1, idna GO-2026 CVEs cleared; govulncheck now 0 findings

* fix(jwk): use time.Since for elapsed-time computation (S1012)

* test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

* test: mark synthetic PKCE verifier with trufflehog:ignore

Quiet the Lob detector's false positive on the fake test-only code_verifier,
matching the repo's existing // trufflehog:ignore convention in token_test.go.
Local trufflehog filesystem scan is now 0 verified / 0 unverified.

* fix(circuit-breaker): stop open-circuit rejections from re-arming the open timer (FIX-01)

ExecuteWithContext called the promoted BaseRecoveryMechanism.RecordFailure()
on every request rejected while the circuit is open. RecordFailure sets
lastFailureTime, the same field allowRequest read as the Open->HalfOpen
timer, so each rejection re-armed the timer. Under steady traffic shorter
than Timeout the breaker never left Open (the default-on token breaker,
token_resilience.go:31-36, is affected in production).

CircuitBreaker now tracks its own openedAt timestamp, set only on a
genuine Closed->Open or HalfOpen->Open transition in recordFailure.
allowRequest and IsAvailable gate on openedAt instead of lastFailureTime.
An open-circuit rejection still increments total_failures directly via
atomic.AddInt64, preserving the R180 metrics contract, but no longer
touches lastFailureTime or the open timer.

Adds TestCircuitBreakerOpenRejectionsDoNotExtendOpenWindow, which opens
the breaker (MaxFailures 1, Timeout 50ms) and sends a probe every 10ms;
it fails at head because no probe is ever admitted within 500ms.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(circuit-breaker): ignore terminal client errors in the breaker state machine (FIX-09)

After FIX-01, an ordinary fn() error still trips recordFailure(), which
reopens a half-open circuit unconditionally and holds it half-open for a
full ResetTimeout (15s/30s in production). A per-user HTTPError such as
invalid_grant from a replayed code is not a downstream-health signal, so
under a 1% user-error rate roughly 78% of half-open cycles reopened for
another ResetTimeout, extending real outages.

recordFailure() is now skipped for a terminal client error (HTTPError
4xx other than 429); the promoted RecordFailure() metrics counter still
runs, since the operation did return an error to its caller. 429 and
non-HTTPError failures (network errors, 5xx) are unaffected and still
trip the state machine.

Adds three regression tests: a half-open probe returning HTTPError 400
must stay half-open and later close on success (fails at head: reopens);
HTTPError 429 and a net.OpError must still reopen half-open (already
passing, pinned as a guard against over-broadening the exemption).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(retry): stop single-use retry from matching HTTP response bodies (FIX-14)

ExecuteSingleUseWithContext substring-matched singleUseRetryableErrors
against the raw err.Error() text. helpers.go returns a *HTTPError whose
Message carries up to 10 KiB of the token-endpoint response body once a
response is received, so an IdP 500 that happened to mention "connection
refused" in its own body was retried up to MaxAttempts times even though
the request had definitely reached the server. Re-sending a consumed
authorization code or a rotated refresh token surfaces invalid_grant or
triggers refresh-token-family revocation on rotating IdPs.

Adds isNeverSentError: an *HTTPError (a response was received) is never
retried, and the fragment match now applies only to a genuine *net.OpError
(a dial/connect failure), the concrete type net/http.Client.Do returns
before any request reaches the wire.

Adds TestExecuteSingleUseWithContextNeverRetriesAfterHTTPResponse, which
fails at head (fn called 3 times instead of 1) and passes after the fix,
plus a guard that a real dial error is still retried.

Updates the existing TestRetryExecutor_SingleUse_RetriesPreSendError
(review_r82_test.go) to simulate the dial failure as a *net.OpError
instead of a bare string, matching what client.Do actually returns; the
bare-string form no longer satisfies the tightened, type-based match.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(circuit-breaker): address review for FIX-09

isTerminalClientError used errors.As(err, &httpErr) against an
interpreted *HTTPError target. Under yaegi v0.16.1 (Makefile:9) this
panics with "errors: *target must be interface or implement error",
regardless of the error's own concrete type. CircuitBreaker calls
this on every fn() error, on the default-on token-exchange/refresh
path, so every failed exchange or refresh panicked the goroutine
instead of returning its error, and the panic on the refresh path
(refresh_coordinator.go, an unrecovered goroutine) crashed the
process. Switch to a plain type assertion: the production error
reaches the breaker unwrapped, so no Unwrap chain walk is needed.

Extend cmd/yaegicheck/main.go to drive CircuitBreaker.ExecuteWithContext
under the real interpreter: a plain error (the first call shape that
panicked), a half-open 400 (must stay half-open), a closed-state 400
(must stay closed), and a 429 (must still reopen half-open). make
yaegi-validate now fails on the pre-fix code and passes after.

Also add a Closed-state regression test pinning the existing scope
choice (the terminal-client-error exemption applies to Closed as well
as HalfOpen, not only HalfOpen): a 400 leaves the breaker Closed, and a
following genuine 5xx still opens it. This is coverage-only -- the
Closed-state behavior itself already matched this before the change,
confirmed by running the new test against the pre-fix code (PASS).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(retry): address review for FIX-14

isNeverSentError used errors.As(err, &httpErr) against an interpreted
*HTTPError target. Under yaegi v0.16.1 (Makefile:9) this panics with
"errors: *target must be interface or implement error", regardless of
the error's own concrete type. ExecuteSingleUseWithContext calls this
on every fn() error, on the default-on authorization-code-exchange and
refresh path, so every failed exchange or refresh panicked instead of
returning its error. Switch to a plain type assertion: the production
error reaches here unwrapped, so no Unwrap chain walk is needed. The
errors.As(err, &opErr) match against *net.OpError is untouched -- a
compiled stdlib type, yaegi-safe.

Also narrow the *net.OpError match to Op "dial" or "proxyconnect".
isNeverSentError previously matched singleUseRetryableErrors against
ANY *net.OpError, including "read"/"write", which happen after the
connection is already established and the single-use request may
already have reached the IdP. Only a failed connect proves the request
never went out. Correct the doc comment, which claimed a *net.OpError
is always pre-wire -- it is not.

Extend cmd/yaegicheck/main.go to drive
RetryExecutor.ExecuteSingleUseWithContext under the real interpreter: a
*HTTPError whose Message happens to contain a retryable-looking
fragment (must be called once, never retried) and a real client.Do
dial failure against a closed local port (must be retried to
MaxAttempts). make yaegi-validate now fails on the pre-fix code and
passes after.

Add a regression pinning the Op-scoping fix: a *net.OpError{Op: "read"}
carrying syscall.EHOSTUNREACH is not retried by
ExecuteSingleUseWithContext (fn called once). Confirmed this fails
against the pre-fix code (fn called 3 times) before applying the fix.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(recovery): stop gdInstances leak from TokenResilienceManager (FIX-18)

Register GracefulDegradation in gdInstances synchronously in
NewGracefulDegradation, before the health-check goroutine starts. A
Close() that ran immediately after construction could otherwise race
the async registration and delete nothing, then the later registration
would add an already-closed instance permanently.

Add Close to ErrorRecoveryManager and TokenResilienceManager.
NewTokenResilienceManager builds its own ErrorRecoveryManager (and
therefore its own GracefulDegradation), separate from the plugin
instance own errorRecoveryManager. Production Close() only ever closed
the first one, so the second leaked in gdInstances forever and the
shared health-check task last-instance stop gate never fired.

TraefikOidc.Close now calls Close on both managers.

Regression test TestFix18_ClosingBothManagersEmptiesGDInstances fails
to build at head (Close undefined on both managers) and passes after
the fix.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(tasks): keep pending singleton task instead of orphaning it (FIX-19)

RegisterBackgroundTask replaced any existing task with
started==0 && stopped==0, including one that is merely pending its
first Start() call. CreateSingletonTask (and the two other call sites
sharing its Register-then-Start pattern) does not hold tasksMu across
that sequence, so a second concurrent caller lands in that window and
replaces a task the first caller is about to start. The first caller
then starts an object no longer reachable from the registry, and
StopAllTasks/Shutdown never reach it again.

Add a startRefused flag to BackgroundTask, set on Starts refused by
the circuit breaker or the concurrency limiter (the two early-return
paths that leave started==0 and stopped==0 permanently).
RegisterBackgroundTask now replaces an existing task only when it is
stopped or its one Start attempt was refused, keeping a task that is
simply not started yet.

review_r122_test.go pinned the old "started==0 && stopped==0 always
means replace" behavior with a fixture that force-sets those fields
directly, without ever exercising a real Start() rejection. Update the
fixture to also set startRefused=1, the precise signal that case now
carries, preserving the R122 invariant (a circuit-breaker-rejected
task is still always replaced) alongside the new one.

Regression test TestFix19_RegisterBackgroundTaskKeepsPendingTaskNoOrphan
fails at head (orphan task keeps ticking after StopAllTasks: 13 -> 25)
and passes after the fix.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(lifecycle): re-check last-instance under shared mutex before stop (FIX-35)

Close() decided whether it was the last live instance once, early
in its shutdown sequence (unregisterLiveInstance return value), then
reused that boolean much later to gate three separate singleton
stops (singleton-token-cleanup, singleton-metadata-refresh-*, and
the general StopAllTasks). Session and cache teardown run in
between, taking real time, during which a concurrently-created new
instance (an overlapping Traefik reload) can register and adopt the
same singletons. The stale decision then stops them anyway, leaving
the surviving instance with no memory monitor, token cleanup, or
metadata refresh until the next reload.

Add liveInstanceMu, taken by registerLiveInstance,
unregisterLiveInstance and a new isLastInstanceNow. Close() now calls
isLastInstanceNow() fresh, immediately before each of the three
singleton stops, instead of reusing one early decision.

main.go now calls registerLiveInstance before New adopts the
memory-monitor singleton (previously called after), so a concurrent
Close elsewhere always sees a new instance counted before it can
decide to stop the singletons that instance depends on.

Regression test
TestFix35_ConcurrentNewKeepsSingletonAliveAcrossOldClose fails to
build at head (isLastInstanceNow undefined) and passes after the fix.
A throwaway scratch probe (not committed) confirmed the runtime bug
independently: reproducing the old stale-decision pattern inline
wrongly stops memory-monitor even after a new instance registered and
adopted it.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(refresh): reject CoordinateRefresh after Shutdown, correct stale ctx comments (FIX-36)

CoordinateRefresh called wg.Add(1) unconditionally, with no check
on rc.stopChan, so a request arriving during or after Shutdown still
registered and ran a new refresh operation. go doc sync.WaitGroup.Add
requires that Adds with a positive delta happening when the counter
is zero happen before a Wait; an Add racing the last Done during an
in-progress Wait can panic with WaitGroup misuse.

Add lifecycleMu (RWMutex). CoordinateRefresh now takes RLock around
its stopChan check and its wg.Add(1) call; Shutdown takes Lock()
before closing stopChan. Lock() cannot succeed while any
CoordinateRefresh call holds RLock, so every Add that will ever
happen has completed before Shutdown reaches wg.Wait().
CoordinateRefresh called after Shutdown now returns an error instead
of running.

The comment on the isNew branch claimed in-flight refreshes "are
aborted promptly via rc.ctx when stopChan closes" - rc.ctx does not
exist. An initial version of this fix added it, deriving
executeRefreshAsync timeout context from it and canceling it in
Shutdown, so Shutdown would return before a genuinely in-flight
refresh finished. That directly regressed two existing, deliberately
written tests - TestRefreshCoordinator_ShutdownWaitsForInFlight
(review_r154) and TestRefreshCoordinatorShutdownWaitsForInflight
(review_r63) - which pin that Shutdown must wait for an in-flight
refresh to finish naturally, not abandon it (avoiding a leaked
refresh goroutine). This fix keeps that contract: Shutdown still
waits via wg.Wait(), bounded only by each operation own
RefreshTimeout, and the stale comments are corrected to describe
that behavior accurately instead of a rc.ctx mechanism that does not
exist.

Regression test TestFix36_CoordinateRefreshRejectedAfterShutdown
fails at head (CoordinateRefresh after Shutdown wrongly succeeds
and runs refreshFunc) and passes after the fix. The R63/R154 tests
were re-run and confirmed still green.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(refresh): replace timing-margin sleeps with deterministic waits (FIX-22)

Four tests raced the 100ms DeduplicationCleanupDelay cleanup timer
with a 150ms fixed sleep, a 50ms margin. A late timer let the next
call join the previous operation instead of starting a new one,
under-counting circuit-breaker/rate-limit attempts on loaded CI
runners. A fifth test (internal/cache/backends) raced singleflights
own 100ms delayed-cleanup goroutine the same way.

Set DeduplicationCleanupDelay=0 on the four RefreshCoordinator tests
(TestRefreshCoordinatorIntegration CircuitBreaker and RateLimiting
subtests, TestCircuitBreakerProtection,
TestRefreshCoordinator_SuccessOnlyAfterCombinedOperations), matching
the pattern already used elsewhere in refresh_coordinator_test.go.
Delay=0 alone is not fully deterministic: close(operation.done) and
the synchronous cleanup call are two separate statements in the same
deferred closure, so a waiter woken by the channel close can run
concurrently with, and observe the map entry before, that same
goroutines next statement. Confirmed this manually: an
intermediate delay-only version (no polling) failed 1 run out of 20
under -race -shuffle=on with the exact under-counting symptom the
finding describes.

Add waitForRefreshDrain, which polls
RefreshCoordinator.inFlightRefreshes for the tokens removal instead
of sleeping a fixed margin, and use it in all four loops. For
internal/cache/backends/review_r141_test.go, poll
SingleflightCache.calls under its own mutex the same way, per the
todo acceptance criterion.

All four tests plus the r141 test now pass go test -race -count=20
-shuffle=on with no fixed sleep at the previously-flaky sites, and
keep their existing assertions.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(refresh): assert bounded Shutdown and goroutine exit (FIX-23)

TestRefreshCoordinatorShutdownStopsCleanup called Shutdown() with no
assertion, so it passed on base regardless of whether Shutdown
actually stopped the cleanup goroutine. Only the sibling
TestRefreshCoordinatorShutdownIdempotent caught anything (a panic on
double-close).

Assert Shutdown returns within a 2s deadline, then independently
observe the cleanup goroutine exit via rc.wg (the same WaitGroup
Shutdown wg.Wait() depends on, bracketing exactly cleanupRoutine).

Mutation check performed and reverted: temporarily removing the
"case <-rc.stopChan: return" branch from cleanupRoutine makes the
test fail with "Shutdown did not return within the deadline" (the
goroutine loops on the ticker forever, wg.Done() never fires).
refresh_coordinator.go is unmodified in this commit (git diff
--stat shows only review_r58_shutdown_test.go); the mutation was
applied and reverted locally to prove the pin is live before this
commit.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(recovery): address review for FIX-18

Fix the close-before-goroutine race the review reopened: delete the
duplicate async registration in startHealthCheckRoutine (only
NewGracefulDegradation registers now), and make the goroutine check
gd.stopChan under gd.mutex before creating or adopting the shared
health-check task, so a closed instance can never (re)start it.

Close() now stops the shared task by name via
GetResourceManager().StopBackgroundTask instead of reading this
instance own gd.healthCheckTask field. With two or more instances,
that field can still be nil on the last-closing instance even though
a sibling already started the shared task, which would have skipped
the stop and leaked the task.

Close every remaining GracefulDegradation NewWithContext can leak: add
a deferred cleanup that closes t.errorRecoveryManager and
t.tokenResilienceManager on any error return after they are
constructed.

Add TestFix18_CloseImmediatelyAfterNewDoesNotReRegister (pins the
exact race; fails deterministically pre-fix, green across
-count=300 -cpu=1,4,16 post-fix), TestFix18_TraefikOidcCloseEmptiesGDInstances
(drives the real TraefikOidc.Close instead of calling the managers
Close directly), and TestFix18_NewWithContextClosesManagersOnEarlyError
(pins the NewWithContext error-path leak). Make the existing
TestFix18_ClosingBothManagersEmptiesGDInstances wait for each
instance async health-check goroutine to settle before closing, via
the new gd.healthRoutineSettled helper, so it exercises the
task-already-assigned path deterministically instead of sometimes
racing the goroutine.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(lifecycle): address review for FIX-35

Close the check-then-stop window the review reopened: isLastInstanceNow
released liveInstanceMu as soon as it returned, before the actual
singleton stop ran (StopBackgroundTask / StopAllTasks, which can block
up to 5s per task). A concurrent New() could register and adopt the
very singleton in that gap, and the stop would kill it anyway.

Add stopIfLastInstance, which holds liveInstanceMu across both the
check and the stop callback, and use it at all three gated stops in
Close() (singleton-token-cleanup, singleton-metadata-refresh-*,
StopAllTasks) in place of the bare isLastInstanceNow() check.

Add TestFix35_StopIfLastInstanceHoldsLockAcrossCheckAndStop, which
proves the lock is genuinely held for the stop full duration (a
concurrent registerLiveInstance cannot complete while a slow stop
callback is still running). Rewrite
TestFix35_ConcurrentNewKeepsSingletonAliveAcrossOldClose to drive the
real (*TraefikOidc).Close via a new closeTestHook (nil in production,
invoked once in Close right after unregisterLiveInstance) instead of
re-implementing Close stop decision inline — the previous version
stayed green even with the production fix fully reverted, since it
never called Close at all.

Both new tests fail to build pre-fix (stopIfLastInstance and
closeTestHook are new symbols); green post-fix across
-count=50 -cpu=1,4,16.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(session): expire chunk cookies before writing replacement chunks (FIX-05)

SetRefreshToken and SetIDToken re-Get and fill the new chunk sessions
before calling the expire helper for the old ones. gorilla Registry.Get
returns the same cached *sessions.Session per cookie name for a request,
so the expire pass re-Gets the objects this call just wrote and wipes
their Values, silently dropping the replacement token.

Reorder both methods to match SetAccessToken: validate chunk count,
sizes and reassembly first (pure computation, no store.Get), then
expire the old chunks, then Get and fill the new ones. A session whose
refresh or ID token was loaded from existing chunk cookies and gets
replaced with another token that also needs chunking no longer loses
the new token.

Adds fix05_session_chunk_replace_test.go, adapted from
.claude/review-2026-09-10/repro/zz_g1_chunkwipe_test.go and
zz_g1_chunkwipe_id_test.go with helpers and test names renamed to
describe the behavior pinned.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(session): gate deferred pool-return on ownership generation (FIX-10)

ServeHTTP defers session.returnToPoolSafely() right after GetSession.
The invalidated-session paths deeper in the same request (backchannel/
frontchannel logout detection) can session.Clear() that exact object
and re-acquire a fresh one before ServeHTTP returns. The deferred call
stays bound to the original pointer regardless, so if a concurrent
request pops the same pooled object before this deferred call fires,
its CompareAndSwap(true, false) still succeeds against the new owner
and Reset()s a session another request is actively using (ABA on the
pool-return CAS).

Add a generation counter to SessionData, bumped once by GetSession and
newSession on every handout. ownerGeneration() reads the current
value; returnToPoolIfOwner(gen) only acts if the generation still
matches what the caller captured at acquire time, so a stale deferred
call from a previous ownership epoch is a deliberate no-op instead of
releasing a live session. ServeHTTP now captures the generation right
after GetSession and defers returnToPoolIfOwner instead of the plain
call.

This is the generation-counter alternative the finding names, chosen
over nil-ing the deferred pointer: the Clear+reacquire happens inside
processAuthorizedRequestRS/processAuthorizedRequest, separate
functions from the ServeHTTP-scope defer, so nil-ing a local variable
there cannot reach the already-bound deferred call.

Adds fix10_session_pool_aba_test.go, adapted from
.claude/review-2026-09-10/repro/zz_g1_aba_test.go with the helper
names and test renamed, and rewritten to drive the ABA sequence
deterministically (the pool handing back the same object after Clear
is unspecified sync.Pool timing, not part of the fixed contract, and
did not reproduce on every run).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(middleware): require real preflight headers for the OPTIONS auth bypass (FIX-02)

shouldBypassAuth bypassed OIDC auth for any request whose method is
OPTIONS. A genuine CORS preflight always carries both an Origin header
and an Access-Control-Request-Method header; gating on the method
alone let an unauthenticated OPTIONS on any protected path reach the
backend with no session check. Reproduced against http.FileServer:
200 with the protected file body, no cookie, no Origin.

Require both headers before treating an OPTIONS request as a
preflight bypass. A genuine preflight still bypasses unconditionally;
every other OPTIONS request now goes through the normal auth
pipeline.

Adds fix02_options_bypass_test.go covering shouldBypassAuth directly
(bare OPTIONS, Origin-only, and a genuine preflight) plus an
end-to-end ServeHTTP reproduction of the leak and its fix. Updates the
existing TestShouldBypassAuth_PassesOptions in review_r124_test.go
(touched_outside) to send a genuine preflight instead of a bare
OPTIONS, since it asserted the vulnerable bypass-on-method-alone
behavior.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(middleware): drop oversized ID token header instead of truncating (FIX-34)

forwardAuthorized truncated an ID token longer than headerTemplateMaxLen
(8192 bytes) and still set X-Auth-Request-Token to the truncated value.
A truncated JWT is structurally invalid: a downstream that verifies the
signature rejects it (fine), but one that only base64-decodes claims
without verifying reads a corrupted value.

Drop the header instead of truncating, matching the fail-closed
pattern already used for X-Forwarded-User / X-Auth-Request-User in the
same function when identifier sanitization fails.

Adds fix34_idtoken_header_test.go (oversized token drops the header;
in-budget token still forwards unmodified). Updates
review_r155_regression_test.go (touched_outside): its existing test
asserted the header was truncated to exactly headerTemplateMaxLen
bytes, which is the behavior this fix replaces; renamed to
TestR155_XAuthRequestToken_DroppedWhenOverHeaderBudget and rewritten
to assert the header is absent.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(middleware): hand next.ServeHTTP the real writer, not the tracking wrapper (FIX-06)

ServeHTTP wraps rw in *trackingWriter (rw = tw) for panic-commit
tracking and then forwards that SAME wrapped writer to every
t.next.ServeHTTP call: excluded, SSE, WebSocket, options bypass, the
default case, and forwardAuthorized (the authenticated path). Traefik
runs the plugin interpreted under yaegi v0.16.1, whose stdlib interop
layer composes a boundary wrapper only for ResponseWriter+Hijacker
crossing into compiled code, never for Flusher or the Unwrap pattern
http.ResponseController relies on. So Traefik's compiled ReverseProxy
calling http.NewResponseController(rw).Flush() for SSE gets "feature
not supported" in production, even though trackingWriter declares
Flush/Unwrap and native tests (which never cross an interpreter
boundary) pass.

Reproduced with a throwaway yaegi run probe (not committed; yaegi
v0.16.1, GOPATH/bin/yaegi) mirroring trackingWriter exactly:
  wrapped:   ResponseController.Flush err=feature not supported, recorderFlushed=false
  unwrapped: ResponseController.Flush err=<nil>,                 recorderFlushed=true
matching the finding's own reproduction.

Add downstreamWriter(rw), used at every t.next.ServeHTTP call site: it
unwraps *trackingWriter to the real writer ServeHTTP received, and
marks the trackingWriter's new calledNext field so the deferred
recover (which may run in a different function than the call site, via
forwardAuthorized) knows control passed downstream.

Handing next the real writer means wroteHeader can no longer observe
writes next makes directly (it bypasses tw entirely). The deferred
panic recovery is updated to skip its fallback 500 once calledNext is
true: guessing in that state risks appending "Internal Server Error"
to a response next already committed, which TestR155_ServeHTTP_
PanicAfterCommitKeepsBodyIntact exists to prevent and is the more
severe failure mode. A panic in the middleware's own pre-forward code
is unaffected and still gets a clean 500
(TestR179_PanicRecoverySetsNoStore). Updates review_r74_test.go
(touched_outside): its existing assertion that a downstream (next)
panic forces a 500 is no longer achievable without that same
corruption risk; rewritten to assert the recovered-but-unwritten
default (200) Go's http.Server already gives any handler that returns
without writing.

Adds fix06_downstream_writer_test.go: asserts next receives the
unwrapped writer on the SSE, WebSocket and authenticated
(forwardAuthorized) paths.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(middleware): make FIX-06 actually load and behave correctly under yaegi (FIX-06)

trackingWriter now declares Header() explicitly instead of relying on
the embedded http.ResponseWriter promotion. yaegi v0.16.1 does not
count a promoted method when it statically checks whether
*trackingWriter satisfies http.ResponseWriter, so the plugin refused
to load under yaegi at all ("missing Header method"), invisible to
every native test. Verified with a temp GOPATH symlinked to this
worktree (the shared GOPATH symlink resolves to the main checkout, not
this branch) via `yaegi run ./cmd/yaegicheck/main.go`: FAIL before
this change, OK after.

ServeHTTP's panic-recovery defer now sends a header-only 500
(Cache-Control: no-store) whenever nothing was written through the
tracking wrapper, even after control has passed to next
(tw.calledNext). WriteHeader is idempotent, so this is a no-op if next
already committed its own response; only the fallback body Write is
still gated on !calledNext, since only a body Write can corrupt an
already-committed response. Previously the whole 500 was skipped once
calledNext was true, so a downstream panic before any write produced
an empty 200 instead of a 500, telling the client a failed request
succeeded. review_r74_test.go is restored to asserting 500 (its
925d627 baseline), with comments updated for the new behavior.

Adds cmd/yaegiflushcheck, a nested Go module (its own go.mod, so it
never enters the root module's build/vendor graph) that drives the
real plugin under yaegi with a COMPILED next handler calling
http.NewResponseController(w).Flush(), reproducing the finding
end-to-end rather than only at import time. Confirmed it fails
("feature not supported") when downstreamWriter is reverted to not
unwrap the tracking writer, and passes ("err=<nil>") against the fix.
fix06_downstream_writer_test.go's dangling reference to a
never-committed fix06_yaegi_probe.go now points at this file.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(middleware): discard the response body on a forged CORS preflight (FIX-02)

The FIX-02 header check (Origin + Access-Control-Request-Method) rules
out an accidental bare OPTIONS request but not a deliberate attacker:
any non-browser client can set both headers itself, and
bypassReasonOptions still forwarded that unauthenticated request to
next with no session check. Reproduced against http.FileServer: a
forged preflight with no cookie still returned the protected file's
body.

This exceeds what the FIX-02 todo originally asked for, so flagging
for maintainer sign-off (see the fixes report's concerns) even though
it is implemented here: severity is major with a concrete exploit, and
leaving it undone seemed worse than the scope overrun.

ServeHTTP's bypassReasonOptions case now hands next an
optionsPreflightWriter instead of the raw writer. It forwards
Header()/WriteHeader() (deleting any Content-Length next sets, since
no body follows) but discards every Write(). A browser never reads a
preflight response body, so a genuine CORS preflight keeps working
unchanged (TestServeHTTP_GenuinePreflightReachesBackend still passes);
a forged one can no longer read protected content through this path.
Declares Header/Write/WriteHeader explicitly rather than relying on
the embedded http.ResponseWriter's promotion, for the same yaegi
reason as trackingWriter (FIX-06): confirmed the plugin still loads
clean under yaegi (cmd/yaegicheck) with this change.

Adds TestServeHTTP_ForgedPreflightDoesNotLeakBody, which reproduces
the finding's own repro (http.FileServer, forged Origin +
Access-Control-Request-Method, no cookie) and asserts the body never
reaches the caller.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(bearer): gate opaque-token introspection and bind it to the client (FIX-03)

buildPrincipalFromOpaqueIntrospection accepted any introspected
active=true token from the IdP, with none of the JWT-path gates: it never
checked allowOpaqueTokens, never bound the response to this client when
audience==clientID (the common default), and never consulted
isSessionInvalidated or bearerIdentifierClaim/sanitizeBearerIdentifier/
maxTokenAge. A token issued to an unrelated client at the same IdP could
authenticate as any user, and IdP-initiated logout did not revoke an opaque
bearer token.

Gate the opaque branch behind the existing allowOpaqueTokens flag (no new
config knob). When audience==clientID, require resp.ClientID==clientID or
an aud containing clientID. Apply the identifier claim, sanitization,
maxTokenAge (resp.Iat) and isSessionInvalidated (by sub; RFC 7662 carries
no sid) the same way the JWT bearer path does. Update review_r159 and
review_r166 fixtures to set allowOpaqueTokens and a matching client_id, and
document the gated contract in docs/BEARER_AUTH.md.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(introspection): stop treating introspection 4xx as token-revoked (FIX-13)

R156 (8640451) mapped any 400-499 status from the introspection endpoint
to a definite "token invalid" verdict, on the session path
(token_validation_rs.go) and both bearer-path introspection call sites
(bearer_auth.go). RFC 7662 s2.2 defines only a 200 response with
active=false as inactive; s2.3 defines a 401 as the plugin own client
credentials being rejected, not a statement about the token. A rotated
client_secret or an IdP 429 therefore turned every valid token into a 401,
fed the bearer per-IP penalty box, and forced a refresh storm on the
session path.

Remove the 4xx-as-invalid special case at all three sites so those errors
fall into the existing generic handling: bearerErrIntrospectionUnavailable
(503) on the bearer path, and the existing requireTokenIntrospection-gated
fail-closed / transient-fallthrough on the session path. Only a 200
response with active=false still rejects the token. Update the R156
fixture that pinned the old (now superseded) 401-forces-refresh contract,
and document the corrected 401/503 split in docs/BEARER_AUTH.md.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(bearer): fail closed on logout invalidation when iat is absent (FIX-24)

buildPrincipalFromBearerToken derived the backchannel-logout invalidation
createdAt from iat, falling back to time.Now() when absent. 8640451 made
iat OPTIONAL in jwt.Verify (R126), so an access token without iat now
reaches this check. The time.Now() fallback made such a token always look
newer than any logout event, so IdP-initiated logout never revoked it,
reintroducing the R98 defect the cookie path already avoids by falling
back to the zero time instead.

Fall back to the zero time (fail closed) instead of time.Now(), matching
sessionCreatedAtForInvalidation on the cookie path. Also correct the stale
comment on enforceIatAge, which claimed jwt.Verify still hard-requires iat.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(bearer): stop sweeping in-progress failure counters (FIX-28)

recordFailure map-growth sweep deleted every entry whose penaltyUntil was
before the cutoff. An entry that has not tripped the penalty box yet has a
zero penaltyUntil, which is always before any cutoff, so once the map
passed defaultBearerEntrySweepThreshold every accumulating counter was
discarded regardless of how recently it started. An attacker who floods
many distinct source IPs (or one interleaving its own failures with
sweeps) could keep any one source below the threshold forever.

Delete an entry only when it is BOTH untripped-or-expired AND outside the
counting window: penaltyUntil.Before(cutoff) AND firstFailureAt is older
than the window. A fresh, still-accumulating counter now survives a sweep;
only entries that have genuinely gone stale are reclaimed. Update the R214
memory-bound test: a fresh flood within the window is now expected to grow
past the threshold (that is the fix, not a regression), while entries that
age past the window still get swept, which the rewritten test verifies in
a second phase.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(jwt): share the time-claims contract between Verify and the lenient path (FIX-27)

accessTokenUnexpired (the lenient-audience-path re-check that runs after
jwt.Verify short-circuits at the aud check) still hard-required iat, even
though 8640451 made iat OPTIONAL in jwt.Verify itself per RFC 7519 4.1.6
(R126). The two paths had drifted onto different contracts for the same
claim: an iat-less lenient-audience access token was always forced to
refresh or re-authenticate, while the identical token with a matching
audience passed through jwt.Verify fine.

Maintainer confirmed the iat-optional contract (R126) stands. Extract the
exp/iat/nbf validation shared by both paths into one verifyTimeClaims
helper in jwt.go and use it from both jwt.Verify and accessTokenUnexpired,
so the two cannot independently drift on which time claims are mandatory
again. Both R92 fixtures (which carry iat) keep passing.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(bearer): amortize the failure-tracker map-growth sweep (FIX-28)

recordFailure swept the whole entries map on every call once the map
crossed defaultBearerEntrySweepThreshold, even when the sweep found
nothing stale to delete. A flood of distinct source IPs (attacker-
controlled) turned this into O(n) work under b.mu on every call, O(n^2)
to fill the map, while blocked() waits on the same mutex on every
bearer request.

Add nextSweepAt, which doubles after each sweep (bounded below by
defaultBearerEntrySweepThreshold), so the scan runs only when the map
has genuinely grown, amortizing its frequency to logarithmic in the
flood size instead of linear. Add sweepPasses to count scans for
tests.

Rewrite TestBearerFailureTrackerSweepBoundsMemory phase 2 to record
failures until the next amortized sweep actually fires, then assert
the aged keys are gone, rather than asserting a fixed total-size
bound that the amortized gate no longer holds to on every call. Add
TestBearerFailureTrackerSweepAmortized: 30,000 fresh distinct sources
must trigger at most 6 sweep passes (HEAD triggers on ~29,000 calls).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(bearer): close 3 opaque-introspection gaps: sid logout, iat bound, identifier claims (FIX-03)

buildPrincipalFromOpaqueIntrospection had three gaps against the JWT
bearer path it mirrors:

- isSessionInvalidated was always called with an empty sid, so a
  sid-only (front-channel) logout never revoked an opaque token, even
  when the IdP introspection response itself carried a sid. Add Sid
  to IntrospectionResponse and pass resp.Sid through.
- maxTokenAge was applied only when resp.Iat > 0, silently skipping
  the bound on a response with no iat, unlike enforceIatAge on the
  JWT path (which fails closed on a missing iat once maxAge is set,
  and New() always sets it > 0). Route the opaque-path check through
  enforceIatAge itself so the two paths cannot drift again.
- The identifier claims map was built from sub/username only, so any
  other bearerIdentifierClaim value (client_id, scope, iss, jti, aud)
  always 401d with "missing claim", even when the introspection
  response carried it.

Add regression tests for all three (sid-only logout, missing iat with
maxTokenAge set, bearerIdentifierClaim=client_id). Add iat to the
R159/R166 introspection fixtures, which otherwise now fail the
enforced age bound under makeBearerOIDC's 24h maxTokenAge default.
Document the opaque iat requirement and the sid-only logout scope in
docs/BEARER_AUTH.md.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(introspection): stop classifying session-path introspection errors by IdP body text (FIX-13)

validateOpaqueToken wraps introspectTokens *HTTPError for a non-200
introspection response, and HTTPError.Message embeds up to 10 KiB of
the IdPs own response body. validateStandardTokensRS substring-matched
that message for "token is not active", "revoked" or "token has
expired" before reaching the transient/fail-closed branch, so a
401/403/429 whose body happened to contain one of those words (e.g.
the IdPs OWN client-secret-revoked error, RFC 7662 s2.3) still forced
a refresh, even though only a 200 response with active=false may
reject the token.

Detect an *HTTPError via errors.As before the substring match and
route it straight to the requireTokenIntrospection/transient handling.
Only validateOpaqueTokens own generated messages (active=false,
expired, nbf — never an *HTTPError) still reach the substring
classification. Add a regression test: a 401 with "revoked" in the
body, requireTokenIntrospection=false, must not force a refresh.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(bearer): correct maxTokenAge opt-in comments (FIX-24)

The enforceIatAge and TestBearerLogoutInvalidation_NoIatFallsClosedNotOpen
comments called maxTokenAge>0 an "operator opt-in": false. New()s
config-default closure (main.go:357-362) always sets maxTokenAge > 0 —
0/unset becomes 24h — so enforceIatAge rejects every iat-less bearer
JWT in production, opt-in or not. Only a test that constructs
*TraefikOidc directly (bypassing New()) can set maxTokenAge=0.

Reword both comments to state this, and note that the zero-time
createdAt fallback for the logout-invalidation check is mostly
defense in depth given that in production: it is what protects an
iat-less token only when maxTokenAge is explicitly 0 or the object
bypasses New(), since enforceIatAge otherwise rejects the token first.

No behavior change. Separately, docs/BEARER_AUTH.md:164 and
docs/CONFIGURATION.md:288 state "0 disables the check", which
contradicts main.go:357-362 (0 becomes 24h, it is never actually
disabled) -- flagged to the lead as a pre-existing doc/code mismatch
outside this packages scope, not fixed here.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): stop deleting applied-but-slow backend writes on Set failure (FIX-04)

RedisBackend.executeWithRetry checked ctx.Err() before err==nil, so a SET
that completed after the caller gave up waiting reported as failed even
though Redis applied it. UniversalCache.Set then issued a Delete on any
backend Set error, erasing the value that write just landed.

Reorder executeWithRetry to return nil immediately on a successful
operation, before consulting ctx.Err(). Skip the Delete in
UniversalCache.Set when the error is a context deadline/timeout (the
write may have applied), and unconditionally for MonotonicMarkers caches
(blacklist, session invalidation), whose entries are revocation markers
and are never stale regardless of the failure reason.

Adds MonotonicMarkers to UniversalCacheConfig, set for the blacklist and
session-invalidation cache configs in universal_cache_singleton.go.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): add blacklist to getLocal RLock fast path (FIX-15)

The blacklist cache moved to CacheTypeBlacklist but the getLocal fast
path only gained CacheTypeIntrospection, so every blacklist lookup fell
to the exclusive c.mu.Lock(). tokenBlacklist.Get runs on the verify path
for every authenticated request, so this re-created the RLock-convoy
pattern (a single expired entry serializing every concurrent JWT verify
under yaegi) the fast path exists to prevent.

Add CacheTypeBlacklist to the fast-path case list.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): read legacy token: namespace on blacklist miss (FIX-16)

The R128 rename moved the blacklist cache backend namespace from
CacheTypeToken (token:<key>) to CacheTypeBlacklist (blacklist:<key>) with
no migration. Revocation markers written before the upgrade (TTL up to
24h) were ignored after it, and mixed-version replicas in a rolling
deploy did not share revocations, since old and new instances read and
write different namespaces.

On a blacklist miss, also read the legacy token:<key> backend entry.
Treat it as blacklisted only when the stored value deserializes to
boolean true, so a CacheTypeToken claims-map entry for the same raw
token is never misread as a revocation marker. Writes stay on the new
blacklist: namespace only.

Upgrade note: operators upgrading through this release keep denying
tokens revoked by a pre-upgrade instance for the lifetime of the
revocation marker (up to 24h). The legacy-namespace read is a one-release
compatibility shim; a future release can drop checkLegacyBlacklistMarker
and legacyBlacklistPrefix in universal_cache.go once all replicas have
rolled forward past the R128 rename.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): use PTTL and a no-expiry sentinel for Get TTL (FIX-31)

RedisBackend.Get read TTL (second precision), which maps both "no
expiry" (-1) and "under one second left" to a reported ttl of 0.
UniversalCache.Get treated any ttl<=0 as DefaultTTL, so a key on the
verge of expiring in Redis got re-cached locally for the cache's full
DefaultTTL, up to 25h for the session-invalidation cache, well past the
real expiry of the entry.

Switch Get to PTTL (millisecond precision) and return the distinct
NoExpiryTTL sentinel for a key with no associated expiry. Update
UniversalCache.Get to federate DefaultTTL only for that sentinel, and to
skip repopulating the local copy for any other non-positive ttl instead
of defaulting to DefaultTTL.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): address review for FIX-04

Replace the anonymous-interface errors.As in isTimeoutOrDeadlineError
with the compiled net.Error pattern already used in error_recovery.go.
Under yaegi v0.16.1, errors.As against `var x interface{ Timeout() bool
}` panics with "errors: *target must be interface or implement error"
when the plugin package is interpreted the way Traefik loads it (GOPATH
self-import, not `go test`). Every non-context Set error on a
non-monotonic cache panicked UniversalCache.Set in Redis mode. Verified
this session: repointing the ~/.go/src GOPATH symlink to this worktree
(make yaegi-validate otherwise silently validates the main checkout,
see the yaegi-validate-gopath-symlink memory note) reproduces the exact
panic on the old code and confirms it is gone on the new code, both via
a standalone repro script and via a new cmd/yaegicheck guard
(checkUniversalCacheSetDoesNotPanicOnBackendError) that make
yaegi-validate now runs on every call.

Add the backend-stale local-write guard the FIX-04 todo asked for.
Skipping the post-failure Delete (timeout error, or a MonotonicMarkers
cache) leaves the backend holding whatever was there before the failed
Set. Get() previously trusted that backend value unconditionally,
reopening R162 for a deadline-erroring Set that never applied, and
silently masking a newer session-invalidation logout with an older
Redis timestamp when the newer Set's write failed. UniversalCache now
tracks a per-key backend-stale mark (staleBackend, cleared by the next
successful backend Set and by item removal/eviction/Clear); Get()
prefers the live local value over the backend value for a marked key
instead of overwriting it via updateLocalCache. Corrects the
MonotonicMarkers doc comment, which claimed session-invalidation
entries are "never stale" - they are Unix timestamps compared by
value, so an older one really can be stale next to a newer one.

Add SkipAutoCleanup/Close to the FIX-04 and FIX-16 test caches that
were leaking a cleanup goroutine and ticker per test run.

Tests: TestFIX04_TimeoutSetFailureServesFreshLocalNotStale,
TestFIX04_SessionInvalidationNewerLogoutDeadlineServesFreshLocal,
TestFIX04_SessionInvalidationNewerLogoutErrorReplyServesFreshLocal
(new); existing TestFIX04_*, TestFIX16_*, TestR162_* re-run clean.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): address review for FIX-31

Correct the NoExpiryTTL godoc: it said the sentinel covers "Redis PTTL
-2/-1", contradicting the very next sentence, but Get only maps PTTL
-1 to NoExpiryTTL. PTTL -2 (and 0) map to a reported ttl of 0, same as
an about-to-expire key.

Tighten TestFIX31_GetWithRealTTLReportsPositiveDuration with a lower
bound near the set TTL. The prior assertions (ttl>0, ttl<=10s) do not
pin the millisecond-precision PTTL contract: reproduced this session
by mutating Get back to `conn.Do("TTL", ...)` while still reading the
reply as milliseconds — both FIX-31 backend tests still passed, and a
10s key reported "10ms" as its TTL. The new `ttl>9s` bound fails on
that same mutation ("10ms" is not greater than "9s") and passes on the
real PTTL-based code.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): address review for FIX-16

Reword the legacy-blacklist-namespace comment in Get(). It claimed
mixed-version replicas "share revocations" during a rolling deploy,
but the shim is one-directional: an upgraded replica still honors a
revocation a pre-upgrade replica wrote under the legacy "token:"
namespace (checkLegacyBlacklistMarker on a "blacklist:" miss), but a
pre-upgrade replica has no knowledge of "blacklist:" and never sees a
revocation an upgraded replica writes. Writes stay on the new
namespace only, unchanged.

Comment-only change; TestFIX16_* re-run clean.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache/redis): drain array after nested -ERR reply (FIX-37)

readArray returned early on the first nested "-ERR" element, leaving
declared-but-unread elements on the connection. Do treats
ErrCommandReply as non-fatal and returns the connection to the pool, so
the leftover bytes could be read as the reply to the next command on
that connection (response desync).

readArray now keeps reading past a nested command-error reply, storing
it as the element value, and only aborts on a genuine IO or protocol
error.

Regression test proves a nested -ERR no longer aborts the array read
and that a subsequent reply on the same stream is not corrupted by
leftover bytes.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache/redis): surface pipeline command errors in GetMany (FIX-38)

Pipeline.Execute stores a Redis command-error reply (e.g. LOADING,
WRONGTYPE) as an error value in the responses slice instead of failing
the batch. GetMany ran that value through RESPString, which always
failed on an error value, and counted the failure as a cache miss with
no log. A command error therefore looked identical to "key not found".

GetMany now recognizes an error-valued response, keeps it out of the
miss count, and returns it wrapped with the offending key. Other keys
in the same batch still populate the result map.

Regression test proves a WRONGTYPE reply for one key is surfaced as an
error, not silently dropped, while a good key in the same batch still
comes back.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* chore(cache): remove unreachable internal/cache dead code (FIX-43)

Grep confirms no non-test code imports traefikoidc/internal/cache, and
NewMemoryBackend/NewHybridBackend have no production caller anywhere
(only tests of the twins themselves). The production cache path is
UniversalCache over the root-level backends package; R64/R68/R74/R76/
R78 fixes to these twins had no production effect, and R64 duplicates
logic that already exists in universal_cache.go (unchanged).

Removed:
- internal/cache (parent package): cache.go, manager.go, typed_cache.go,
  compat.go, log_redact.go, and their tests.
- internal/cache/backends: memory.go, memory_shard.go, memory_wrapper.go,
  hybrid.go, and their tests. FIX-20 (hybrid.go asyncWg race) is
  superseded by this removal and is not fixed.

Tests that exercised the deleted MemoryCacheBackend/cacheShard/
MemoryBackend/HybridBackend internals directly are removed with them
(review_r76/78/99/124/125/139_f2/177_regression_test.go under
backends, race_regression_test.go). Tests that used NewMemoryBackend
only as a convenient CacheBackend substrate for still-alive production
code (singleflight.go, review_r141/r212 stress tests, and the root
package JWKCache tests via NewMemoryBackendForTest) now build that
substrate from a miniredis-backed RedisBackend instead. Assertions are
unchanged.

The redis.go retry classifier depended on a small case-insensitive
contains/toLower helper that had been living in hybrid.go; moved to a
new stringutil.go so the redis backend keeps working standalone.

go list ./... no longer lists internal/cache (only backends and
resilience remain); build, vet and the full race test suite are green.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache/backends): delete now-unused redactKey (FIX-43)

redactKey had callers only in the deleted hybrid.go. staticcheck U1000
and a full golangci-lint run both flagged it as unused after the FIX-43
deletion. Delete it and move the package doc comment it carried onto
interface.go, replacing that file's stale singular-typo comment.

staticcheck ./... and golangci-lint run ./... (no --new-from-rev) both
report 0 issues in internal/cache/backends after this change.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache/backends): treat nested nil array elements as values (FIX-37)

readArray aborted on a nested "$-1" or "*-1" element by returning
ErrNilResponse, leaving trailing array elements unread on the wire.
Do() treats ErrNilResponse as a healthy-connection signal and keeps
the connection pooled, so the next command desyncs onto the leftover
bytes. This is the same desync the nested "-ERR" fix already handles.

Store nil for a nested ErrNilResponse and keep draining the array,
mirroring how Pipeline.Execute already treats ErrNilResponse as a
non-fatal per-command value. Top-level "$-1"/"*-1" still return
ErrNilResponse unchanged.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(cache/backends): assert misses counter on GetMany command error (FIX-38)

The regression test only checked the returned error and the good key
result, not the misses counter, so the todo acceptance criterion
"does not increment misses" went unenforced.

Snapshot GetStats() before and after GetMany and assert misses is
unchanged and hits goes up by exactly one. Verified the test catches
the regression by temporarily reintroducing r.misses.Add(1) in the
resp.(error) branch: the test fails with "expected: 0 actual: 1" on
the misses assertion. Reverted the mutation; redis.go has no diff.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(test): close miniredis in NewMemoryBackendForTest (FIX-43)

NewMemoryBackendForTest started a miniredis server as a local variable
and never closed it. Callers only deferred backend.Close(), which
closes the RedisBackend pool, not the miniredis listener, so each
call leaked a listener and its goroutines for the rest of the test
binary.

NewMemoryBackendForTest now takes *testing.T and registers the
miniredis server against t.Cleanup(mr.Close), matching the pattern
already used by NewMiniredisServer and setupTestRedis in
internal/cache/backends. Updated both call sites (review_r124_test.go,
review_r130_test.go) to pass t.

New regression test in memory_backend_for_test_leak_test.go dials the
miniredis address after the owning subtest ends and asserts the
connection is refused. It fails against the pre-fix helper (dial
succeeds, listener still up) and passes after the fix.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(cache): fix comments referencing deleted FIX-43 files (FIX-43)

Several comments still pointed at code the FIX-43 dead-code deletion
removed: sharded_cache.go and review_r129_test.go cited
internal/cache/backends/memory_shard.go, and review_r34_regression_test.go
cited a nonexistent hybrid TestRecordL2Error. interface_test.go claimed
the RedisBackend contract subtest actually runs, but setupRedisBackend
also t.Skips, so TestCacheBackendContract currently exercises neither
subtest.

Reword each comment to drop the stale references and, for
interface_test.go, state plainly that both subtests are pending
t.Skip stubs.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(jwk): bound repeat JWKS fetches after a failed refresh (FIX-30)

doLiveRefresh recorded the force-refresh cooldown only after a
successful fetch (R100), so every unknown-kid bearer request and every
backchannel-logout token hit the JWKS endpoint again during an IdP
outage, with no throttling at all.

Record a short 5s failure cooldown (jwksFailureCooldown) by backdating
the existing lastForceRefresh/lastSignatureRefresh timestamps, so a
failure blocks repeat upstream calls briefly without waiting the full
30s success cooldown before retrying once the IdP recovers.

forceJWKSRefresh previously delegated its within-cooldown branch to
GetJWKS, which itself falls back to a live fetch on a cache miss. That
silently defeated the new failure cooldown (nothing is cached after a
failure), so the branch now reads the local cache directly instead.

Update TestForceJWKSRefresh_FailedFetchDoesNotSetCooldown (review_r100_test.go)
to pin the corrected bound: a failure records a short cooldown that
clears well before the 30s success cooldown, not zero cooldown at all -
the previous assertion (no cooldown recorded) is the exact behavior
this fix corrects.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(logout): rebuild post_logout_redirect_uri from the trusted redirect origin (FIX-07)

handleLogout sent every postLogoutRedirectURI value that does not start
with "http" (including the documented default of "/") to a branch that
set postLogoutRedirectURI = "". BuildLogoutURL then omitted the
parameter entirely, so RP-initiated logout left users stranded on the
IdP logout page under the default config plus an end_session_endpoint.

Capture the origin of redirect_url before session.Clear wipes it. That
value was persisted at authentication-initiate time (R136) and already
accepted by the IdP as this deployment redirect_uri, so its scheme and
host are safe to reuse for post_logout_redirect_uri - unlike the
request Host / X-Forwarded-Host, which the browser controls.

When no trusted origin is available (pre-R136 session, or logout
without a completed login), the parameter is still omitted, matching
the existing safe fallback. An operator-configured absolute URL keeps
taking priority over the derived origin.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(logout): log provider revocation failures and bound the calls (FIX-33)

handleLogout makes two synchronous provider revocation round trips
(access token, refresh token) and discarded both errors with "_ =",
so a failing revocation endpoint left no trace, and each call used
context.Background() with no deadline of its own, so a slow or
unreachable provider could hold the logout redirect open with no
bound of its own.

RevokeTokenWithProvider now derives its request context from a
3-second timeout (revocationRequestTimeout) instead of
context.Background(), and returns a sentinel
ErrRevocationEndpointNotConfigured for the expected "no revocation
endpoint" case. handleLogout logs any other error at error level and
still redirects the browser.

Document the logout revocation and post_logout_redirect_uri behavior
in docs/CONFIGURATION.md.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(auth-flow): stop logging CSRF/nonce on login initiation (FIX-29)

defaultInitiateAuthentication logged "Session saved before redirect.
CSRF: %s, Nonce: %s" and the full provider authorize URL (which also
carries state and nonce as query values) at Debug, despite the R153
commit claiming redaction of state in logs.

Drop the CSRF/nonce values from the first log line. The authorize-URL
log now goes through a new redactAuthorizeURLForLog, which calls the
existing redactCallbackURL (state) and additionally strips nonce and
code_challenge - redactCallbackURL alone was written for the callback
URL and does not know about those two authorize-URL-only values.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(auth-flow): drop Retry-After on the rate-limited callback 429 (FIX-32)

handleCallback sent Retry-After on the 429 for ErrRateLimitExceeded, but
clearOneTimeAuthState has already cleared csrf/nonce/code_verifier and
the authorization code has already been redeemed at the IdP by the
time that response is sent. A client that honors Retry-After and
retries the exact callback URL cannot succeed - it hits "CSRF token
missing in session" instead. Drop the header; the 429 status stays.

Update TestR179_CallbackRateLimitReturns429 (review_r179_regression_test.go)
to assert the corrected contract (no Retry-After) instead of the header
it previously required - the header it pinned is exactly what this fix
removes.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(replay): remove the dead JTI replay write path, make backchannel jti check atomic (FIX-17)

verifyTokenWithOpts wrote every verified JTI into the shared
shardedReplayCache, and its comment (R36) claimed this is "the store
jwt.Verify consults for genuine replay detection". Both were wrong:
jwt.Verify replay branch, the only reader of that cache, only runs
when called with skipReplayCheck=false, and the sole non-test
production caller (VerifyJWTSignatureAndClaims) always passes true.
The write was pure overhead - an exclusive replayCacheMu.Lock (via
initReplayCache) on every cache-miss verification, for a cache nothing
in production reads.

Remove the write-only block and correct the comment. jwt.Verify keeps
its replay branch intact rather than being removed too: ~15 existing
tests across several files call Verify directly with the replay check
enabled and assert on it, and rewriting that test surface is out of
this change scope - see the concern in the final report. A comment
in jwt.go now states the branch does not run on any production path.

Make the backchannel-logout jti replay check (OIDC Back-Channel Logout
1.0 section 2.5) atomic: it was a plain Get followed by a separate Set,
so two logout tokens sharing a jti could both observe "not yet
processed" and both proceed. The check now lives in
checkAndMarkLogoutJTIProcessed, serialized by a package-level mutex.

Correct four existing tests whose assertions pinned the removed
write-only behavior (review_r36_regression_test.go,
security_edge_cases_test.go TestJWTReplayAttack, main_test.go
TestAuthenticationFlowReplayDetection): each now asserts the cache is
NOT written by the production path, and where the test also wanted to
show jwt.Verify replay branch still works when called directly, it
now makes two direct Verify calls instead of relying on the removed
cross-path write.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(replay): correct four more tests pinning the removed FIX-17 write path

TestConcurrentTokenValidation, TestJTIBlacklistBehavior,
TestSessionBasedTokenRevalidation and TestEdgeCasesWithDifferentTokenTypes
(main_test.go) asserted that VerifyToken writes the JTI into the
shared shardedReplayCache, and in two cases relied on that write
happening so a single direct jwt.Verify call would then detect a
replay. FIX-17 removed that write-only path.

Each test now asserts the cache is not written by VerifyToken, and
the two direct-replay-detection cases make two direct Verify calls
(first succeeds and records the JTI itself, second is rejected)
instead of relying on the removed cross-path write.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(jwt): remove the dead replay branch from Verify (FIX-17)

Address verifier review of FIX-17.

Major: the todo's chosen option was to remove the dead jwt.Verify replay
branch, but only its write-only shardedReplayCache.Set call had been
removed; the branch itself and its comment claiming it was "live code"
stayed. Removes the replay-check block and its skipReplayCheck parameter
from JWT.Verify outright, plus the now-unused shardedReplayCache/
replayCache globals and their init/cleanup/stats helpers (jwt.go), and
the startReplayCacheCleanup call that started their background sweep
(main.go). Migrates every non-test and test call site of Verify to the
new two-argument signature, and rewrites or removes the tests whose sole
subject was the removed branch or cache (main_test.go,
security_edge_cases_test.go, review_r179_regression_test.go,
review_r156_regression_test.go, review_r119_test.go, review_r142_test.go
[deleted], review_r126_test.go, review_r36_regression_test.go,
review_r131_test.go, review_r66_lenient_expiry_test.go, audience_test.go,
coverage_boost_final_test.go). New regression coverage:
TestJWTVerify_PerformsNoReplayDetection and
TestVerifyTokenWithOpts_ProductionPathUnaffectedByReplayRemoval
(review_fix17_replay_test.go) pin that Verify performs no jti tracking at
all, and that the production verify path is unaffected.

Minor: verifyOpts.skipReplayMarking is written (bearer_auth.go) but
nothing in verifyTokenWithOpts reads it — the JTI blacklist Set it used
to gate was already removed by an earlier FIX-17 pass without updating
the comments describing it. Rewrites the comments on the field, on
verifyTokenWithOpts, on the blacklist Get, and in bearer_auth.go's
package doc to stop describing a Set that no longer exists. The field
itself is left in place and flagged as dead code needing maintainer
approval to delete, per the dead-code hygiene rule. Also fixes the
repeated "VerifyJWTSignatureAndClaims, via VerifyJWTSignatureAndClaims"
phrase in the R36 correction comment.

Minor: the backchannel-logout jti check (logout.go) uses a process-wide
mutex around Get-then-Set, not an atomic SetIfAbsent, so it is atomic
only within one process, not across Traefik replicas sharing a
Redis-backed sessionInvalidationCache. A real fix needs an atomic
primitive on the cache backend (e.g. Redis SET NX); backends.CacheBackend
has none, and adding one touches many files across internal/cache/
backends owned by unrelated work (FIX-20), which is out of this fix's
scope. Rewrites the backchannelLogoutJTIMu and
checkAndMarkLogoutJTIProcessed comments to state the single-process-only
guarantee explicitly, rather than implying full atomicity.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(logout): correct revocation timing and redirect-uri claims (FIX-33)

Address verifier review of FIX-33.

The Logout Behavior section overstated and misstated logout timing and
redirect behavior. Item 2 said the 3-second revocation timeout means a
slow provider cannot delay the redirect, but the two revocation calls
(access and refresh token) run one after the other, so together they can
delay it by up to about 6 seconds. Items 3-4 gave 'a logout request with
no completed login' as the example of a missing redirect origin, but
that case has no ID token and never reaches the oidcEndSessionURL branch
at all; the real missing-origin case is a session created before R136
started recording the redirect origin. The section also omitted that an
absolute postLogoutRedirectURI is sent unchanged. Rewrites items 2-4 to
state the actual timing and the three real conditions for the
end-session redirect, its redirect_uri handling, and when the parameter
is omitted. Removes the semicolon and the em dash per
simplified-technical-english.md.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(logout): make the FIX-07 redirect-origin regression table-driven (FIX-07)

Address verifier review of FIX-07.

The regression test set postLogoutRedirectURI to "", which helpers.go
sends through a separate case postLogoutRedirectURI == "" branch, not
the default: branch production actually runs (main.go turns an unset
config into the documented default '/', which goes through default:).
The old test's comment called "" the documented default, which it is
not. Deleting the trustedOrigin rebuild in default: would have kept the
old test green.

Makes the test table-driven with three cases: the production default
'/', a relative '/bye', and the pre-existing '' case, all wanting
https://app.example.com/ or https://app.example.com/bye. Verified with a
scratch mutation of the default: branch (trustedOrigin rebuild removed,
reverted before this commit): the old single-case '' test still passed,
the new '/' and '/bye' subtests failed as expected. Corrects the comment
that called '' the documented default.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(pool): remove racy nil pre-check, move test reset helper (FIX-39)

GetTransportPool read globalTransportPool outside transportPoolOnce,
racing the write inside Once.Do when two goroutines called it for the
first time concurrently. Run the whole body inside Once.Do instead, so
every caller only observes the pointer after Once establishes
happens-before.

Move resetGlobalTransportPoolForTest into a new export_test.go file so
the test-only helper no longer compiles into the plugin package that
imports internal/pool. Update TestCreateHTTPClient_Fallback to exhaust
the real singleton in place (mutate its fields) instead of swapping in
a hand-built *TransportPool, since Once.Do now always builds its own
pool after a reset and would overwrite a manually assigned one.

Regression test TestGetTransportPool_ConcurrentFirstCall pins the race:
it fails under -race at head (WARNING: DATA RACE between the write in
GetTransportPool.func1 and the read at the removed pre-check) and
passes after the fix.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(config): add perSourceLoginRateLimit, clientAssertionKeyPath to configToMap (FIX-40)

configToMap is the single field/redaction list MarshalJSON and
MarshalYAML share (R150), meant to stop the marshalled config from
silently dropping fields. It still dropped two json-tagged Config
fields: perSourceLoginRateLimit (added in the same changeset) and
clientAssertionKeyPath. Neither is a secret, so this reintroduced the
exact drift R150 set out to eliminate.

Add both fields to configToMap. clientAssertionKeyPath is a filesystem
path, not the key content, so it needs no redaction (the content field
clientAssertionPrivateKey is already REDACTED).

TestConfigToMap_IncludesAllJSONFields reflects over every json-tagged
Config field and asserts it is a configToMap key. It fails at head
with exactly the two missing fields and passes after the fix.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(makefile): run make test under -race (FIX-21)

Several regression pins (R44 TestSessionDataRedirectCountConcurrency,
R111 TestSessionAccessors_ConcurrentAccess, R77
TestSessionPool_ReturnToPool_ExactlyOnce) only fail when the old bug
they pin is reintroduced AND the race detector is on. make test ran
plain go test with no -race, so a regression in any of them would ship
silently. docs/TESTING.md already says to always run with -race.

Add -race to the Makefile test target.

Verified this session: reverting the R77 CAS in returnToPoolSafely
(and the inUse field back to plain bool, matching the pre-R77 shape)
back to a temporary local build, `go test -run
TestSessionPool_ReturnToPool_ExactlyOnce` passes without -race and
fails with -race:

    WARNING: DATA RACE
    Read at ... session.go:1784 (returnToPoolSafely)
    Previous write at ... session.go:1947 (Reset, called from the
    second concurrent returnToPoolSafely)
    --- FAIL: TestSessionPool_ReturnToPool_ExactlyOnce
        testing.go:1865: race detected during execution of test

The revert was local-only and is not part of this commit. Also
confirmed the shared CI workflow (go-pr.yaml@main in
lukaszraczylo/shared-actions, used by .github/workflows/pr.yaml) already
runs `go test -race -coverprofile=... -covermode=atomic ./...`, so CI
was not the gap.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(session): pin R104 no-reject-on-decompressed via the real read path (FIX-08)

TestValidateChunkingEfficiency_NoRejectOnDecompressed called
cm.validateChunkingEfficiency(big, config) as a bare statement and
asserted nothing. Go lets a statement call drop a return value, so the
test compiled and passed both before and after the R104 fix -
validateChunkingEfficiency changed from returning an error to
returning nothing in the same changeset, and a bare call compiles
either way. The test pinned nothing.

Rewrite it to drive the actual read path: build a JWT-shaped fixture
whose decompressed length exceeds MaxChunks*MaxChunkSize, gzip+base64
it the way a stored compressed cookie is shaped, and call
ChunkManager.GetToken(compressed=true, ...) - the same entrypoint
session.go uses. Assert the token reassembles unchanged with no error.

Verified this session with a temporary, uncommitted local revert of
validateChunkingEfficiency and its validateToken call site to the
pre-R104 base f728f61 shape (hard error on expectedChunks >
MaxChunks): the rewritten test fails there -

    review_r104_test.go:350: GetToken rejected a large
    legitimately-compressed token: access token would require 51
    chunks (max: 50)
    --- FAIL: TestValidateChunkingEfficiency_NoRejectOnDecompressed

and passes again once session_chunk_manager.go is restored to head.
The revert was local-only and is not part of this commit.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(ratelimit): key PerSourceLoginRateLimit on RemoteAddr, not XFF (FIX-11)

sourceIP() preferred the first X-Forwarded-For value, and
isInternalSource then trusted that attacker-controlled value as the
basis for internal classification. An external attacker sending
X-Forwarded-For: 127.0.0.1 (or any RFC 1918 address) was classified
internal and never throttled, making PerSourceLoginRateLimit a no-op
against exactly the attacker it exists to stop. Rotating arbitrary XFF
values also let an attacker dodge the per-source counter and grow the
entries map, or spoof a victim IP to exhaust that IPs budget.

clientIPForBearer (bearer_auth.go) already deliberately ignores XFF
for the same reason - a second mechanism doing the opposite of the
solved one.

Derive sourceIP from RemoteAddr only. No new config: the feature is
opt-in (default 0/off) and this restores the trust boundary it should
have shipped with.

Two existing tests relied on the old XFF-as-source behavior to
simulate distinct/internal sources and are updated to use RemoteAddr
instead, matching the corrected contract: TestR185_InternalSourceNeverThrottled
(review_r185_regression_test.go) and
TestR185_PerSourceLimiterSweepEvictsIdle (review_r213_test.go).

New regression tests (per_source_ratelimit_test.go):
TestPerSourceRateLimit_XFFSpoofDoesNotBypassThrottle drives the full
ServeHTTP callback path with an external RemoteAddr and a spoofed
X-Forwarded-For: 127.0.0.1, and TestSourceIP_IgnoresXForwardedFor pins
sourceIP() directly. Both fail at head:

    per_source_ratelimit_test.go:56: external source spoofing
    X-Forwarded-For: 127.0.0.1 was never throttled
    per_source_ratelimit_test.go:70: sourceIP = "127.0.0.1", want
    RemoteAddr-derived "203.0.113.7"

and pass after the fix.

docs/CONFIGURATION.md and README.md perSourceLoginRateLimit rows now
state the RemoteAddr-only keying.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(http): stop sharing a cookie jar across the pooled token client (FIX-12)

R70 made CreatePooledHTTPClient honor config.UseCookieJar.
TokenHTTPClientConfig and OIDCProviderHTTPClientConfig both set
UseCookieJar: true, and main.go builds one pooled tokenHTTPClient per
plugin instance from TokenHTTPClientConfig, shared by every users
token/refresh exchange. An IdP Set-Cookie on user As exchange response
was stored in that one jar and replayed on user Bs next token request
to the same host - cross-user state confusion at the IdP, with no
config change on upgrade.

Set UseCookieJar to false (the DefaultHTTPClientConfig default) in
both config constructors. Token/refresh calls are stateless
back-channel requests; the nil-client fallback in exchangeTokens
(helpers.go) already builds its own fresh jar per call, which stays
correct and is untouched. CreatePooledHTTPClients own UseCookieJar
honoring (http_client_pool.go) is unchanged and still covers any
future caller that legitimately needs a jar.

TestPooledTokenClient_DoesNotShareCookieJarAcrossRequests
(http_client_jar_test.go) drives CreatePooledHTTPClient(TokenHTTPClientConfig())
against a test IdP that sets a cookie on request 1 and asserts request
2 does not carry it. It fails at head:

    http_client_jar_test.go:31: request 2 carried leaked cookie
    idp_sess=alice from an earlier request

and passes after the fix. Two existing assertions that expected the
old (leaky) behavior are updated to match the corrected contract:
TestOIDCProviderHTTPClientConfigUnit and TestCreateTokenClientUnit
(http_client_factory_unit_test.go).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test: add newTestOIDC builder, move stubIntrospectionCache, migrate logout round files (FIX-41)

136 added root test files (71 hand-building TraefikOidc literals, 112
in total) make any change to TraefikOidc required fields a many-file
patch. Round files also depend on each others locally declared
helpers: review_r149_test.go used stubIntrospectionCache, declared in
review_r126_test.go, so deleting or renaming either file would break
the other silently at compile time.

Add newTestOIDC(t, opts...) in a new shared newtestoidc_test.go: a
builder with the common ServeHTTP-ready defaults (next handler, error
logger, closed initComplete, a real session manager, both startup
barriers past init, a plausible issuer/callback/client), customized
per test via functional options that set unexported fields directly
(same-package test file).

Move stubIntrospectionCache from review_r126_test.go into the same
shared file. review_r143_test.go and review_r149_test.go, which also
use it, need no change - Go resolves package-level identifiers by
package, not file, so moving it to a shared file removes the
round-to-round coupling without touching either caller.

Migrate the logout round files onto the builder (5 tests):
review_r55_logout_blacklist_test.go, review_r73_test.go, and
review_r87_test.go.

Verified this session that migration did not defang any of these
pins: for 3 of the 5, a temporary uncommitted local revert of the
exact behavior each test regresses made the migrated test fail, then
was restored. All 5 migrated tests, and the full root package (go
test -race), pass at head with the reverts removed.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(http): correct stale cookie-jar comment on CreatePooledHTTPClient (FIX-12)

Reword the comment above the UseCookieJar branch. It described the
jar-less pooled token/OIDC clients as a bug to fix, contradicting the
FIX-12 comments already in http_client_factory.go and inviting a
reintroduction of the cross-user jar R70 introduced. State instead
that TokenHTTPClientConfig and OIDCProviderHTTPClientConfig
deliberately leave UseCookieJar false because a pooled client is
shared across users.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(ratelimit): document the shared-proxy-IP tradeoff for perSourceLoginRateLimit

perSourceLoginRateLimit keys solely on RemoteAddr (per_source_ratelimit.go).
Behind a load balancer or CDN that is the proxy address, not the real
client: a private proxy address is exempt from throttling entirely, and
a public proxy address puts every client into one shared bucket. State
this in both docs rows, matching the tradeoff already documented in
clientIPForBearer (bearer_auth.go).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test: eliminate remaining cross-round test-helper references (FIX-41)

The prior FIX-41 pass moved only stubIntrospectionCache; 14 references
into 10 other helpers survived, 3 of them into the migrated logout
round files (review_r172_regression_test.go used newR87LogoutHarness
and r87BaseClaims from review_r87_test.go; review_r103_test.go used
mustTemplate from review_r73_test.go). Deleting or renaming any of
those round files would still have broken an unrelated file.

Move every cross-referenced helper into a shared _test.go file, by
topic: jwt_test_helpers_test.go (writeJWKS, signRSAJWTForTest,
makeJWTForTest), cache_test_helpers_test.go (NewMemoryBackendForTest,
mapCache, serializingCache), config_test_helpers_test.go
(r134ValidConfig), plugin_test_helpers_test.go (newR154TestPlugin),
logout_test_helpers_test.go (r87LogoutHarness, newR87LogoutHarness,
r87BaseClaims), and mustTemplate into the existing newtestoidc_test.go.
A go/ast analyzer built for this fix (File.Unresolved checked against
top-level decls of every other review_rNN*_test.go file) now reports 0
cross-round references, down from 20.

Also migrate TestBackchannelLogout_RejectsReplayedJTI
(review_r73_test.go) onto the newTestOIDC builder, the one migration
the prior pass missed among the three logout round files. Verified the
migrated test still catches the regression: with the jti-replay check
in logout.go temporarily disabled (reverted before this commit), it
fails with "review_r73_test.go:109: replayed logout token should be
rejected (400), got 200".

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(client-assertion): pin and document the RSA<2048 private_key_jwt rejection (FIX-42)

validateAlgKeyMatch already rejects an RS*/PS* private_key_jwt signing
key under 2048 bits (RFC 7518 3.3), added by 8640451 with no commit
mention and no CHANGELOG entry. Keep the rejection as-is.

Wrap the error with a new ErrRSAKeyTooSmall sentinel so callers can
match it with errors.Is instead of parsing the message, add a pin
test that generates a 1024-bit and a 2048-bit key and asserts the
reject/accept boundary, and document the minimum in
docs/CONFIGURATION.md and CHANGELOG.md.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(main): name and document dropped http endpoints under https providers (FIX-26)

validateDiscoveredEndpoint already refuses a discovered http:// endpoint
under an https providerURL (R146). Keep that pin; do not add an
opt-out flag.

Wrap the rejection in a named ErrDiscoveredEndpointSchemeDowngrade
sentinel and have updateMetadataEndpoints sanitize log an extra
SECURITY-tagged line, naming the endpoint, the dropped URL, and the
absence of an override, whenever the dropped endpoint is token,
jwks_uri, or authorization — the three a login cannot function
without. The generic per-endpoint log line stays unchanged.

Add a regression test pinning the new log line and a negative test
confirming accepted https endpoints stay silent. Document the
behaviour in docs/CONFIGURATION.md, README.md, and CHANGELOG.md.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(changelog): record the R96/R102/R105/R126 auth relaxations (FIX-25)

security_edge_cases_test.go:459 (+bearer_auth_test.go:225, custom_claims_test.go:158,
main_test.go:2325) pin four claim-validation relaxations that shipped
in 8640451 with no commit-body or CHANGELOG mention: optional iat
(R126), a stringified numeric bearer sub (R102), a malformed
groups/roles claim treated as empty (R96), and stringified numeric
items inside a groups/roles array (R105).

Each relaxation is intentional, matches a production change, and
already has a passing regression test (re-run this session to
confirm: TestMissingClaims/Missing_IssuedAt_is_optional,
TestResolveBearerIdentifier, TestCustomClaimNames_MalformedRoleClaim,
TestCustomClaimNames_MalformedGroupClaim,
TestCustomClaimNames_NonStringInRoleArray,
TestCustomClaimNames_NonStringInGroupArray). Keep all four as-is; no
code change. Record each in CHANGELOG.md so a reviewer of the
squashed commit can see the intent.

Also record the blacklist Redis namespace move (token: -> blacklist:,
FIX-16, implemented elsewhere) and its one-release legacy read, since
CHANGELOG.md is otherwise silent on it too.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(main): restrict SECURITY scheme-downgrade log to no-override endpoints (FIX-26)

sanitize logged the SECURITY line for every dropped endpoint, not only
jwks_uri, authorization and token as docs/CHANGELOG/README say. Revocation,
end_session and introspection have a config override (revocationURL,
oidcEndSessionURL, introspectionURL) that replaces the endpoint right after
sanitize runs, so the "no override; requests will fail" wording was false
for those three.

Add discoveredEndpointHasNoOverride and named constants for the three
endpoints with no config source, and gate the SECURITY line on both the
scheme-downgrade error and endpoint name. Add negative tests pinning that
end_session/revocation/introspection/registration keep only the generic
line, and that a config override still replaces a dropped endpoint. Add one
sentence to docs/CONFIGURATION.md naming which endpoints have an override.
Correct the fix26 test file header comment: the pre-existing ERROR line
already named the scheme-downgrade reason; the new SECURITY line only adds
a distinct tag and the no-override statement.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(changelog): scope the iat relaxation, drop the unbuilt FIX-16 bullet (FIX-25)

The iat bullet overstated the R126 relaxation: it is optional in
jwt.Verify only. Bearer-token auth still rejects a token with no iat
(enforceIatAge, "missing iat claim"), because maxTokenAgeSeconds always
applies and 0 falls back to a 24h default. The lenient-audience
accessTokenUnexpired path also still requires iat on this branch. State
that scope explicitly instead of implying the check is gone everywhere.

Reword the heading to match bullet 4: a numeric groups/roles array item
was silently dropped before R105, not rejected, so "previously-rejected"
alone mis-described it.

Remove the Blacklist Redis-namespace-move bullet: it describes
universal_cache.go changes from commit 4eb876b on fix/d1-universal-cache,
which this branch does not contain. Re-add it when that branch merges.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(yaegi): replace errors.As on interpreted *HTTPError in RetryExecutor

errors.As(err, &target) panics under yaegi v0.16.1 whenever the target
pointed-to type is interpreted. *HTTPError is declared in this plugin, so
RetryExecutor.isRetryableError panicked on the default-on token-exchange/
refresh retry path regardless of the concrete error type reaching it.

Add asHTTPError, a manual errors.Unwrap walk plus type assertions (both
yaegi-safe), and use it in place of both errors.As calls in
isRetryableError. Native classification stays unchanged: the walk mirrors
errors.As exactly for the fmt.Errorf(%w) chains callers actually wrap.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(yaegi): replace errors.As on interpreted HTTPError/OIDCError in internal/recovery

Same yaegi v0.16.1 hazard as error_recovery.go's RetryExecutor: this
package's own *HTTPError and *OIDCError types are interpreted whenever
the traefikoidc plugin loads under yaegi (it imports internal/recovery
transitively through internal/utils/logger_wrapper.go), so
RetryExecutor.isRetryableError's two errors.As calls here panic too.

Add asHTTPError and asOIDCError, the same manual errors.Unwrap-walk
pattern used in the top-level package, and use them in place of
errors.As. Native classification is unchanged (TestR175 stays green).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(yaegi): drop errors.As from introspection error classification

token_validation_rs.go classified validateOpaqueToken's error with
errors.As(err, &httpErr): *HTTPError is interpreted under yaegi v0.16.1,
so this panicked on every opaque-token session-path classification.

A plain type assertion is yaegi-safe but only if the value arrives
unwrapped, and an interpreted *HTTPError wrapped with fmt.Errorf(%w)
cannot be recovered by a manual errors.Unwrap walk under yaegi either
(verified this session against the pinned interpreter). So instead of
adding an unwrap-walk helper here, fix the producer:
validateOpaqueToken (token_introspection.go) now returns
introspectToken's *HTTPError unwrapped instead of wrapping it with
"token introspection failed: %w", matching the existing yaegi-safe
pattern (isTerminalClientError, isNeverSentError). The call site
switches to a plain err.(*HTTPError) assertion.

Adds native regression coverage for the unwrapped return and for the
5xx classification case (401/429 were already covered).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(yaegi): add NEW-01 regression checks to yaegicheck

Extend cmd/yaegicheck/main.go, the program make yaegi-validate runs
under the interpreter, with checks that drive every site fixed by
NEW-01: RetryExecutor.ExecuteWithContext (top-level package) with an
HTTPError 500 (retried), an HTTPError 400 (not retried), and a plain
error (no panic); the same pair for internal/recovery's RetryExecutor,
plus its OIDCError retryable/terminal classification; and a full
plugin instance driving RFC 7662 introspection end to end through the
bearer path for a 4xx and a 5xx response.

Confirmed these checks panic (errors.As at error_recovery.go:723) when
run against the pre-fix commit, and pass on the fixed worktree.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* refactor: remove symbols left unused by the review fixes

staticcheck (U1000) flagged defaultBlacklistDuration in cache_manager.go and isLastInstanceNow in singleton_resources.go. The FIX-35 lifecycle change routes every last-instance stop through stopIfLastInstance, and the blacklist TTL no longer reads the constant. Comments that named the removed function now describe the check they compare against.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(yaegi): fold the SSE flush check into yaegicheck

Add checkSSEFlushReachesNext to cmd/yaegicheck. It sends an SSE request through the excluded-URL bypass under yaegi and asserts that http.NewResponseController(w).Flush() succeeds on the writer next receives (FIX-06). Remove cmd/yaegiflushcheck, a nested module with its own go.mod (go 1.27.1) and a yaegi dependency that ran the same check. make yaegi-validate now covers it.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(changelog): record the blacklist namespace move, correct the iat scope

Add the FIX-16 entry: the blacklist cache writes under the blacklist: Redis prefix, and for one release it reads a legacy token: entry only when the stored value is boolean true. Correct the iat bullet: accessTokenUnexpired now calls verifyTimeClaims, so the lenient-audience path treats iat as optional, the same as jwt.Verify (FIX-27).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(middleware): pin FIX-02 default-deny for genuine OPTIONS preflight

Regression test for the maintainer decision on FIX-02: the released
behavior required auth for every OPTIONS request by default. Confirms
red on base code -- shouldBypassAuth currently bypasses any genuine
CORS preflight (Origin + Access-Control-Request-Method) unconditionally,
so this test currently fails with the backend reached (status=204).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* feat(settings): add AllowUnauthenticatedPreflight config option

New Config.AllowUnauthenticatedPreflight bool (json tag
allowUnauthenticatedPreflight, default false), wired through to
TraefikOidc.allowUnauthenticatedPreflight (types.go, main.go) and into
configToMap (config_marshalling.go) so it round-trips through
MarshalJSON/MarshalYAML like every other Config field. Naming and
omitempty match the sibling AllowPrivateIPAddresses option. No
behavior change yet -- middleware.go still needs to read the field
(next commit).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(middleware): gate OPTIONS bypass behind AllowUnauthenticatedPreflight

Maintainer decision for FIX-02: restore the released behavior where
every OPTIONS request needs authentication by default. shouldBypassAuth
now only treats a genuine CORS preflight (Origin +
Access-Control-Request-Method) as an auth bypass when
t.allowUnauthenticatedPreflight is true; with the flag at its default
(false), OPTIONS goes through the normal auth pipeline like any other
method. The optionsPreflightWriter body-discard hardening (forged
preflights cannot read a protected body even when the flag is on)
still applies unchanged inside the bypassReasonOptions case, since
shouldBypassAuth only returns that reason when the flag permits it.

Updates the FIX-02 tests that assumed the bypass was unconditionally
on (fix02_options_bypass_test.go, review_r124_test.go
TestShouldBypassAuth_PassesOptions) to set
allowUnauthenticatedPreflight: true, so they keep exercising the
Origin+Access-Control-Request-Method gate rather than being short-
circuited by the new flag gate. Adds
fix02b_allow_unauthenticated_preflight_test.go pinning the maintainer
decision directly: default config requires auth for a genuine
preflight (red on prior commit); with the flag on, a genuine preflight
still bypasses with its body discarded; with the flag on, a bare
OPTIONS still requires auth.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs: document allowUnauthenticatedPreflight option

Adds the new Config.AllowUnauthenticatedPreflight option to the
docs/CONFIGURATION.md security-options table and the README.md option
table, next to its sibling allowPrivateIPAddresses. .traefik.yml is not
touched: it lists only complex opt-in feature blocks (bearer-auth,
Redis) as commented examples, not the plain security-relaxing bools
like allowPrivateIPAddresses -- allowUnauthenticatedPreflight follows
that same precedent.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* style(test): fix wrong test name in FIX-02 cross-reference comment

TestShouldBypassAuth_PassesOptions referenced a
TestShouldBypassAuth_DefaultDoesNotBypassOptions that does not exist;
point it at the real default-off regression test,
TestServeHTTP_DefaultConfigGenuinePreflightRequiresAuth in
fix02b_allow_unauthenticated_preflight_test.go.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(refresh): cancel refresh context on Shutdown so it returns promptly (FIX-36)

Derive each refresh operation's timeout context in executeRefreshAsync from
a coordinator-owned context (rc.ctx) instead of context.WithTimeout(
context.Background(), RefreshTimeout). Shutdown now cancels rc.ctx before
wg.Wait(), so it no longer blocks for up to RefreshTimeout (or the
refreshFunc's own natural completion) per in-flight refresh. A waiter
blocked in CoordinateRefresh on an aborted operation gets an error, not a
hang. RefreshTimeout still caps a refresh that is not aborted by Shutdown.

The refreshFunc call itself runs in an untracked inner goroutine
(executeRefreshAsync) that cannot be aborted given its
func() (*TokenResponse, error) signature; it keeps running past Shutdown
until it returns naturally (in production, until its own HTTP client
timeout). This is documented in code comments on Shutdown and
executeRefreshAsync.

Corrects three comments that described the old contract: the goroutine-
launch comment in CoordinateRefresh, the timeout-context comment in
executeRefreshAsync, and the Shutdown comment — all previously said
Shutdown deliberately does not cancel and must wait for a genuine in-flight
refresh to finish, which is now false.

Rewrites TestRefreshCoordinatorShutdownWaitsForInflight (review_r63) and
TestRefreshCoordinator_ShutdownWaitsForInFlight (review_r154), which pinned
the old "Shutdown blocks until the refresh finishes" contract this commit
intentionally reverses; they now assert the prompt-return contract instead.

Adds TestFix36_ShutdownReturnsPromptlyDuringInFlightRefresh: starts a
refresh whose refreshFunc blocks 3s, calls Shutdown, and asserts Shutdown
returns in under 1s and the waiter gets an error. Fails on pre-fix code at
refresh_coordinator_test.go:871 ("Shutdown did not return within 1s while a
refresh was in flight"); green under go test -race.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(refresh): pin wg-tracking of the aborted refresh goroutine (FIX-36 review)

TestRefreshCoordinator_ShutdownWaitsForInFlight (review_r154) and
TestRefreshCoordinatorShutdownReleasesWaiterOnInflight (review_r63) only
checked that Shutdown returns promptly and the waiter gets an error. Both
checks also pass when the executeRefreshAsync goroutine is not tracked by
rc.wg, so an untracked-goroutine regression would go unnoticed, and the
R154 test comment claimed wg coverage the test did not assert.

Add an assertion on rc.circuitBreaker.failures right after Shutdown
returns: executeRefreshAsync calls RecordFailure() before it returns, and
the goroutine that calls it is (correctly) covered by wg.Wait(), so the
count must already be 1 by the time Shutdown, and therefore wg.Wait,
returns.

Verified with a local mutation (not committed): replacing
`defer rc.wg.Done()` inside the spawned goroutine with an immediate
`rc.wg.Done()` before `go func(){...}()` made the new assertion fail
20/20 runs for the R154 test and 12/20 for the R63 test under
-race -count=20; both pass 20/20 on the real (tracked) code.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(refresh): skip refreshFunc when rc.ctx is already canceled

executeRefreshAsync spawns an inner goroutine that calls refreshFunc
unconditionally, even when rc.ctx (and therefore refreshCtx) is already
canceled before the goroutine starts. The outer select then always takes
the refreshCtx.Done() branch and discards whatever refreshFunc returned,
but refreshFunc is the IdP refresh-token grant: calling it anyway still
spends a request against a (possibly rotating, one-time-use) refresh
token whose result nobody reads.

Check rc.ctx.Err() as the first statement in the inner goroutine and
return without calling refreshFunc when it is already canceled.

Adds TestFix36_ExecuteRefreshAsyncSkipsRefreshFuncWhenAlreadyCanceled:
cancels rc.ctx directly (isolating this from the stopChan-reject path),
then asserts refreshFunc is never called and the waiter gets an error.
Fails on pre-fix code at refresh_coordinator_test.go:926 ("refreshFunc
must not be called when rc.ctx is already canceled before the refresh
starts"); green under go test -race -count=20.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(refresh): correct stale nolint comment on the tracked refresh goroutine

The nolint reason still said the refresh "intentionally uses a background
context", describing the pre-FIX-36 behaviour. Since FIX-36,
executeRefreshAsync derives its timeout context from rc.ctx (canceled by
Shutdown), capped by RefreshTimeout, not context.Background().

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* feat(cache/redis): add atomic SetNX check-and-set to RedisBackend (FIX-17)

RedisBackend gets SetNX(ctx, key, value, ttl) (bool, error): one Redis
SET key value NX PX <ttl-ms> command instead of a separate GET then
SET, so two callers racing the same key can never both observe
"absent". Backs the UniversalCache.SetIfAbsent primitive the next
commit adds, which the backchannel-logout jti replay check
(logout.go) needs to be atomic across Traefik replicas, not just
within one process (FIX-17, R36 correction).

A nil bulk-string reply (NX condition failed, key already exists) is
reported as (false, nil), not an error: it is a valid protocol
outcome, not a backend failure, so executeWithRetry must not retry it
or surface it as err.

Regression test (miniredis-backed): a second SetNX on an already-set
key does not overwrite the first value or its TTL, and exactly one of
20 concurrent SetNX calls on the same key wins under -race.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* feat(cache): add UniversalCache.SetIfAbsent atomic check-and-set (FIX-17)

SetIfAbsent(key, value, ttl) (bool, error) stores value only if key is
not already present, replacing the TOCTOU-prone separate Get then Set
with one atomic operation (FIX-17, R36 correction).

With no distributed backend, the presence check and the insert happen
inside a single c.mu critical section (setLocalLocked, extracted from
setLocal so SetIfAbsent does not have to re-enter the lock setLocal
already holds). With a backend that implements the optional
backendSetNXer interface (RedisBackend.SetNX, previous commit),
that call alone decides the outcome, so the check is atomic across
every replica sharing that backend too. CacheBackend itself is not
widened to require SetNX: every other implementer and test double
would need a method only this caller needs, so SetIfAbsent reaches it
through a type assertion instead. A successful backend claim is then
mirrored into the local cache as a best-effort read-through.

Exposed to callers as AtomicSetIfAbsentCache (types.go), an optional
capability a CacheInterface value can satisfy, for the same reason:
CacheInterface itself is not widened, since most of its many test
doubles across the suite have no need for the atomic primitive.
CacheInterfaceWrapper (the concrete type sessionInvalidationCache
actually is at runtime) implements it by delegating to
UniversalCache.SetIfAbsent.

Regression tests: SetIfAbsent single-threaded claim/no-overwrite
semantics; exactly one of 20 concurrent same-key calls wins, both with
no backend and with a real Redis backend (miniredis); and
CacheInterfaceWrapper satisfies AtomicSetIfAbsentCache. All green
under -race.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(logout): make backchannel-logout jti check atomic via SetIfAbsent (FIX-17)

checkAndMarkLogoutJTIProcessed now type-asserts sessionInvalidationCache
to AtomicSetIfAbsentCache and, when it is available, uses SetIfAbsent
as the sole check: no separate Get then Set, and no
backchannelLogoutJTIMu. CacheInterfaceWrapper (what
sessionInvalidationCache actually is at runtime) satisfies the
interface, so this is the path production traffic takes, and it is
atomic across Traefik replicas sharing a Redis-backed cache, not just
within one process (FIX-17, R36 correction: the prior commit on this
line only made the check-and-set atomic process-locally).

backchannelLogoutJTIMu is kept as a fallback for a CacheInterface
implementation that does not provide the atomic primitive, guarding
only that case now. A SetIfAbsent backend error falls through to the
same fallback rather than rejecting an otherwise-valid logout token
outright on a transient cache failure.

Regression test: 20 concurrent backchannel-logout submissions of the
same valid logout token, through the production validateLogoutToken
path, must yield exactly one acceptance AND must reach it through
SetIfAbsent alone (asserted via call counts on an instrumented cache
double) rather than the legacy Get/Set fallback, so the test would
catch a regression to the old path even where the outcome happens to
still be correct under backchannelLogoutJTIMu. Green under
-race -count=5.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache/resilience): forward SetNX through circuit-breaker and health-check wrappers

Round-2 verifier finding (major): UniversalCache.SetIfAbsent reaches a
Redis backend through the optional backendSetNXer type assertion, but
neither CircuitBreakerBackend nor HealthCheckBackend implemented SetNX,
so wrapping Redis with either (docs/REDIS.md and the example configs
recommend both true in production) made the assertion fail and every
call silently fall back to the process-local-only path. Two replicas
sharing the same wrapped Redis backend both claimed the backchannel-
logout jti and Redis never saw the key.

Add SetNX passthrough to both wrappers: forward to the wrapped backend
when it implements SetNX (through the same circuit-breaker/health
accounting as every other operation), and report the new
backends.ErrSetNXUnsupported sentinel otherwise.

Pin with three regression tests driving two UniversalCache instances
(simulated replicas) over one miniredis-backed RedisBackend wrapped by
NewCircuitBreakerBackend, NewHealthCheckBackend, and the production
wiring order HealthCheck(CircuitBreaker(raw)). All three fail on
b433f42 (second replica also claims; redis keys=[]) and pass here.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): reject SetIfAbsent when backend lacks SetNX, no silent local

Round-2 verifier finding (major, completes the previous commit):
UniversalCache.SetIfAbsent fell back to the local-only path for ANY
backend that failed the backendSetNXer type assertion, not only the
CircuitBreakerBackend/HealthCheckBackend case the previous commit
fixes at the source. Belt-and-suspenders: a distributed backend
attached to the cache now must expose SetNX (directly or through a
wrapper) or SetIfAbsent errors loudly with the new
errSetIfAbsentUnsupported sentinel, instead of quietly giving each
replica a process-local-only guarantee it never asked for.
checkAndMarkLogoutJTIProcessed already falls through to its
backchannelLogoutJTIMu-guarded Get+Set on any SetIfAbsent error, so no
logout.go behavior change is needed there beyond correcting its doc
comments to describe the corrected contract.

Pin with a fake backend that deliberately has no SetNX: two
UniversalCache instances (simulated replicas) sharing it must both
get the same sentinel error and neither may silently claim locally.
Fails on HEAD before this commit (no error returned); passes here.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(cache): pin SetIfAbsent cross-replica atomicity with two instances

Round-2 verifier finding (minor): the existing Redis-backed SetIfAbsent
test drives 20 concurrent calls through a SINGLE UniversalCache
instance, so its own c.mu already serializes them to exactly one
winner even when the c.backend.(backendSetNXer) branch is mutated
dead — the test cannot tell "one process, one mutex" from "many
replicas, one Redis". Add a test using two separate UniversalCache
instances (simulated replicas) sharing one miniredis-backed
RedisBackend: the second instance must be rejected AND the key must
be present in the shared miniredis, which two independent local maps
cannot produce.

Verified this test (and the pre-existing one) both fail under the
verifiers mutation (backendSetNXer branch forced dead) once the
previous two commits are in place: SetIfAbsent now errors instead of
silently using the local-only path, so the mutation surfaces as
"unexpected error" rather than a quiet pass.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache/redis): make SetNX retry-safe when a reply is lost

Round-2 verifier finding (minor): SetNX ran SET key value NX PX inside
executeWithRetry, which blindly retries the whole operation on a
"connection"/"timeout"/"EOF" error by re-issuing the closure. That is
fine for Set (SETEX/PSETEX overwrite unconditionally, so a retry after
a lost reply just repeats the same write) but wrong for SET NX: if the
first SET NX reached Redis and applied, and only the reply was lost,
the retried SET NX sees the caller own write and reports
(false, nil) — "already claimed" — for what was actually a
first-ever claim. checkAndMarkLogoutJTIProcessed then rejected a
legitimate logout token (and every IdP redelivery) as a replay.

Add RedisConn.doTracked, reporting whether the command was already
written when it failed; Do becomes a thin wrapper over it. Give SetNX
its own retry loop: retry a failed connection acquisition (nothing
sent yet, safe), but once doTracked reports the command reached the
wire, stop and return the new backends.ErrSetNXAmbiguous sentinel
instead of guessing. checkAndMarkLogoutJTIProcessed accepts that
specific error outright rather than falling through to the
Get+Set fallback, which would see the same ambiguous write and
misreport the token as a replay.

Pin with a TCP proxy that forwards a SET NX to a real miniredis
instance but swallows its reply: RedisBackend.SetNX must report
(false, ErrSetNXAmbiguous), and the key must actually exist in
miniredis (proving the old (false, nil) was a false negative on a
first-ever claim). Also pin checkAndMarkLogoutJTIProcessed accepting
an ambiguous SetIfAbsent result without consulting Get. Both fail on
the pre-fix code (redis.go:161 gets claimed=false err=nil;
logout_test.go:89 gets a spurious replay error) and pass here.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(changelog): record the allowUnauthenticatedPreflight option (FIX-02)

OPTIONS requests need authentication by default again. The new allowUnauthenticatedPreflight option lets a genuine CORS preflight bypass authentication, with its response body discarded.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(yaegi): pin SetIfAbsent claim semantics under yaegi (FIX-17)

Add checkSetIfAbsentUnderYaegi to cmd/yaegicheck. It claims one key twice through UniversalCache.SetIfAbsent in local-only mode and through a backend that implements SetNX, and expects exactly one winner each time. A backend without SetNX must return an error instead of a local claim. This covers the optional-interface assertion in SetIfAbsent under the interpreter.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache/redis): check sent before ctx.Err() in SetNX

RedisBackend.SetNX checked ctx.Err() before the sent check, so a lost
SET NX reply under the real 500ms SetIfAbsent context almost always
surfaced as context.DeadlineExceeded instead of ErrSetNXAmbiguous.
checkAndMarkLogoutJTIProcessed only special-cases the ambiguous
sentinel, so it fell through to the Get+Set fallback and rejected a
first-ever, never-before-seen logout token as a replay.

Move the sent check ahead of ctx.Err() so ErrSetNXAmbiguous is
reported whenever the command reached the wire, regardless of ctx
state, and keep it returned unwrapped for == comparison under yaegi.

Add a regression test that drives UniversalCache.SetIfAbsent and
checkAndMarkLogoutJTIProcessed through miniredis behind a proxy that
drops the SET NX reply, using a deterministic pre-call delay to avoid
racing the real 500ms timing window.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(main): cover AllowUnauthenticatedPreflight constructor wiring

FIX-02: main.go NewWithContext wires
Config.AllowUnauthenticatedPreflight into
TraefikOidc.allowUnauthenticatedPreflight, but every existing
middleware test builds *TraefikOidc as a struct literal and sets the
field directly, so deleting that wiring line failed no test.

Add a pair of tests that build the plugin through NewWithContext: one
with the flag enabled, asserting a genuine CORS preflight reaches next
and the response body is discarded; one with the default config,
asserting the same request is redirected into the login flow instead.
Confirmed with a mutation (temporarily removing the wiring line) that
the enabled case fails while the default case still passes, then
restored the line.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(refresh): drop unused nolint:gosec on tracked refresh goroutine

FIX-36: nolintlint (allow-unused: false) reports the //nolint:gosec
directive on the tracked refresh goroutine call as unused — gosec
never flagged this line, so the suppression served no purpose.

Remove the directive suffix and keep the explanatory comment, which
still documents why the goroutine detaches from the request ctx.

nolintlint is not in .golangci.yml enable list in this worktree, so
plain golangci-lint run ./... does not surface this finding either
before or after the change; verified with --enable nolintlint instead
that the report is gone and gosec genuinely does not fire on this
line. The plain run ./... command shows the same 6 pre-existing,
unrelated findings before and after (2x gosec G117 in
internal/dcrstorage, 2x gosec G710 in internal/testutil/servers,
1x gosec G124 in internal/testutil/suite.go, 1x unparam in
token_manager.go) — left untouched, out of scope.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* refactor(token): remove the dead verifyOpts parameter

FIX-17 removed the only reader of verifyOpts.skipReplayMarking, so golangci-lint (unparam) reported the opts parameter of verifyTokenWithOpts as unused. Remove the verifyOpts type, its dead field, its only write in buildPrincipalFromBearerToken and the parameter, and update the comments that described it. Behaviour does not change. The function keeps its name to avoid churn in the many comments that refer to it.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(helpers): move round-file-declared cross-file JWT/GD test helpers into shared files

makeTestJWT (review_r92_test.go) was consumed by
access_token_unexpired_iat_optional_test.go and resetGdInstancesForTest
(review_r34_regression_test.go) was consumed by fix18_gd_lifecycle_test.go,
reintroducing the hidden cross-round-file dependency FIX-41 removed:
deleting or folding either round file would silently break its consumer.

Move makeTestJWT into jwt_test_helpers_test.go (alongside the other shared
JWT builders) and resetGdInstancesForTest into a new
gd_test_helpers_test.go, unchanged in behaviour.

Add TestRoundFilesDependOnlyOnSharedHelpers, a static AST-based regression
pin that parses every _test.go file and fails if any non-Test helper
declared in a review_rNN*_test.go round file is referenced from another
file, catching this class of fragility again.

Closes the remaining partial from FIX-41.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(middleware): drop Content-Length on implicit-200 preflight writes

optionsPreflightWriter only stripped a stale Content-Length inside its
own WriteHeader. A next handler that sets Content-Length and calls
Write with no explicit WriteHeader (the implicit-200 idiom) left the
real header in place while the body stayed discarded, so the client
saw a non-zero Content-Length with an empty body and treated the
preflight response as truncated.

Write now commits an implicit 200 through WriteHeader before
discarding the bytes, so Content-Length is stripped either way.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(middleware): repanic ErrAbortHandler, drop guessed post-next 500

ServeHTTP recovered http.ErrAbortHandler like any other panic and
returned normally, so net/http finished the response as if it were
complete: a reverse-proxied body truncated mid-copy (httputil panics
with this sentinel) reached the client as a clean 200 instead of an
aborted connection. Re-panic it first, before any logging or write,
so the outer net/http recovery aborts the connection the same way it
would with no plugin in front of it.

Separately: once t.next.ServeHTTP has been called it holds the real
ResponseWriter (FIX-06), not the tracking wrapper, so wroteHeader can
no longer prove nothing was sent. The old code still guessed and sent
WriteHeader(500) unconditionally, which is a superfluous call net/http
logs whenever next already committed a response. The recovery now
logs and returns without writing once next has been reached, instead
of guessing. Documented trade-off: a panic in next before it writes
anything no longer gets an explicit 500 from this middleware.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(main): gate the SECURITY log on whether an override is set

discoveredEndpointHasNoOverride was static: it always answered false
for revocation, end_session and introspection, regardless of whether
the operator had actually configured revocationURL/oidcEndSessionURL/
introspectionURL. With no override set, a scheme-downgrade drop of one
of these three is exactly as terminal as a drop of jwks_uri,
authorization or token, yet it never logged the SECURITY line, and the
comment plus docs/CONFIGURATION.md claimed nothing fails for them.

discoveredEndpointHasNoOverride now checks the matching config field
and fires the SECURITY line whenever it is empty. registration is
unaffected: its override is read independently of this discovery
step. Corrects docs/CONFIGURATION.md to match.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(yaegicheck): fail NEW-01 introspection checks on recovered panic

checkNew01IntrospectionBearerStatus only failed when rw.Code == 0,
which httptest.NewRecorder never leaves (it starts at 200), so a
reintroduced errors.As panic on the bearer path -- recovered by
ServeHTTP as a 500 -- still printed PASS. Require the exact expected
status (503, bearerErrIntrospectionUnavailable) instead.

The bearer path also shares introspectToken with the SESSION path
(token_validation_rs.go, the NEW-01 fix site) but never reaches it, so
no check exercised the classification commit d7686c3 actually fixed.
Adds checkNew01OpaqueSessionIntrospectionClassification: builds an
authenticated cookie session holding an opaque access token via a
second SessionManager sharing cfgs encryption key and cookie
parameters (the plugins own session manager is an unexported field,
unreachable from this package, but the cookie codec key is a pure
function of those inputs), then drives it through ServeHTTP against a
5xx introspection response and requires the expected 302
re-authentication redirect.

Verified both checks fail under yaegi v0.16.1 with a temporarily
reintroduced errors.As at their respective sites (bearer_auth.go
buildPrincipalFromOpaqueIntrospection, token_validation_rs.go
validateStandardTokensRS), then reverted.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* ci(pr): run cmd/yaegicheck under yaegi v0.16.1 on every PR

The 15 yaegi-only regression checks in cmd/yaegicheck (errors.As on an
interpreted target, SSE Flush across the interpreter boundary, ...)
only ran locally via `make yaegi-validate`. The shared go-pr.yaml
workflow has no yaegi step, so a PR reintroducing an errors.As on an
interpreted type -- the exact shape of the NEW-01 production break --
passed CI.

Adds a sibling yaegi-validate job: checkout, setup-go, install yaegi
pinned to v0.16.1 (the version Traefik v3.7.1 vendors, matching
Makefile YAEGI_VERSION), symlink the checkout into GOPATH so yaegi
resolves the plugins own import path, then run cmd/yaegicheck.
contents:read only and a 10-minute timeout; no non-actions/* action is
used, so nothing needs SHA pinning. The existing pr-checks job is
unchanged.

Validated: python3 -c "import yaml" parses the file, and the shell
steps ran end to end against a fresh private GOPATH (go install +
symlink + yaegi run, exit 0).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(middleware): repanic instead of swallowing a post-next panic

Once t.next has been called, the deferred recover silently returned
after logging, answering every post-next panic with a false clean
response: an empty 200 for a pre-write panic, and a truncated-but-
"complete" 200 for a mid-body panic. That is the same defect class
the ErrAbortHandler branch above it already exists to prevent.

Re-panic the original value instead, once calledNext is true. This
writes no second WriteHeader and wraps nothing, so it reaches
net/http's own top-level recovery (or, in production, Traefik's
compiled recovery middleware), which can tell whether a response was
already committed and react correctly from outside this plugin.

Update the three regression tests that pinned the old return-normally
behavior (TestServeHTTP_RecoversHandlerPanic,
TestServeHTTP_PanicAfterNextCommitted_NoSuperfluousWriteHeader,
TestR155_ServeHTTP_PanicAfterCommitKeepsBodyIntact) to recover around
ServeHTTP and assert the original panic value comes back out, with the
writer holding only next's own writes.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(middleware): fix stale trackingWriter doc comment on calledNext

The comment said the panic handler still sends a header-only 500 once
calledNext is true. That stopped being true with the repanic fix: the
recover now re-panics the original value and writes nothing.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(yaegi): pin ErrAbortHandler abort behavior through a compiled next

r == http.ErrAbortHandler only matches a panic raised by compiled
code under yaegi v0.16.1 -- exactly the real production shape, since
only this plugin runs interpreted and every next handler downstream
of it is compiled. Add a yaegicheck that drives that shape for real: a
front-facing server running the interpreted plugin, next a compiled
httputil.ReverseProxy, upstream writes a partial chunk, flushes, then
Hijacks and closes the raw connection. The client must see a non-nil
read error, never a clean 200 with a truncated body.

Amend the comment on the ErrAbortHandler branch: the re-panicked
value is not identical to the sentinel once it crosses back out of
the interpreter, so net/http and Traefik log a panic line even though
the connection still aborts correctly.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(yaegicheck): require an actual introspection hit for NEW-01 session check

checkNew01OpaqueSessionIntrospectionClassification passed on a bare
302 alone. An unauthenticated request with no session cookie at all
also redirects with 302, without ever calling
introspectToken/validateOpaqueToken (the d7686c3 fix site), so a
future regression there could leave the check green.

Count requests that reach the introspection endpoint with an atomic
counter and require at least one, alongside the existing 302 check.

Verified: with the cookie deliberately withheld (simulating the
second SessionManager cookie no longer decoding), the check now FAILS
with "expected at least one request to reach the introspection
endpoint ... got 0" instead of silently printing PASS.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(main): cover revocation and introspection in the override-replace test

TestUpdateMetadataEndpoints_ConfigOverrideReplacesDroppedEndpoint only
pinned end_session. A regression that stopped applying
configRevocationURL or configIntrospectionURL specifically left every
test green.

Verified: with discoveredEndpointHasNoOverride hardcoded to always
report no override for revocation/introspection (ignoring the
configured override), the prior test suite still passed. The new
table-driven version, run against the same mutation, fails for both
revocation and introspection; reverted, all three subtests pass.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(config): correct registration override wording for scheme-downgrade drops

The prior wording implied an override always covers registration. It
does not: RegisterClient falls back to the discovered
registrationURL whenever dynamicClientRegistration.registrationEndpoint
is unset (main.go), so an unset override plus a scheme-downgrade drop
breaks Dynamic Client Registration with only the generic ERROR line --
the same unset-override case this fix already made loud for
revocation, end_session and introspection.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(session): make pool-return ownership check and release atomic

returnToPoolIfOwner checked sd.generation.Load() != gen and then called
returnToPoolSafely, whose inUse.CompareAndSwap(true, false) is a second,
independent atomic. GetSession/newSession hand an object out with
inUse.Store(true) before generation.Add(1), so a stale deferred return
from a previous owner could land its generation check in that window,
then have its CAS succeed against a concurrently re-acquired object,
releasing (and Reset()ing) a session another request still owns.

Replace inUse+generation as the ownership gate with a single atomic
word, sessionOwner: 0 means free, any nonzero value is the current
owner's generation. A handout claims it with Store(newGeneration); a
release claims it back with one CompareAndSwap(gen, 0). generation
itself never resets and is never reused, so once a release zeroes
sessionOwner, no later stale CompareAndSwap naming an older generation
can ever match again, regardless of timing against a new owner's own
writes.

inUse stays as a best-effort, observational field for callers that only
need a snapshot (token_manager.go's refreshToken abort check); it is no
longer part of the ownership decision. ReturnToPool now delegates to
returnToPoolSafely so both unconditional-release call sites share one
gate instead of racing two independent CAS mechanisms.

Adds a stress regression test that races the real returnToPoolIfOwner
against a goroutine performing the exact writes GetSession/newSession
make on a handout of a freshly-freed object. A cruder version of the
same race (matching the old two-field design, where a release never
touched generation) reproduced the bug in 362/400000 iterations against
the unfixed code; the fixed code shows 0 hits deterministically across
repeated -race runs.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(session): pin ServeHTTP's generation-gated pool-return wiring

The only existing regression for FIX-10 (fix10_session_pool_aba_test.go)
calls returnToPoolIfOwner directly and never drives ServeHTTP, where the
actual fix lives (middleware.go:700-701:
'defer session.returnToPoolIfOwner(sessionGen)' instead of a plain
'defer session.returnToPoolSafely()'). Reverting those two lines
compiles and leaves the whole root suite green (re-review finding at
session.go:1825).

Add a test that drives a real ServeHTTP call through the
Clear-and-reacquire branch (processAuthorizedRequestRS's backchannel/
front-channel-logout invalidation check). A small test-only hook,
sessionClearReleaseHook (nil outside tests, called at the end of
Clear()'s existing pool-return defer), lets the test pause the
invalidated request's goroutine the instant its session is freed and
deterministically steal that exact object with a direct GetSession
call, mark it as a different user's live session, then let the
invalidated request run to completion including its outer ServeHTTP
defer.

Verified the test fails (5/5 runs) against a temporary, uncommitted
revert of middleware.go:700-701 to 'defer session.returnToPoolSafely()'
(inUse=false: the stale call released the concurrent owner's session),
and passes (including under -race) against the unmodified wiring.
middleware.go itself is untouched by this commit.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(session): make the ServeHTTP pool-owner wiring test deterministic

The initial version of TestServeHTTP_InvalidatedSessionReacquireDoesNotStealConcurrentSession
was flaky in two independent ways, both found by stress-running it:

1. Stealing the freed session object via a second, real GetSession call
   (even from the same goroutine, immediately after the Put, with
   GOMAXPROCS(1) and GC disabled) missed the just-freed object in roughly
   a quarter of runs -- sync.Pool's exact reuse behavior here is an
   unspecified implementation detail. Fixed by having the hook swap the
   SessionManager's pool for a fresh, empty one the instant it captures
   the freed pointer, so request A's own reacquire can only allocate a
   new object, never collide with the stolen one.

2. The test asserted on the stolen object's user identifier
   (SetUserIdentifier/GetUserIdentifier), which lives in the gorilla
   session's Values map. gorilla/sessions caches a decoded session on the
   *http.Request's context keyed by cookie name; request A's own reacquire
   reads the SAME request, so it aliases the SAME underlying mainSession
   the stolen SessionData points to, even once it is a distinct SessionData
   struct. Request A's own re-auth bookkeeping then legitimately (and
   correctly) mutates that shared map, which looked like corruption but
   had nothing to do with the pool-ownership bug being tested. Fixed by
   asserting only on the SessionData struct's own ownership fields
   (inUse/sessionOwner via ownerGeneration), which ns's aliased
   mainSession cannot touch.

Verified: 80/80 passes against the correct wiring and 20/20 failures
against a temporary, uncommitted revert of middleware.go:700-701 to
'defer session.returnToPoolSafely()', both under -race. middleware.go
itself remains untouched.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(session): simulate the real handout sequence in the FIX-10 ABA test

The stale-return simulation wrote inUse and generation but left
sessionOwner at 0. returnToPoolIfOwner gates on sessionOwner, so the
stale return CAS mismatched because the object looked already-free
(owner 0), not because a real new owner held it. The cleanup call at
the end of the test was therefore a no-op: it never released the
object back to the pool.

Set sessionOwner to the freshly bumped generation before inUse, the
same order GetSession/newSession use on every real handout
(session.go:1076-1078, 1108-1110). Verified against the current
session.go: before this change the cleanup left inUse true and
activeSessions unchanged; after it, inUse goes false and
activeSessions decrements by one, as a real release does.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(session): skip the pool-owner race test below GOMAXPROCS 2, fix rate claim

TestSessionPoolReturnIfOwner_ConcurrentHandoutRace only catches the
regression statistically: it needs two OS threads to interleave a
stale returnToPoolIfOwner with a concurrent handout. At GOMAXPROCS=1
it passes with 0 hits even against the unfixed two-field gate, so a
single-CPU runner would report green for the wrong reason. Skip the
test below GOMAXPROCS 2 instead.

The comment also claimed a rate "consistent with" a different,
unrelated experiment (about 3 hits per 1.2M), which does not hold up:
reverting returnToPoolIfOwner/returnToPoolSafely to the pre-fix
two-field gate and running this exact test gives 76-89 hits per
400000 on this 16-core machine, roughly 100x that figure. Replace the
claim with the rate actually measured for this test against that
mutation, plus the 0-hits-at-GOMAXPROCS=1 control that motivates the
skip.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(bearer): check local revocation blacklist and nbf on opaque path

buildPrincipalFromOpaqueIntrospection never read t.tokenBlacklist, so a
captured opaque bearer token kept authenticating after logout for as
long as the introspection endpoint still reported it active (RevokeToken
blacklists locally; provider-side revocation is best-effort and silent
by default). Reject the raw token and, when the introspection response
carries one, its jti (gated on disableReplayDetection), the same way
verifyTokenWithOpts gates the JWT path. Also enforce nbf, which
validateOpaqueToken already applies on the session path and the JWT
path applies through verifyTimeClaims, but the opaque bearer path
skipped.

Regression tests: RevokeToken-blacklisted raw token, blacklisted jti
echoed in the introspection response, and a future nbf all now 401;
each failed on the base code before this fix.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(bearer): correct maxTokenAgeSeconds:0 opt-out claim

main.go maps every maxTokenAgeSeconds <= 0 (unset or an operator setting
0) to a 24h default; there is no config value that disables the iat-age
check. The FIX-24 comment and BEARER_AUTH.md both said 0 could disable
it and be used as an opt-out for an iat-less opaque introspection
response. State plainly that 0 means the 24h default and that a
response without iat is rejected once the bound is in effect, which it
always is.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(bearer): rewrite stale JTI replay marking claim

FIX-17 removed the last writer of the JTI replay cache: no request path
Sets a JTI any more, so the header comment and BEARER_AUTH.md row that
described a Set/Get split ("skips the Set but the Get stays active")
were stale. Revocation does not depend on that cache: RevokeToken
blacklists the raw token and a JWTs jti, and both the JWT and (as of
the previous commit) the opaque-introspection bearer path check that
blacklist before accepting a token.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* chore(cache): remove dead ShardedCache

FIX-17 removed jwt.gos replay cache, ShardedCaches last production
caller. Nothing outside its own tests referenced NewShardedCache or
ShardedCache after that (verified with grep across the package and a
clean go build). Delete sharded_cache.go and the test functions that
existed only to exercise it:

- review_r57_shard_eviction_test.go, review_r86_test.go: deleted whole
  files, entirely ShardedCache-specific.
- cache_test.go, cache_bench_test.go, review_r129_test.go,
  review_r153_regression_test.go: deleted only the ShardedCache-specific
  functions/benchmarks, keeping unrelated tests in the same file.
  BenchmarkShardedVsGlobalMutex is dropped whole since its purpose was
  comparing against ShardedCache.

Approved dead-code removal per review decision; go build and the full
test suite are clean after the removal.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(bearer): scope JTI replay claim to access tokens

bearer_auth.go header and BEARER_AUTH.md JTI-replay row said no path
writes a JTI to a replay cache at all. Backchannel logout still writes
logout-token JTIs via checkAndMarkLogoutJTIProcessed (made atomic by
FIX-17, not removed). Limit the claim to access-token JTIs and name the
one JTI replay check left.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(bearer): correct stale JTI Set/Get replay claim in README

README said the bearer path skips the JTI Set but keeps the Get active,
contradicting the rewritten BEARER_AUTH.md and bearer_auth.go, both of
which say no access-token JTI Set exists on this path at all. Replace
with a bullet matching the corrected wording: revocation goes through
the raw-token (and JWT jti) blacklist, not a JTI-replay Get.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(config): correct maxTokenAgeSeconds opt-out claim

CONFIGURATION.md said maxTokenAgeSeconds:0 disables the age check.
main.go maps any value <= 0 to a 24h default; no value disables the
check. BEARER_AUTH.md already carries the corrected wording; this was
the sibling copy the earlier fix missed.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(bearer): correct nbf clock-skew-tolerance claim in comment

Comment on the opaque-introspection nbf check said it was the same
check the JWT path applies through verifyTimeClaims. It is not: the JWT
path's verifyNotBefore allows 10s of ClockSkewTolerancePast, this check
allows none. It does match validateOpaqueToken's strict comparison and
this function's own strict exp check. Comment only, no behaviour
change.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(bearer): assert opaque-token rejects return 401 not 503

TestBearerOpaqueIntrospection_RevokedTokenRejected,
_BlacklistedJtiRejected and _NbfFutureRejected only checked bErr != nil.
A mutant that swaps those three gates to
newBearerError(bearerErrIntrospectionUnavailable, ...) (mapped to 503,
and skipped by the per-IP failure tracker) still passed bErr == nil.
Add a kind == bearerErrTokenInactive check to each so the tests pin the
401 status, not just any error.

Verified against the described mutant before reverting it: all three
tests failed with 'got kind 6' (bearerErrIntrospectionUnavailable);
reverting the mutant restores a clean pass.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(bearer): pin disableReplayDetection skips jti blacklist check

The jti-blacklist gate at bearer_auth.go:928 guards itself with
!t.disableReplayDetection, but no test exercised that guard. Add
TestBearerOpaqueIntrospection_BlacklistedJtiIgnoredWhenReplayDetectionDisabled:
a blacklisted jti on an otherwise-valid introspection response must be
accepted when disableReplayDetection is true.

Verified against a mutant removing the guard before reverting it: the
new test failed with 'token replay detected (jti blacklisted)'
(bearer_opaque_binding_test.go:337); reverting the mutant restores a
clean pass across all TestBearerOpaqueIntrospection_* tests.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache/redis): treat a Redis command-error reply as definitive in SetNX

RedisBackend.SetNX reported ErrSetNXAmbiguous for any post-write read
failure, including a RESP -ERROR reply (READONLY, OOM, MISCONF). That
reply proves Redis rejected the command, unlike a genuinely lost reply
after a timeout/EOF/reset. Reporting it as ambiguous let
checkAndMarkLogoutJTIProcessed accept a logout jti-claim outright
instead of falling to its local Get+Set fallback, so a captured
backchannel-logout token could be replayed forever while Redis
rejects writes (e.g. a demoted read-only replica).

Check errors.Is(doErr, ErrCommandReply) before the sent-based
ambiguity check and return it as a plain error. Add a proxy-backed
regression test in internal/cache/backends pinning SetNX itself, and
an end-to-end test wiring a real RedisBackend behind a proxy that
always answers SET-family commands with -READONLY, confirming
checkAndMarkLogoutJTIProcessed now rejects the second delivery of the
same jti.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): let a newer backend value win over a stale-marked local one

FIX-04s backend-stale mark let Get serve the local value over EVERY
later backend value for a marked key, assuming the backend entry
could only be older (a same-replica write that may have landed after
a timeout). That is false across replicas: another replica can write
a genuinely newer value to the same key while this one is still
marked stale, e.g. a later cross-replica backchannel logout. The
session-invalidation cache (MonotonicMarkers, 25h local TTL) could
then ignore a newer logout from another replica for up to 25h.

Add backendValueIsNewer: when both the local and backend values
decode to a comparable timestamp, Get now serves whichever is not
older, so a genuinely newer backend value wins. Values it cannot
compare (e.g. the blacklist caches bool markers) keep the original
FIX-04 behavior of always preferring local. This also keeps the
original protection intact: an applied-but-timed-out Set is still not
clobbered by an older backend value, because local is newer in that
case too.

Add two-replica regression tests (a shared fake backend, no real
Redis needed) for both the plain and MonotonicMarkers cases.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* perf(cache): bound the legacy blacklist-namespace lookup cost

checkLegacyBlacklistMarker ran an extra Redis round trip (PING+GET,
plus PTTL when the key existed) on every single blacklist Get miss,
which is nearly every blacklist check, since most tokens are never
revoked. It also fully JSON-decoded whatever it found there, even a
CacheTypeToken claims map cached under the same raw token, just to
learn the value was not the boolean marker.

Compare the raw legacy value against the exact bytes serialize(true)
produces before decoding anything, and remember a miss (or a
non-bool legacy hit) locally per key for legacyBlacklistMissCacheTTL
(30s), so a repeated check for the same key skips the legacy round
trip until the window elapses. A genuine legacy marker already in
Redis is still honored once the window is up. Prune expired entries
opportunistically from cleanup(), which already runs on a timer for
every cache including the blacklist one.

Add miniredis CommandCount-based regression tests: the fix reduces a
repeated miss from 4 Redis commands to 2, and separate tests pin that
a real legacy marker is still found and a cached claims map is still
never misread as one.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* chore(cache): remove dead memory/hybrid backend config

FIX-43 deleted MemoryBackend and HybridBackend, but config.go still
declared BackendTypeMemory, BackendTypeHybrid, TypeMemory, TypeHybrid,
DefaultConfig (Type: memory) and DefaultHybridConfig — config for
backends with no implementation left. Confirmed no production caller
of backends.DefaultConfig or backends.DefaultHybridConfig outside
their own now-deleted tests (servers.DefaultConfig in
internal/testutil/servers is an unrelated function).

Remove both functions and the memory/hybrid constants; keep
BackendTypeRedis/TypeRedis, the only backend now implemented. Delete
config_test.go, which exercised only DefaultHybridConfig.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(cache): run the backend contract suite against a real RedisBackend

TestCacheBackendContract was a no-op: setupMemoryBackend and
setupRedisBackend were both t.Skip stubs, so no CacheBackend
implementation ever ran the 13 shared contract tests. MemoryBackend
no longer exists (FIX-43), so drop that subtest and wire
setupRedisBackend to a real miniredis-backed RedisBackend, matching
the pattern redis_test.go and singleflight_test.go already use.

miniredis only expires a key when its own simulated clock is moved
forward (FastForward) - it never expires anything on real elapsed
time, so testTTLExpirations time.Sleep never actually exercised
expiry against it. Thread an advanceClock func through
runContractTests/testTTLExpiration and pass mr.FastForward for it, so
that subtest genuinely proves expiry rather than passing by coincidence.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): bound the backend-stale mark in time for values FIX-04 cannot compare

markBackendStale/backendStaleLocalValue let Get serve the local value over
every later backend value, for as long as the local entry stayed live,
whenever backendValueIsNewer cannot decode the value into a comparable
number (a string, a map, a struct). The DCR client-credentials cache
(a JSON string, TTL up to 100*365 days) hit this on every replica whose
write timed out: a stale credential could pin over a value a different
replica legitimately wrote, for the entry's whole TTL.

staleBackend now records when each key was marked (map[string]time.Time),
and backendStaleLocalValue treats a mark older than the new
backendStaleMarkTTL (5s, well above the 500ms Set timeout) as expired,
deleting it so the current backend value is trusted again. The numeric
newer-wins comparison for MonotonicMarkers caches is unchanged.

Two regression tests pin both directions for a non-numeric (string) value
across two replicas sharing one backend: within the bound an older
backend write does not clobber the surviving local value, and after the
bound a newer value written by another replica is served.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): gate the backend-stale numeric comparison on MonotonicMarkers

backendValueIsNewer's "larger number wins" comparison ran for every
cache, not only MonotonicMarkers ones. For a non-monotonic numeric cache
a larger number is not necessarily a newer write, so an older, larger
backend value could clobber a fresh, smaller local write that survived a
timed-out Set — the exact clobber FIX-04 exists to prevent.

Get now gates the comparison behind c.config.MonotonicMarkers. Every
other cache recovers from a stale mark via the time bound added in the
previous commit instead of by numeric order.

Rebuilt TestR4_BackendStale_CrossReplicaNewerValue_PrefersNewerBackend on
the time bound instead of numeric order, since its cache never set
MonotonicMarkers, and added a regression test pinning the direction it
used to get backwards (an old, larger backend value must not clobber a
fresh, smaller local write on a non-monotonic cache).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* perf(cache): cap legacyBlacklistMissUntil at the cache's MaxSize

legacyBlacklistMissUntil had no size cap of its own. Its keys came from
the raw bearer token, looked up before signature verification, so a
caller who can send unique tokens fully controlled how many distinct
entries piled up. Pruning ran only from cleanup()'s 5-minute tick, so
each unique key stayed in memory for up to ~5.5 minutes regardless of
volume — unbounded memory a caller could grow at will.

recordLegacyBlacklistMiss now caps the map at c.config.MaxSize (already
>0 for every cache), pruning expired entries inline when the cap is hit
before deciding whether to record. If it is still full afterward, the
miss is simply not recorded — the only cost is one extra legacy lookup
next time, exactly what every check paid before this bound existed. The
map is also keyed by a sha256 digest of the lookup key instead of the raw
string, so an entry's size no longer grows with token length.

Regression test drives a small-MaxSize blacklist cache through 4x its
cap in unique misses and asserts the map never exceeds the cap, and that
a genuine legacy marker is still honored while the map sits at capacity.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): honour the pre-#117 legacy blacklist marker encoding

checkLegacyBlacklistMarker's byte compare recognized only the current
serialize() encoding (0x01 type-marker byte + json.Marshal(true)). Code
before #117 (commit 775de2a; every tag up to and including v0.8.17) wrote
plain json.Marshal(true) with no type-marker byte at all - 4 bytes,
'true'. deserialize's legacy no-marker fallback still accepts that
shape, and the OLD checkLegacyBlacklistMarker (which deserialized instead
of comparing bytes) honored it, so a Redis-mode upgrade straight from
v0.8.17 or earlier could silently drop revocations written up to the
blacklist's TTL before the upgrade.

Also accept legacyBlacklistTrueMarker with its type-marker byte stripped.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(lifecycle): fix order-dependent baseline and global-state leaks in FIX-35/18/19 tests

TestFix35_ConcurrentNewKeepsSingletonAliveAcrossOldClose registered a live
instance without capturing a liveInstanceCount baseline first. A live
instance left registered by an earlier test in the same run already makes
the pre-FIX-35 stale "was last" decision false on its own, so the test
cannot tell a reverted production fix from a working one under -shuffle.
Save/reset/restore the counter via a new resetLiveInstanceCountForTest
return value and t.Cleanup instead. Reproduced with a temporary leaked
instance ahead of the test plus a manual revert of the FIX-35 decision in
Close(): the test passed either way before this change, now fails as
expected. TestFix35_StopIfLastInstanceHoldsLockAcrossCheckAndStop is
updated to the same save/restore pattern.

TestFix18_CloseImmediatelyAfterNewDoesNotReRegister called the shared
resetGdInstancesForTest helper, which wipes the process-global gdInstances
registry with no restore, discarding any GracefulDegradation instances
other tests left registered. Add snapshotAndClearGdInstancesForTest, which
saves the prior set and restores it via t.Cleanup.

TestFix19_RegisterBackgroundTaskKeepsPendingTaskNoOrphan called
rm.StopAllTasks() on the process-global ResourceManager, which stops every
registered singleton task (memory-monitor, singleton-token-cleanup, etc.),
not just the one this test created. Replace it with
StopBackgroundTask(name) so the test only touches its own task.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(recovery): treat HTTP 408 as transient in isTerminalClientError

isTerminalClientError excluded only 429 from the terminal-4xx breaker
exemption, so a burst of token-endpoint 408 Request Timeout responses
never opened the refresh circuit breaker. token_validation_rs.go (FIX-13),
bearer_auth.go, and internal/recovery already classify 408 as a transient
service-health signal, not a per-request rejection. Exclude 408 alongside
429.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* refactor(recovery): move healthRoutineSettled out of production code

GracefulDegradation.healthRoutineSettled was added to error_recovery.go
(production) but its only caller is fix18_gd_lifecycle_test.go, and its
own doc comment says "Tests use this". FIX-39 established the pattern of
keeping test-only helpers out of the production binary
(internal/pool/export_test.go). Move the method into
fix18_gd_lifecycle_test.go next to its sole caller,
waitForHealthRoutineSettled.

No behavior change: verified via go build (production code compiles with
the method removed) and the FIX-18 test suite, unchanged.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(refresh): remove fixed-sleep dedup race in TestRefreshRateLimiting

TestRefreshRateLimiting used the default 100ms DeduplicationCleanupDelay
and a 150ms sleep to outrun it before starting the next iteration -- the
same fixed-sleep-vs-cleanup-timer race FIX-22 removed from its siblings
(TestCircuitBreakerProtection, issue67, review_refresh_cb), but not from
this test.

Reproduced deterministically by temporarily setting
DeduplicationCleanupDelay above the 150ms sleep: the next CoordinateRefresh
call then joins the still-registered previous operation instead of
starting fresh, so attempts is miscounted (5 instead of 3) and cooldown
never triggers. Fix: DeduplicationCleanupDelay=0 plus waitForRefreshDrain
polling the in-flight map, matching the sibling tests.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(refresh): bound Shutdown's abandonment of in-flight refreshes to a drain cap

FIX-36 made Shutdown cancel rc.ctx immediately, aborting every in-flight
refresh unconditionally -- including one whose refreshFunc call had
already reached the IdP and would complete on its own. Discarding that
result loses the token response, and for a rotating IdP (Zitadel,
Authentik), consumes a one-time-use refresh token that gets thrown away,
forcing the next refresh into invalid_grant and a re-login.

DECIDED: Shutdown now waits for in-flight refreshes to drain naturally, up
to a new shutdownRefreshDrainTimeout (5s) constant. A refresh that
completes within the cap delivers its result to its waiters as normal;
Shutdown only cancels rc.ctx (abandoning whatever is still running) once
the cap elapses, so Shutdown itself never blocks longer than the cap.
CoordinateRefresh's stopChan check (still gated by lifecycleMu, still
ahead of wg.Add) is unchanged: a call arriving after Shutdown starts is
still rejected immediately, without waiting for the drain cap.

Reproduced with a probe mirroring the finding's evidence (refreshFunc
completes 300ms after Shutdown starts): the waiter got "refresh
coordinator is shutting down: context canceled" instead of its tokens on
unfixed code. Added as
TestFix36_ShutdownDeliversResultForRefreshCompletingWithinDrainCap
(fails on base at refresh_coordinator_test.go:905) and
TestFix36_ShutdownReturnsNearCapWhenRefreshExceedsIt (fails on base:
Shutdown returned after 4.666us instead of waiting out the cap), plus a
rejected-during-drain coverage test. Rewrote
TestFix36_ShutdownReturnsPromptlyDuringInFlightRefresh into these two,
since its "always cancel immediately" assertions directly contradicted
the new contract, and its refreshFunc's fixed 3s time.Sleep left a
goroutine running past the test -- both replacements block on a channel
released via t.Cleanup instead.

Updated review_r63's TestRefreshCoordinatorShutdownReleasesWaiterOnInflight
and review_r154's TestRefreshCoordinator_ShutdownWaitsForInFlight to the
same drain-cap contract: their refreshFunc never completes on its own, so
they now assert Shutdown gives up near the cap (not immediately) and the
waiter still gets an error, while keeping their original wg-tracking
assertion (circuit-breaker failure recorded before Shutdown returns).

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(refresh): gate the pre-start refresh on stopChan, not only rc.ctx

Shutdown closes stopChan synchronously but only cancels rc.ctx after
shutdownRefreshDrainTimeout (or once every in-flight refresh drains).
executeRefreshAsyncs inner goroutine checked only rc.ctx.Err() before
calling refreshFunc, so an operation whose wg.Add ran just before
Shutdown started, but whose goroutine reached that check afterward,
still spent the IdP grant for nothing during the whole drain window.

Add a stopChan gate ahead of the rc.ctx check so a refresh not yet
started is skipped and its waiter gets the shutdown error immediately.
Also make Shutdown cancel rc.ctx unconditionally before it returns (not
only on the drain-cap path), so a clean Shutdown with nothing in flight
still leaves rc.ctx canceled instead of dead. Update the stale FIX-36
comments describing the old cancel-immediately contract.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(refresh): wait on stopChan instead of fixed sleeps in two Fix36 tests

TestFix36_CoordinateRefreshRejectedAfterShutdownStillImmediate slept
20ms hoping Shutdown had closed stopChan by then; a late-scheduled
Shutdown would let the second CoordinateRefresh get wrongly accepted.
TestFix36_ShutdownDeliversResultForRefreshCompletingWithinDrainCap
slept 50ms before releasing the refresh; if Shutdown had not started
yet, the refresh would finish before Shutdown ran, passing even on the
reverted cancel-immediately code (a false negative).

Both now block on <-rc.stopChan (with a 2s failure timeout) so the
release/second-call always happens strictly after Shutdown has begun.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(lifecycle): remove duplicated doc paragraph in FIX-35 test

be3ac67 duplicated the TestFix35_ConcurrentNewKeepsSingletonAliveAcrossOldClose
doc paragraph word for word. Delete the copy and keep the baseline
paragraph that follows it.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(lifecycle): restore process-global singleton state in fix18/fix35 tests

TestFix18_TraefikOidcCloseEmptiesGDInstances made its synthetic
instance the last live one, so Close() ran stopIfLastInstance and
stopped singleton-token-cleanup and (via StopAllTasks) every other
process-global singleton, including memory-monitor, with nothing to
restart them. TestFix35_ConcurrentNewKeepsSingletonAliveAcrossOldClose
unconditionally reset the global memory monitor on entry and on
cleanup, discarding whatever state an earlier test in the same binary
left running.

Fix18: register a sentinel live instance so this test is never the
last one, leaving Close()s last-instance stop path unreached.
Fix35: capture whether memory-monitor was running before this tests
own reset, and restart it in a cleanup (registered first, so it runs
last) when it was.

Verified with a throwaway probe (started both singletons, ran both
tests via t.Run, asserted running-state after): failed at HEAD with
singleton-token-cleanup=false/memory-monitor=false after fix18 and
memory-monitor still false after fix35; passes with this change.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(lifecycle): surface StopBackgroundTask errors in FIX-19 test

_ = rm.StopBackgroundTask(name) discarded the "task not registered"
error StopBackgroundTask returns on a failed lookup, which would let
the test fail later with a misleading "orphan escaped registry"
message instead of pointing at the real cause. Fail the test directly
with the actual error, and fix the stale StopAllTasks wording in the
neighboring failure message to name the call this test actually makes.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* docs(changelog): record the round-4 re-review fixes

Record the behaviour changes users can notice: opaque bearer tokens with all three bearer flags, the first post-upgrade logout for older sessions, the 5-second refresh drain on shutdown, and panics after forwarding that now abort the connection. Add a Fixed section for the six round-4 fixes and note that the legacy blacklist check runs at most once per key in each 30 seconds.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(cache): keep the backend-stale mark for MonotonicMarkers caches

The round-4 time bound on the backend-stale mark also expired it for MonotonicMarkers caches. When a replica could not write a newer session-invalidation marker to Redis, it fell back to the older backend marker after 5 seconds and stopped enforcing the newer logout, which is the case FIX-04 exists for. Exempt MonotonicMarkers caches from the bound. Get still lets a newer marker from another replica win through the newer-wins compare. The regression test fails before this change (Get returns 1000) and passes after it.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* chore(git): ignore the .claude directory

Local Claude Code state (todos, review artifacts, agent worktrees) lives under .claude/ and must not be committed. Replace the narrower .claude/*.out rule with the whole directory.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(make): fail make lint on golangci-lint findings

The lint recipe "golangci-lint run ./... || echo ..." turned every lint failure into exit 0, so make lint always reported success. Use an explicit if/else: run golangci-lint when it is installed and return its exit status, otherwise print the skip message. TestMakeLintPropagatesGolangciLintResult runs the target with a fake golangci-lint and fails on the old recipe.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix: avoid narrowing int conversions flagged by gosec G115

reserveConnectionSlot and the half-open gate narrowed an int limit to int32, so a configured value above MaxInt32 wrapped negative and refused every connection or probe. Compare in int64 instead. BuildSessionName used rune(0+index) for any index below 10, so a negative index produced a non-digit; limit the fast path to 0..9. Regression tests fail on the old code.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* chore(gosec): annotate intentional findings with #nosec

GitHub code scanning runs standalone gosec, which ignores golangci //nolint:gosec directives and honors only #nosec. Replace the directive with a #nosec Gxxx comment and a reason at the nine intentional sites: persisted DCR client_secret (G117), operator-enabled insecureSkipVerify (G402), the conditional-Secure deletion cookie and a test request cookie (G124), and the test mock IdP redirects (G710). golangci-lint also honors #nosec, so it stays at 0 issues.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* ci: build with Go 1.26

staticcheck@latest (v0.8.1) and govulncheck@latest (v1.8.0) now require Go 1.26. The shared workflow runs them with GOTOOLCHAIN=local on the pinned 1.25.x, so the Static Analysis and Security Scan jobs failed to install them. Pin 1.26.x in pr.yaml (both jobs) and release.yml, matching toolchain go1.26.6 in go.mod.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(recovery): stop health routine restarting task after last Close

GracefulDegradation.Close closed stopChan without gd.mutex. A health
routine that passed its stopChan check could then reach the task registry
after the last Close stopped the shared task. RegisterBackgroundTask
replaces a stopped task, so the routine started a task that no live
instance can stop. This made TestSharedHealthTaskSurvivesOtherInstanceClose
flaky when an earlier test left the shared task running.

Close now closes stopChan under gd.mutex, so an in-flight routine finishes
before the instance unregisters. The lock is released before the task
stop, because BackgroundTask.Stop waits for a pass that takes gd.mutex.

TestSharedHealthTaskNotRestartedAfterLastClose parks the routine after its
check and fails on the old code in 20 of 20 runs.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(recovery): keep shared health pass out of health-check subtests

TestGracefulDegradationHealthChecks calls performHealthChecks directly.
The shared health-check task also runs the same registered checks in the
background, so the race detector reported a write to healthCheckCalled.
The background pass could also clear the degraded state before the first
assertion. The subtests failed 18 of 1000 runs alone under -race.

The two subtests now hold globalHealthCheckMu, so no background pass runs
during their assertions. The unlock is deferred after Close, so it runs
first and Close never waits on a blocked pass.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(tls): drop the deprecated PreferServerCipherSuites field

crypto/tls ignores Config.PreferServerCipherSuites since Go 1.18, and staticcheck v0.8.1 (SA1019), which CI now installs, fails the Static Analysis job on it. Remove the field at its three sites and the stale #nosec comment beside one of them. Behaviour does not change.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test(cleanup): wait for the processed-task metric in TestWorkerPool_GetMetrics

executeTask increments tasksProcessed in a deferred call that runs after the task returns, so the task wg.Done() can fire first, and wg.Wait() returned while the metric still read 1. CI failed on this once. Poll the counter with a 2 second deadline before asserting. With a 20ms delay injected before the increment, the old test fails in 3 of 3 runs and the new test passes.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(recovery): serialize GracefulDegradation creation with the last-instance stop

GracefulDegradation.Close removed the instance from gdInstances, decided it
was the last one, and released the lock before stopping the shared
health-check task. A GracefulDegradation created in that gap registered at
once, and its health routine adopted the still-running task. The stop then
killed the task that the new, live instance relies on, and nothing
restarted it.

Add gdLifecycleMu. NewGracefulDegradation registers under it, and Close holds
it across the last-instance check and the stop. A new instance now either
counts toward the check or registers after the stop, and its routine then
replaces the stopped task. The health-check pass never takes this lock, so
the stop can still wait for an in-progress pass.

TestSharedHealthTaskSurvivesCreateDuringLastClose pauses Close between the
check and the stop through a nil-by-default test seam
(beforeSharedTaskStop). With the seam on the old Close logic, it fails in 10
of 10 runs. With this change, it passes in 20 of 20 runs under -race.

Production impact today is limited: no production code registers a health
check, and degraded state expires through RecoveryTimeout, not the task.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* fix(session): delete stale cookies at the configured cookiePath

Session cookies are written at the configured cookiePath
(EnhanceSessionSecurity), but CleanupOldCookies wrote its deletion cookies
at a hardcoded "/". A browser deletes a cookie only when name, domain and
path all match, so the cleanup removed nothing when cookiePath was set.

Add SessionManager.effectiveCookiePath (the configured cookiePath, or "/")
and use it for cookie writes, for the deletion cookies, and in
getSessionOptions, so the three sites cannot drift. The cleanup deletes
only at the configured path. Cookies written at "/" before an operator set
cookiePath stay until they expire.

TestCleanupOldCookies_UsesConfiguredCookiePath fails on the old code
(deletion Path "/", want "/app") and passes after the fix.

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

* test: close leaked graceful-degradation managers and guard against leaks

Eleven root tests created an ErrorRecoveryManager or TokenResilienceManager,
or built a manager with a GracefulDegradation, and never closed it. Each one
left an instance registered and the shared health-check task running for
every later test in the process. That made lifecycle tests that assume a
clean start flaky (TestSharedHealthTaskSurvivesOtherInstanceClose).

The leakers were found by running each of the 1156 root tests alone, followed
by a check of gdInstances and the task state. Each leaker now registers
t.Cleanup(<manager>.Close).

TestMain now fails the package when tests leave a GracefulDegradation
unclosed or the shared task running, after a 2-second settle window for
plugin instances that close asynchronously. On a leaking test it reports
"tests leaked 1 unclosed GracefulDegradation instance(s)".

Claude-Session: https://claude.ai/code/session_01KwtV5ecajCrftcf8TkfPad

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>

internal/cache/backends/config.go

@@ -6,14 +6,10 @@ import "time"
 type BackendType string
 
 const (
-	BackendTypeMemory BackendType = "memory"
-	BackendTypeRedis  BackendType = "redis"
-	BackendTypeHybrid BackendType = "hybrid"
+	BackendTypeRedis BackendType = "redis"
 
-	// Aliases for backward compatibility
-	TypeMemory BackendType = "memory"
-	TypeRedis  BackendType = "redis"
-	TypeHybrid BackendType = "hybrid"
+	// TypeRedis is an alias for backward compatibility
+	TypeRedis BackendType = "redis"
 )
 
 // Config provides common configuration for cache backends
@@ -39,17 +35,6 @@ type Config struct {
 	TLSSkipVerify        bool
 }
 
-// DefaultConfig returns a default configuration for in-memory caching
-func DefaultConfig() *Config {
-	return &Config{
-		Type:            BackendTypeMemory,
-		MaxSize:         1000,
-		MaxMemoryBytes:  50 * 1024 * 1024, // 50MB
-		CleanupInterval: 5 * time.Minute,
-		EnableMetrics:   true,
-	}
-}
-
 // DefaultRedisConfig returns a default configuration for Redis caching
 func DefaultRedisConfig(addr string) *Config {
 	return &Config{
@@ -64,19 +49,3 @@ func DefaultRedisConfig(addr string) *Config {
 		EnableMetrics:        true,
 	}
 }
-
-// DefaultHybridConfig returns a default configuration for hybrid caching
-func DefaultHybridConfig(redisAddr string) *Config {
-	return &Config{
-		Type: BackendTypeHybrid,
-		L1Config: &Config{
-			Type:            BackendTypeMemory,
-			MaxSize:         500,
-			MaxMemoryBytes:  10 * 1024 * 1024, // 10MB for L1
-			CleanupInterval: 1 * time.Minute,
-		},
-		L2Config:      DefaultRedisConfig(redisAddr),
-		AsyncWrites:   true,
-		EnableMetrics: true,
-	}
-}

internal/cache/backends/config_test.go

@@ -1,59 +0,0 @@
-//go:build !yaegi
-
-package backends
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestDefaultHybridConfig verifies the default hybrid configuration
-func TestDefaultHybridConfig(t *testing.T) {
-	redisAddr := "localhost:6379"
-
-	config := DefaultHybridConfig(redisAddr)
-
-	require.NotNil(t, config)
-
-	// Verify top-level config
-	assert.Equal(t, BackendTypeHybrid, config.Type)
-	assert.True(t, config.AsyncWrites)
-	assert.True(t, config.EnableMetrics)
-
-	// Verify L1 (memory) config
-	require.NotNil(t, config.L1Config)
-	assert.Equal(t, BackendTypeMemory, config.L1Config.Type)
-	assert.Equal(t, 500, config.L1Config.MaxSize)
-	assert.Equal(t, int64(10*1024*1024), config.L1Config.MaxMemoryBytes) // 10MB
-	assert.Equal(t, 1*time.Minute, config.L1Config.CleanupInterval)
-
-	// Verify L2 (Redis) config exists
-	require.NotNil(t, config.L2Config)
-	assert.Equal(t, BackendTypeRedis, config.L2Config.Type)
-}
-
-func TestDefaultHybridConfig_DifferentRedisAddr(t *testing.T) {
-	tests := []struct {
-		name      string
-		redisAddr string
-	}{
-		{"localhost", "localhost:6379"},
-		{"remote host", "redis.example.com:6379"},
-		{"IP address", "192.168.1.100:6379"},
-		{"custom port", "localhost:6380"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			config := DefaultHybridConfig(tt.redisAddr)
-
-			require.NotNil(t, config)
-			assert.Equal(t, BackendTypeHybrid, config.Type)
-			assert.NotNil(t, config.L1Config)
-			assert.NotNil(t, config.L2Config)
-		})
-	}
-}

internal/cache/backends/errors.go

@@ -35,4 +35,21 @@ var (
 
 	// ErrDeserializationFailed is returned when deserialization fails
 	ErrDeserializationFailed = errors.New("deserialization failed")
+
+	// ErrSetNXUnsupported is returned by a CacheBackend wrapper's SetNX when
+	// the backend it wraps does not itself implement SetNX (FIX-17 round-2).
+	// Compared with == only: no errors.As, no fmt.Errorf %w — an interpreted
+	// value wrapped with %w loses its type under yaegi v0.16.1, and
+	// errors.As with an interpreted target type panics there.
+	ErrSetNXUnsupported = errors.New("cache backend does not support atomic SetNX")
+
+	// ErrSetNXAmbiguous is returned by RedisBackend.SetNX when the SET NX
+	// command was already written to the connection but its reply could not
+	// be read (timeout, EOF, connection reset): Redis may or may not have
+	// applied it. Unlike Set's idempotent SETEX/PSETEX, retrying SET NX
+	// blindly here would see the caller's own possible write and misreport
+	// a first-ever claim as already-claimed, so SetNX surfaces the
+	// ambiguity instead of guessing (FIX-17 round-2). Compared with == only,
+	// for the same yaegi reason as ErrSetNXUnsupported.
+	ErrSetNXAmbiguous = errors.New("SET NX outcome unknown: reply lost after the command was sent")
 )

internal/cache/backends/hybrid.go

@@ -1,732 +0,0 @@
-// Package backend provides cache backend implementations for the Traefik OIDC plugin.
-package backends
-
-import (
-	"context"
-	"fmt"
-	"log"
-	"sync"
-	"sync/atomic"
-	"time"
-)
-
-// HybridBackend implements a two-tier cache with L1 (memory) and L2 (Redis) backends
-// It provides automatic failover, async writes for non-critical data, and optimized read paths
-type HybridBackend struct {
-	lastL2Error         atomic.Value
-	secondary           CacheBackend
-	primary             CacheBackend
-	logger              Logger
-	ctx                 context.Context
-	syncWriteCacheTypes map[string]bool
-	asyncWriteBuffer    chan *asyncWriteItem
-	l1BackfillBuffer    chan *l1BackfillItem
-	cancel              context.CancelFunc
-	wg                  sync.WaitGroup
-	l1Hits              atomic.Int64
-	errors              atomic.Int64
-	l2Writes            atomic.Int64
-	l1Writes            atomic.Int64
-	misses              atomic.Int64
-	l2Hits              atomic.Int64
-	l1BackfillDrops     atomic.Int64
-	fallbackMode        atomic.Bool
-}
-
-// asyncWriteItem represents an async write operation
-type asyncWriteItem struct {
-	ctx   context.Context
-	key   string
-	value []byte
-	ttl   time.Duration
-}
-
-// l1BackfillItem represents a deferred write of an L2-resolved value back into
-// L1. Backfills run on a single bounded worker so a burst of L2 hits cannot
-// detonate the goroutine count (issue: ~1000% CPU under sustained polling).
-type l1BackfillItem struct {
-	key   string
-	value []byte
-	ttl   time.Duration
-}
-
-// Logger interface for structured logging
-type Logger interface {
-	Debugf(format string, args ...interface{})
-	Infof(format string, args ...interface{})
-	Warnf(format string, args ...interface{})
-	Errorf(format string, args ...interface{})
-}
-
-// defaultLogger provides a basic logger implementation
-type defaultLogger struct {
-	*log.Logger
-}
-
-func (l *defaultLogger) Debugf(format string, args ...interface{}) {
-	l.Printf("[DEBUG] "+format, args...)
-}
-
-func (l *defaultLogger) Infof(format string, args ...interface{}) {
-	l.Printf("[INFO] "+format, args...)
-}
-
-func (l *defaultLogger) Warnf(format string, args ...interface{}) {
-	l.Printf("[WARN] "+format, args...)
-}
-
-func (l *defaultLogger) Errorf(format string, args ...interface{}) {
-	l.Printf("[ERROR] "+format, args...)
-}
-
-// HybridConfig provides configuration for the hybrid backend
-type HybridConfig struct {
-	Primary             CacheBackend
-	Secondary           CacheBackend
-	Logger              Logger
-	SyncWriteCacheTypes map[string]bool
-	AsyncBufferSize     int
-}
-
-// NewHybridBackend creates a new hybrid cache backend with L1 (memory) and L2 (Redis) tiers
-func NewHybridBackend(config *HybridConfig) (*HybridBackend, error) {
-	if config == nil {
-		return nil, fmt.Errorf("config is required")
-	}
-
-	if config.Primary == nil {
-		return nil, fmt.Errorf("primary (L1) backend is required")
-	}
-
-	if config.Secondary == nil {
-		return nil, fmt.Errorf("secondary (L2) backend is required")
-	}
-
-	if config.Logger == nil {
-		config.Logger = &defaultLogger{Logger: log.New(log.Writer(), "[HybridCache] ", log.LstdFlags)}
-	}
-
-	if config.AsyncBufferSize <= 0 {
-		config.AsyncBufferSize = 1000
-	}
-
-	// Default critical cache types that require synchronous writes
-	if config.SyncWriteCacheTypes == nil {
-		config.SyncWriteCacheTypes = map[string]bool{
-			"blacklist": true, // Token blacklist must be immediately consistent
-			"token":     true, // Token validation is critical
-		}
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-
-	h := &HybridBackend{
-		primary:             config.Primary,
-		secondary:           config.Secondary,
-		syncWriteCacheTypes: config.SyncWriteCacheTypes,
-		asyncWriteBuffer:    make(chan *asyncWriteItem, config.AsyncBufferSize),
-		l1BackfillBuffer:    make(chan *l1BackfillItem, config.AsyncBufferSize),
-		ctx:                 ctx,
-		cancel:              cancel,
-		logger:              config.Logger,
-	}
-
-	// Start async write worker
-	h.wg.Add(1)
-	go h.asyncWriteWorker()
-
-	// Start L1 backfill worker (single goroutine) to bound goroutine growth on
-	// L2 hits regardless of request rate.
-	h.wg.Add(1)
-	go h.l1BackfillWorker()
-
-	// Start health monitoring
-	h.wg.Add(1)
-	go h.healthMonitor()
-
-	h.logger.Infof("HybridBackend initialized with L1 (memory) and L2 (Redis) tiers")
-	h.logger.Infof("Sync write cache types: %v", config.SyncWriteCacheTypes)
-	h.logger.Infof("Async write buffer size: %d", config.AsyncBufferSize)
-
-	return h, nil
-}
-
-// Set stores a value in both L1 and L2 caches
-func (h *HybridBackend) Set(ctx context.Context, key string, value []byte, ttl time.Duration) error {
-	// Always write to L1 first (synchronous)
-	if err := h.primary.Set(ctx, key, value, ttl); err != nil {
-		h.errors.Add(1)
-		h.logger.Warnf("Failed to write to L1 cache: %v", err)
-		// Continue to try L2 even if L1 fails
-	} else {
-		h.l1Writes.Add(1)
-	}
-
-	// Check if we're in fallback mode
-	if h.fallbackMode.Load() {
-		h.logger.Debugf("Operating in fallback mode, skipping L2 write for key: %s", redactKey(key))
-		return nil // Don't fail the operation if L2 is down
-	}
-
-	// Determine if this should be a sync or async write based on cache type
-	cacheType := h.extractCacheType(key)
-	requiresSync := h.syncWriteCacheTypes[cacheType]
-
-	if requiresSync {
-		// Synchronous write for critical cache types
-		if err := h.secondary.Set(ctx, key, value, ttl); err != nil {
-			h.errors.Add(1)
-			h.logger.Warnf("Failed to write to L2 cache (sync) for key %s: %v", redactKey(key), err)
-			h.recordL2Error()
-			// Don't fail the operation - L1 write succeeded
-			return nil
-		}
-		h.l2Writes.Add(1)
-		h.logger.Debugf("Synchronous write to L2 completed for critical key: %s", redactKey(key))
-	} else {
-		// Asynchronous write for non-critical cache types
-		select {
-		case h.asyncWriteBuffer <- &asyncWriteItem{
-			key:   key,
-			value: value,
-			ttl:   ttl,
-			ctx:   ctx,
-		}:
-			h.logger.Debugf("Queued async write to L2 for key: %s", redactKey(key))
-		default:
-			// Buffer is full, log and continue
-			h.logger.Warnf("Async write buffer full, dropping L2 write for key: %s", redactKey(key))
-			h.errors.Add(1)
-		}
-	}
-
-	return nil
-}
-
-// Get retrieves a value from cache, checking L1 first, then L2
-func (h *HybridBackend) Get(ctx context.Context, key string) ([]byte, time.Duration, bool, error) {
-	// Try L1 first
-	value, ttl, exists, err := h.primary.Get(ctx, key)
-	if err != nil {
-		h.errors.Add(1)
-		h.logger.Debugf("L1 get error for key %s: %v", redactKey(key), err)
-	}
-
-	if exists {
-		h.l1Hits.Add(1)
-		return value, ttl, true, nil
-	}
-
-	// Check if we're in fallback mode
-	if h.fallbackMode.Load() {
-		h.misses.Add(1)
-		return nil, 0, false, nil
-	}
-
-	// Try L2
-	value, ttl, exists, err = h.secondary.Get(ctx, key)
-	if err != nil {
-		h.errors.Add(1)
-		h.logger.Debugf("L2 get error for key %s: %v", redactKey(key), err)
-		h.recordL2Error()
-		h.misses.Add(1)
-		return nil, 0, false, nil // Don't propagate L2 errors
-	}
-
-	if !exists {
-		h.misses.Add(1)
-		return nil, 0, false, nil
-	}
-
-	h.l2Hits.Add(1)
-
-	// Populate L1 cache with value from L2 (write-through on read).
-	// Hand off to the bounded backfill worker instead of spawning a goroutine
-	// per read - under burst that would mint thousands of goroutines.
-	h.queueL1Backfill(key, value, ttl)
-
-	return value, ttl, true, nil
-}
-
-// Delete removes a key from both L1 and L2 caches
-func (h *HybridBackend) Delete(ctx context.Context, key string) (bool, error) {
-	var deleted bool
-
-	// Delete from L1
-	if d, err := h.primary.Delete(ctx, key); err != nil {
-		h.logger.Debugf("Failed to delete from L1 cache: %v", err)
-	} else if d {
-		deleted = true
-	}
-
-	// Delete from L2 if not in fallback mode
-	if !h.fallbackMode.Load() {
-		if d, err := h.secondary.Delete(ctx, key); err != nil {
-			h.logger.Debugf("Failed to delete from L2 cache: %v", err)
-			h.recordL2Error()
-		} else if d {
-			deleted = true
-		}
-	}
-
-	return deleted, nil
-}
-
-// Exists checks if a key exists in either cache
-func (h *HybridBackend) Exists(ctx context.Context, key string) (bool, error) {
-	// Check L1 first
-	if exists, err := h.primary.Exists(ctx, key); err == nil && exists {
-		return true, nil
-	}
-
-	// Check L2 if not in fallback mode
-	if !h.fallbackMode.Load() {
-		if exists, err := h.secondary.Exists(ctx, key); err == nil && exists {
-			return true, nil
-		}
-	}
-
-	return false, nil
-}
-
-// Clear removes all keys from both caches
-func (h *HybridBackend) Clear(ctx context.Context) error {
-	var lastErr error
-
-	// Clear L1
-	if err := h.primary.Clear(ctx); err != nil {
-		h.logger.Errorf("Failed to clear L1 cache: %v", err)
-		lastErr = err
-	}
-
-	// Clear L2 if not in fallback mode
-	if !h.fallbackMode.Load() {
-		if err := h.secondary.Clear(ctx); err != nil {
-			h.logger.Errorf("Failed to clear L2 cache: %v", err)
-			h.recordL2Error()
-			lastErr = err
-		}
-	}
-
-	return lastErr
-}
-
-// GetStats returns statistics for the hybrid cache
-func (h *HybridBackend) GetStats() map[string]interface{} {
-	l1Hits := h.l1Hits.Load()
-	l2Hits := h.l2Hits.Load()
-	misses := h.misses.Load()
-	total := l1Hits + l2Hits + misses
-
-	stats := map[string]interface{}{
-		"type":          TypeHybrid,
-		"l1_hits":       l1Hits,
-		"l2_hits":       l2Hits,
-		"misses":        misses,
-		"total":         total,
-		"l1_writes":     h.l1Writes.Load(),
-		"l2_writes":     h.l2Writes.Load(),
-		"errors":        h.errors.Load(),
-		"fallback_mode": h.fallbackMode.Load(),
-	}
-
-	if total > 0 {
-		stats["l1_hit_rate"] = float64(l1Hits) / float64(total)
-		stats["l2_hit_rate"] = float64(l2Hits) / float64(total)
-		stats["overall_hit_rate"] = float64(l1Hits+l2Hits) / float64(total)
-	}
-
-	// Add sub-backend stats
-	stats["l1_stats"] = h.primary.GetStats()
-	stats["l2_stats"] = h.secondary.GetStats()
-
-	// Add last L2 error time if available
-	if lastErr := h.lastL2Error.Load(); lastErr != nil {
-		if t, ok := lastErr.(time.Time); ok {
-			stats["last_l2_error"] = t.Format(time.RFC3339)
-			stats["seconds_since_l2_error"] = time.Since(t).Seconds()
-		}
-	}
-
-	return stats
-}
-
-// Ping checks if both backends are healthy
-func (h *HybridBackend) Ping(ctx context.Context) error {
-	// Check L1
-	if err := h.primary.Ping(ctx); err != nil {
-		return fmt.Errorf("L1 ping failed: %w", err)
-	}
-
-	// Check L2 (but don't fail if it's down)
-	if err := h.secondary.Ping(ctx); err != nil {
-		h.logger.Warnf("L2 ping failed: %v", err)
-		h.recordL2Error()
-		// Don't return error - we can operate with L1 only
-	} else {
-		// L2 is healthy, clear fallback mode if it was set
-		if h.fallbackMode.CompareAndSwap(true, false) {
-			h.logger.Infof("L2 backend recovered, exiting fallback mode")
-		}
-	}
-
-	return nil
-}
-
-// Close shuts down the hybrid backend
-func (h *HybridBackend) Close() error {
-	// Cancel context to stop workers
-	h.cancel()
-
-	// Close async write channel
-	close(h.asyncWriteBuffer)
-	close(h.l1BackfillBuffer)
-
-	// Wait for workers to finish with timeout
-	done := make(chan struct{})
-	go func() {
-		h.wg.Wait()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-		// Workers finished
-	case <-time.After(5 * time.Second):
-		h.logger.Warnf("Timeout waiting for workers to finish")
-	}
-
-	var lastErr error
-
-	// Close backends
-	if err := h.primary.Close(); err != nil {
-		h.logger.Errorf("Failed to close L1 backend: %v", err)
-		lastErr = err
-	}
-
-	if err := h.secondary.Close(); err != nil {
-		h.logger.Errorf("Failed to close L2 backend: %v", err)
-		lastErr = err
-	}
-
-	h.logger.Infof("HybridBackend closed")
-
-	return lastErr
-}
-
-// GetMany retrieves multiple values efficiently
-func (h *HybridBackend) GetMany(ctx context.Context, keys []string) (map[string][]byte, error) {
-	if len(keys) == 0 {
-		return make(map[string][]byte), nil
-	}
-
-	results := make(map[string][]byte, len(keys))
-	missingKeys := make([]string, 0)
-
-	// Try L1 first for all keys
-	for _, key := range keys {
-		if value, _, exists, _ := h.primary.Get(ctx, key); exists {
-			results[key] = value
-			h.l1Hits.Add(1)
-		} else {
-			missingKeys = append(missingKeys, key)
-		}
-	}
-
-	// If all found in L1 or in fallback mode, return
-	if len(missingKeys) == 0 || h.fallbackMode.Load() {
-		return results, nil
-	}
-
-	// Try L2 for missing keys using batch operation if available
-	if batcher, ok := h.secondary.(interface {
-		GetMany(context.Context, []string) (map[string][]byte, error)
-	}); ok {
-		l2Results, err := batcher.GetMany(ctx, missingKeys)
-		if err != nil {
-			h.logger.Debugf("L2 batch get error: %v", err)
-			h.recordL2Error()
-		} else {
-			for key, value := range l2Results {
-				results[key] = value
-				h.l2Hits.Add(1)
-				h.queueL1Backfill(key, value, 0) // 0 = primary backend default TTL
-			}
-		}
-	} else {
-		// Fallback to individual gets
-		for _, key := range missingKeys {
-			if value, ttl, exists, err := h.secondary.Get(ctx, key); err == nil && exists {
-				results[key] = value
-				h.l2Hits.Add(1)
-				h.queueL1Backfill(key, value, ttl)
-			}
-		}
-	}
-
-	// Count misses for keys not found anywhere
-	for _, key := range keys {
-		if _, found := results[key]; !found {
-			h.misses.Add(1)
-		}
-	}
-
-	return results, nil
-}
-
-// SetMany stores multiple key-value pairs efficiently
-func (h *HybridBackend) SetMany(ctx context.Context, items map[string][]byte, ttl time.Duration) error {
-	if len(items) == 0 {
-		return nil
-	}
-
-	// Write to L1 first
-	for key, value := range items {
-		if err := h.primary.Set(ctx, key, value, ttl); err != nil {
-			h.logger.Debugf("Failed to write to L1 in batch: %v", err)
-		} else {
-			h.l1Writes.Add(1)
-		}
-	}
-
-	// Skip L2 if in fallback mode
-	if h.fallbackMode.Load() {
-		return nil
-	}
-
-	// Check if L2 supports batch operations
-	if batcher, ok := h.secondary.(interface {
-		SetMany(context.Context, map[string][]byte, time.Duration) error
-	}); ok {
-		if err := batcher.SetMany(ctx, items, ttl); err != nil {
-			h.logger.Warnf("Failed to batch write to L2: %v", err)
-			h.recordL2Error()
-		} else {
-			h.l2Writes.Add(int64(len(items)))
-		}
-	} else {
-		// Fallback to individual sets
-		for key, value := range items {
-			cacheType := h.extractCacheType(key)
-			if h.syncWriteCacheTypes[cacheType] {
-				// Sync write for critical types
-				if err := h.secondary.Set(ctx, key, value, ttl); err != nil {
-					h.logger.Debugf("Failed to write to L2: %v", err)
-					h.recordL2Error()
-				} else {
-					h.l2Writes.Add(1)
-				}
-			} else {
-				// Async write for non-critical types
-				select {
-				case h.asyncWriteBuffer <- &asyncWriteItem{
-					key:   key,
-					value: value,
-					ttl:   ttl,
-					ctx:   ctx,
-				}:
-					// Queued
-				default:
-					h.logger.Warnf("Async buffer full for batch write")
-				}
-			}
-		}
-	}
-
-	return nil
-}
-
-// queueL1Backfill enqueues an L2-resolved value for write-through into L1.
-// Drops on full buffer to keep the read path constant-time; the next L2 hit
-// for the same key simply re-queues it.
-func (h *HybridBackend) queueL1Backfill(key string, value []byte, ttl time.Duration) {
-	select {
-	case h.l1BackfillBuffer <- &l1BackfillItem{key: key, value: value, ttl: ttl}:
-	default:
-		h.l1BackfillDrops.Add(1)
-		h.logger.Debugf("L1 backfill buffer full, dropping for key: %s", redactKey(key))
-	}
-}
-
-// l1BackfillWorker drains the backfill queue serially. Single worker is
-// intentional - L1 writes are local and cheap, and serializing them keeps
-// goroutine count bounded under any read rate.
-func (h *HybridBackend) l1BackfillWorker() {
-	defer h.wg.Done()
-
-	for {
-		select {
-		case <-h.ctx.Done():
-			// Drain remaining items best-effort then exit.
-			for len(h.l1BackfillBuffer) > 0 {
-				select {
-				case item := <-h.l1BackfillBuffer:
-					writeCtx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-					_ = h.primary.Set(writeCtx, item.key, item.value, item.ttl)
-					cancel()
-				default:
-					return
-				}
-			}
-			return
-
-		case item, ok := <-h.l1BackfillBuffer:
-			if !ok {
-				return
-			}
-			writeCtx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-			if err := h.primary.Set(writeCtx, item.key, item.value, item.ttl); err != nil {
-				h.logger.Debugf("Failed to populate L1 cache from L2 for key %s: %v", redactKey(item.key), err)
-			} else {
-				h.logger.Debugf("Populated L1 cache from L2 for key: %s", redactKey(item.key))
-			}
-			cancel()
-		}
-	}
-}
-
-// asyncWriteWorker processes asynchronous writes to L2
-func (h *HybridBackend) asyncWriteWorker() {
-	defer h.wg.Done()
-
-	for {
-		select {
-		case <-h.ctx.Done():
-			// Drain remaining items with best effort
-			for len(h.asyncWriteBuffer) > 0 {
-				select {
-				case item := <-h.asyncWriteBuffer:
-					ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-					_ = h.secondary.Set(ctx, item.key, item.value, item.ttl)
-					cancel()
-				default:
-					return
-				}
-			}
-			return
-
-		case item, ok := <-h.asyncWriteBuffer:
-			if !ok {
-				return
-			}
-
-			// Skip if in fallback mode
-			if h.fallbackMode.Load() {
-				continue
-			}
-
-			// Perform the write with a timeout
-			writeCtx, cancel := context.WithTimeout(item.ctx, 500*time.Millisecond)
-			if err := h.secondary.Set(writeCtx, item.key, item.value, item.ttl); err != nil {
-				h.errors.Add(1)
-				h.logger.Debugf("Async write to L2 failed for key %s: %v", redactKey(item.key), err)
-				h.recordL2Error()
-			} else {
-				h.l2Writes.Add(1)
-				h.logger.Debugf("Async write to L2 completed for key: %s", redactKey(item.key))
-			}
-			cancel()
-		}
-	}
-}
-
-// healthMonitor periodically checks L2 health and manages fallback mode
-func (h *HybridBackend) healthMonitor() {
-	defer h.wg.Done()
-
-	ticker := time.NewTicker(30 * time.Second)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-h.ctx.Done():
-			return
-
-		case <-ticker.C:
-			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-
-			if err := h.secondary.Ping(ctx); err != nil {
-				if !h.fallbackMode.Load() {
-					h.fallbackMode.Store(true)
-					h.logger.Warnf("L2 backend unhealthy, entering fallback mode: %v", err)
-				}
-			} else {
-				if h.fallbackMode.CompareAndSwap(true, false) {
-					h.logger.Infof("L2 backend healthy, exiting fallback mode")
-				}
-			}
-
-			cancel()
-		}
-	}
-}
-
-// recordL2Error records the timestamp of an L2 error
-func (h *HybridBackend) recordL2Error() {
-	h.lastL2Error.Store(time.Now())
-
-	// Check if we should enter fallback mode based on recent errors
-	if !h.fallbackMode.Load() {
-		// Simple heuristic: if we've had an error in the last second, consider L2 unhealthy
-		if lastErr := h.lastL2Error.Load(); lastErr != nil {
-			if t, ok := lastErr.(time.Time); ok && time.Since(t) < time.Second {
-				h.fallbackMode.Store(true)
-				h.logger.Warnf("Multiple L2 errors detected, entering fallback mode")
-			}
-		}
-	}
-}
-
-// extractCacheType attempts to determine the cache type from the key
-func (h *HybridBackend) extractCacheType(key string) string {
-	// Simple heuristic based on key prefixes
-	// This should match the actual cache type strategy in the main application
-
-	if len(key) > 10 {
-		prefix := key[:10]
-		switch {
-		case contains(prefix, "blacklist"):
-			return "blacklist"
-		case contains(prefix, "token"):
-			return "token"
-		case contains(prefix, "metadata"):
-			return "metadata"
-		case contains(prefix, "jwk"):
-			return "jwk"
-		case contains(prefix, "session"):
-			return "session"
-		case contains(prefix, "introspect"):
-			return "introspection"
-		}
-	}
-
-	return "general"
-}
-
-// contains checks if a string contains a substring (case-insensitive)
-func contains(s, substr string) bool {
-	if len(substr) > len(s) {
-		return false
-	}
-	for i := 0; i <= len(s)-len(substr); i++ {
-		match := true
-		for j := 0; j < len(substr); j++ {
-			if toLower(s[i+j]) != toLower(substr[j]) {
-				match = false
-				break
-			}
-		}
-		if match {
-			return true
-		}
-	}
-	return false
-}
-
-// toLower converts a byte to lowercase
-func toLower(b byte) byte {
-	if b >= 'A' && b <= 'Z' {
-		return b + 32
-	}
-	return b
-}

internal/cache/backends/hybrid_l1_backfill_test.go

@@ -1,112 +0,0 @@
-//go:build !yaegi
-
-package backends
-
-import (
-	"context"
-	"fmt"
-	"runtime"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestHybridBackend_L1BackfillBounded verifies that a burst of L2 hits does
-// not detonate the goroutine count. Pre-fix the code spawned one goroutine
-// per Get() L2 hit; post-fix all backfills funnel through a single worker.
-func TestHybridBackend_L1BackfillBounded(t *testing.T) {
-	primary := newMockBackend()
-	secondary := newMockBackend()
-
-	hybrid, err := NewHybridBackend(&HybridConfig{
-		Primary:         primary,
-		Secondary:       secondary,
-		AsyncBufferSize: 256,
-	})
-	require.NoError(t, err)
-	defer hybrid.Close()
-
-	ctx := context.Background()
-	const burst = 1000
-
-	// Pre-populate L2 with `burst` distinct keys so each Get triggers a
-	// fresh L1 backfill enqueue.
-	for i := 0; i < burst; i++ {
-		require.NoError(t, secondary.Set(ctx, fmt.Sprintf("k:%d", i), []byte("v"), time.Minute))
-	}
-
-	baseline := runtime.NumGoroutine()
-
-	// Issue the burst as fast as possible; the backfill worker MUST be the
-	// only goroutine doing L1 writes. Allow brief slack for the test runtime
-	// scheduling but anything north of +20 means goroutine leakage.
-	peak := baseline
-	for i := 0; i < burst; i++ {
-		_, _, exists, err := hybrid.Get(ctx, fmt.Sprintf("k:%d", i))
-		require.NoError(t, err)
-		require.True(t, exists)
-		if g := runtime.NumGoroutine(); g > peak {
-			peak = g
-		}
-	}
-
-	delta := peak - baseline
-	if delta > 20 {
-		t.Fatalf("goroutine count grew by %d during burst (baseline=%d peak=%d); backfill worker not bounding goroutines",
-			delta, baseline, peak)
-	}
-
-	// L1 must eventually catch up via the worker. Worker drains serially so
-	// give it a generous window proportional to the burst size.
-	deadline := time.Now().Add(2 * time.Second)
-	for time.Now().Before(deadline) {
-		var populated int
-		for i := 0; i < burst; i++ {
-			if _, _, ok, _ := primary.Get(ctx, fmt.Sprintf("k:%d", i)); ok {
-				populated++
-			}
-		}
-		// Be lenient: drops are acceptable under buffer pressure, just want
-		// most of the keys to make it.
-		if populated >= burst-int(hybrid.l1BackfillDrops.Load()) {
-			return
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-	t.Fatalf("L1 not backfilled within deadline: l2Hits=%d l1Writes=%d drops=%d",
-		hybrid.l2Hits.Load(), hybrid.l1Writes.Load(), hybrid.l1BackfillDrops.Load())
-}
-
-// TestHybridBackend_L1BackfillFullDrops verifies the drop semantics when the
-// buffer is saturated. Drops must be counted, never block, never spawn a
-// goroutine.
-func TestHybridBackend_L1BackfillFullDrops(t *testing.T) {
-	primary := newMockBackend()
-	secondary := newMockBackend()
-
-	// Tiny buffer + slow primary writes via failSet so the worker stays
-	// blocked enough to overflow the buffer.
-	hybrid, err := NewHybridBackend(&HybridConfig{
-		Primary:         primary,
-		Secondary:       secondary,
-		AsyncBufferSize: 4,
-	})
-	require.NoError(t, err)
-	defer hybrid.Close()
-
-	// Stop the worker from draining: cancel the underlying context so the
-	// worker bails out, leaving us with a cold buffer and the queue method
-	// itself responsible for drop accounting.
-	hybrid.cancel()
-	// Wait for worker to exit so it can't drain.
-	time.Sleep(50 * time.Millisecond)
-
-	for i := 0; i < 50; i++ {
-		hybrid.queueL1Backfill(fmt.Sprintf("k:%d", i), []byte("v"), time.Minute)
-	}
-
-	assert.Greater(t, hybrid.l1BackfillDrops.Load(), int64(0),
-		"expected some drops when buffer is saturated and worker is stopped")
-}

internal/cache/backends/interface.go

@@ -1,4 +1,4 @@
-// Package backend provides cache backend implementations for the Traefik OIDC plugin.
+// Package backends provides cache backend implementations for the Traefik OIDC plugin.
 package backends
 
 import (
@@ -7,7 +7,7 @@ import (
 )
 
 // CacheBackend defines the interface for all cache backend implementations
-// Implementations include: MemoryBackend, RedisBackend, and HybridBackend
+// Implementations include: RedisBackend
 type CacheBackend interface {
 	// Set stores a value in the cache with the specified TTL
 	// Returns an error if the operation fails

internal/cache/backends/interface_test.go

@@ -11,28 +11,24 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// TestCacheBackendContract defines a set of tests that all CacheBackend implementations must pass
-// This ensures that Memory, Redis, and Hybrid backends all behave consistently
+// TestCacheBackendContract defines a set of tests that all CacheBackend
+// implementations must pass. RedisBackend is the only implementation left
+// (FIX-43 deleted MemoryBackend and HybridBackend); it runs against a real
+// miniredis-backed instance via setupRedisBackend (R4 cache review — this
+// suite used to be a no-op: both subtests were t.Skip stubs).
 func TestCacheBackendContract(t *testing.T) {
-	// Test suite will be run against each backend type
-	t.Run("MemoryBackend", func(t *testing.T) {
-		backend := setupMemoryBackend(t)
-		runContractTests(t, backend)
-	})
-
 	t.Run("RedisBackend", func(t *testing.T) {
-		backend := setupRedisBackend(t)
-		runContractTests(t, backend)
-	})
-
-	t.Run("HybridBackend", func(t *testing.T) {
-		backend := setupHybridBackend(t)
-		runContractTests(t, backend)
+		backend, advanceClock := setupRedisBackend(t)
+		runContractTests(t, backend, advanceClock)
 	})
 }
 
-// runContractTests executes all contract tests against a backend
-func runContractTests(t *testing.T, backend CacheBackend) {
+// runContractTests executes all contract tests against a backend.
+// advanceClock advances TTL expiration by d: miniredis (see setupRedisBackend)
+// only expires keys when its simulated clock is explicitly moved forward, so
+// testTTLExpiration cannot rely on a real time.Sleep the way every other
+// contract test can.
+func runContractTests(t *testing.T, backend CacheBackend, advanceClock func(d time.Duration)) {
 	t.Helper()
 
 	ctx := context.Background()
@@ -62,7 +58,7 @@ func runContractTests(t *testing.T, backend CacheBackend) {
 	})
 
 	t.Run("TTLExpiration", func(t *testing.T) {
-		testTTLExpiration(t, ctx, backend)
+		testTTLExpiration(t, ctx, backend, advanceClock)
 	})
 
 	t.Run("Clear", func(t *testing.T) {
@@ -213,7 +209,7 @@ func testExists(t *testing.T, ctx context.Context, backend CacheBackend) {
 }
 
 // testTTLExpiration verifies TTL expiration behavior
-func testTTLExpiration(t *testing.T, ctx context.Context, backend CacheBackend) {
+func testTTLExpiration(t *testing.T, ctx context.Context, backend CacheBackend, advanceClock func(d time.Duration)) {
 	t.Helper()
 
 	key := "ttl-key"
@@ -229,8 +225,8 @@ func testTTLExpiration(t *testing.T, ctx context.Context, backend CacheBackend)
 	require.NoError(t, err)
 	assert.True(t, exists, "Key should exist immediately after Set")
 
-	// Wait for expiration
-	time.Sleep(200 * time.Millisecond)
+	// Advance past expiration.
+	advanceClock(200 * time.Millisecond)
 
 	// Verify expired
 	exists, err = backend.Exists(ctx, key)
@@ -378,44 +374,17 @@ func testSpecialCharactersInKeys(t *testing.T, ctx context.Context, backend Cach
 	}
 }
 
-// Helper functions to setup different backend types
-// These will be implemented in respective test files
-
-func setupMemoryBackend(t *testing.T) CacheBackend {
+// setupRedisBackend wires the contract suite to a real RedisBackend backed
+// by miniredis (R4 cache review), matching the pattern redis_test.go and
+// singleflight_test.go already use. The returned func advances miniredis's
+// own simulated clock (see MiniredisServer.FastForward): miniredis only
+// expires a key when that clock is explicitly moved forward, so it never
+// expires anything on real elapsed time alone.
+func setupRedisBackend(t *testing.T) (CacheBackend, func(d time.Duration)) {
 	t.Helper()
-	// This will be implemented in memory_test.go
-	// For now, return nil to allow compilation
-	t.Skip("MemoryBackend implementation pending")
-	return nil
-}
-
-func setupRedisBackend(t *testing.T) CacheBackend {
-	t.Helper()
-	// This will be implemented in redis_test.go
-	// For now, return nil to allow compilation
-	t.Skip("RedisBackend implementation pending")
-	return nil
-}
-
-func setupHybridBackend(t *testing.T) CacheBackend {
-	t.Helper()
-
-	primary := newMockBackend()
-	secondary := newMockBackend()
-
-	config := &HybridConfig{
-		Primary:         primary,
-		Secondary:       secondary,
-		AsyncBufferSize: 100,
-		Logger:          NewTestLogger(t),
-	}
-
-	hybrid, err := NewHybridBackend(config)
-	require.NoError(t, err)
-
-	t.Cleanup(func() {
-		hybrid.Close()
-	})
-
-	return hybrid
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
+	require.NoError(t, err, "failed to create RedisBackend")
+	t.Cleanup(func() { _ = backend.Close() })
+	return backend, mr.FastForward
 }

internal/cache/backends/log_redact.go

@@ -1,26 +0,0 @@
-// Package backends provides cache backend implementations for the Traefik OIDC plugin.
-package backends
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-)
-
-// redactKey returns a short, deterministic hash prefix of a cache key for use
-// in debug/info log lines. Cache keys in this plugin can include raw access /
-// refresh / id tokens (any caller may pass an arbitrary string), and CodeQL
-// flags `key=%s` formatters as a clear-text-logging sink for HTTP-header-
-// sourced taint. The hash preserves cache-key uniqueness in logs (same key →
-// same hash, useful for correlating a problematic key across log lines) while
-// keeping the raw value out of disk-resident log streams.
-//
-// 8 hex chars (32 bits) is enough to disambiguate at human-debugging scale
-// without making the hash itself a useful lookup primitive for an attacker
-// who only has the log stream.
-func redactKey(key string) string {
-	if key == "" {
-		return "(empty)"
-	}
-	sum := sha256.Sum256([]byte(key))
-	return hex.EncodeToString(sum[:4])
-}

internal/cache/backends/memory.go

@@ -1,535 +0,0 @@
-// Package backend provides cache backend implementations for the Traefik OIDC plugin.
-package backends
-
-import (
-	"context"
-	"sync"
-	"sync/atomic"
-	"time"
-)
-
-// Default configuration values
-const (
-	defaultShardCount      = 256
-	defaultMaxSize         = int64(10000)
-	defaultMaxMemory       = int64(100 * 1024 * 1024) // 100MB
-	defaultCleanupInterval = 5 * time.Minute
-)
-
-// memoryCacheItem represents an item in the memory cache
-type memoryCacheItem struct {
-	expiresAt   time.Time
-	createdAt   time.Time
-	accessedAt  time.Time
-	value       interface{}
-	element     interface{} // *list.Element, using interface{} to avoid import cycle
-	key         string
-	accessCount int64
-	size        int64
-}
-
-// isExpired checks if the item is expired
-func (item *memoryCacheItem) isExpired() bool {
-	if item.expiresAt.IsZero() {
-		return false
-	}
-	return time.Now().After(item.expiresAt)
-}
-
-// MemoryCacheBackend implements the CacheBackend interface using sharded in-memory storage
-// The sharded design reduces lock contention by partitioning keys across multiple shards,
-// each with its own lock.
-type MemoryCacheBackend struct {
-	shards          []*cacheShard
-	startTime       time.Time
-	lastErrorTime   time.Time
-	cleanupDone     chan struct{}
-	cleanupTicker   *time.Ticker
-	lastError       string
-	shardCount      uint32
-	shardMask       uint32
-	maxSize         int64
-	maxMemory       int64
-	cleanupInterval time.Duration
-
-	// Global stats (aggregated from shards)
-	hits      atomic.Int64
-	misses    atomic.Int64
-	sets      atomic.Int64
-	deletes   atomic.Int64
-	evictions atomic.Int64
-	errors    atomic.Int64
-
-	// Latency tracking
-	totalGetTime atomic.Int64
-	totalSetTime atomic.Int64
-	getCount     atomic.Int64
-	setCount     atomic.Int64
-
-	// State
-	closed atomic.Bool
-	mu     sync.RWMutex // For global operations like stats and error tracking
-}
-
-// NewMemoryCacheBackend creates a new sharded memory cache backend
-func NewMemoryCacheBackend(maxSize int64, maxMemory int64, cleanupInterval time.Duration) *MemoryCacheBackend {
-	if maxSize <= 0 {
-		maxSize = defaultMaxSize
-	}
-	if maxMemory <= 0 {
-		maxMemory = defaultMaxMemory
-	}
-	if cleanupInterval <= 0 {
-		cleanupInterval = defaultCleanupInterval
-	}
-
-	shardCount := uint32(defaultShardCount)
-
-	// For very small caches, reduce shard count to maintain sensible per-shard limits
-	// Ensure each shard can hold at least 2 items for proper LRU behavior
-	for shardCount > 1 && maxSize/int64(shardCount) < 2 {
-		shardCount /= 2
-	}
-	if shardCount < 1 {
-		shardCount = 1
-	}
-
-	// Per-shard limits are soft hints; global limits are enforced
-	// Give shards 2x the average to allow for uneven distribution
-	shardMaxSize := (maxSize * 2) / int64(shardCount)
-	if shardMaxSize < 4 {
-		shardMaxSize = 4
-	}
-	shardMaxMemory := (maxMemory * 2) / int64(shardCount)
-	if shardMaxMemory < 4096 {
-		shardMaxMemory = 4096 // Minimum 4KB per shard
-	}
-
-	m := &MemoryCacheBackend{
-		shards:          make([]*cacheShard, shardCount),
-		shardCount:      shardCount,
-		shardMask:       shardCount - 1, // For fast modulo with power-of-2
-		maxSize:         maxSize,
-		maxMemory:       maxMemory,
-		startTime:       time.Now(),
-		cleanupInterval: cleanupInterval,
-		cleanupDone:     make(chan struct{}),
-	}
-
-	// Initialize shards
-	for i := uint32(0); i < shardCount; i++ {
-		m.shards[i] = newCacheShard(shardMaxSize, shardMaxMemory)
-	}
-
-	// Start cleanup goroutine
-	m.cleanupTicker = time.NewTicker(cleanupInterval)
-	go m.cleanupLoop()
-
-	return m
-}
-
-// getShard returns the shard for a given key
-func (m *MemoryCacheBackend) getShard(key string) *cacheShard {
-	hash := fnv32(key)
-	return m.shards[hash&m.shardMask]
-}
-
-// cleanupLoop runs periodic cleanup of expired items
-func (m *MemoryCacheBackend) cleanupLoop() {
-	for {
-		select {
-		case <-m.cleanupTicker.C:
-			m.cleanupExpired()
-		case <-m.cleanupDone:
-			return
-		}
-	}
-}
-
-// cleanupExpired removes all expired items from all shards
-func (m *MemoryCacheBackend) cleanupExpired() {
-	if m.closed.Load() {
-		return
-	}
-
-	totalRemoved := 0
-	for _, shard := range m.shards {
-		totalRemoved += shard.cleanup()
-	}
-
-	if totalRemoved > 0 {
-		m.evictions.Add(int64(totalRemoved))
-	}
-}
-
-// Get retrieves a value from the cache
-func (m *MemoryCacheBackend) Get(ctx context.Context, key string) (interface{}, error) {
-	if m.closed.Load() {
-		return nil, ErrBackendUnavailable
-	}
-
-	start := time.Now()
-	defer func() {
-		duration := time.Since(start).Nanoseconds()
-		m.totalGetTime.Add(duration)
-		m.getCount.Add(1)
-	}()
-
-	shard := m.getShard(key)
-	value, exists, expired := shard.get(key)
-
-	if expired {
-		// Clean up expired item
-		shard.delete(key)
-		m.misses.Add(1)
-		return nil, ErrCacheMiss
-	}
-
-	if !exists {
-		m.misses.Add(1)
-		return nil, ErrCacheMiss
-	}
-
-	m.hits.Add(1)
-	return value, nil
-}
-
-// Set stores a value in the cache with optional TTL
-func (m *MemoryCacheBackend) Set(ctx context.Context, key string, value interface{}, ttl time.Duration) error {
-	if m.closed.Load() {
-		return ErrBackendUnavailable
-	}
-
-	start := time.Now()
-	defer func() {
-		duration := time.Since(start).Nanoseconds()
-		m.totalSetTime.Add(duration)
-		m.setCount.Add(1)
-	}()
-
-	// Calculate item size
-	itemSize := int64(len(key)) + estimateValueSize(value)
-
-	// Enforce global limits before adding new item
-	m.enforceGlobalLimits(itemSize)
-
-	var expiresAt time.Time
-	if ttl > 0 {
-		expiresAt = time.Now().Add(ttl)
-	}
-
-	shard := m.getShard(key)
-	shard.set(key, value, expiresAt, itemSize)
-
-	m.sets.Add(1)
-	return nil
-}
-
-// enforceGlobalLimits ensures global size and memory limits are respected
-// by evicting from shards when necessary
-func (m *MemoryCacheBackend) enforceGlobalLimits(newItemSize int64) {
-	// Check and enforce size limit
-	for {
-		totalSize, totalMemory := m.getGlobalStats()
-
-		needsSizeEviction := m.maxSize > 0 && totalSize >= m.maxSize
-		needsMemoryEviction := m.maxMemory > 0 && totalMemory+newItemSize > m.maxMemory
-
-		if !needsSizeEviction && !needsMemoryEviction {
-			break
-		}
-
-		// Find the shard with the most items and evict from it
-		evicted := m.evictFromLargestShard()
-		if !evicted {
-			break // No more items to evict
-		}
-		m.evictions.Add(1)
-	}
-}
-
-// getGlobalStats returns the total size and memory usage across all shards
-func (m *MemoryCacheBackend) getGlobalStats() (totalSize, totalMemory int64) {
-	for _, shard := range m.shards {
-		size, memory := shard.stats()
-		totalSize += size
-		totalMemory += memory
-	}
-	return
-}
-
-// evictFromLargestShard evicts the globally oldest item across all shards
-// This provides true LRU behavior even with sharding
-func (m *MemoryCacheBackend) evictFromLargestShard() bool {
-	var oldestShard *cacheShard
-	var oldestTime time.Time
-
-	for _, shard := range m.shards {
-		accessTime := shard.getOldestAccessTime()
-		// Skip empty shards
-		if accessTime.IsZero() {
-			continue
-		}
-		// Find the shard with the oldest (earliest) access time
-		if oldestShard == nil || accessTime.Before(oldestTime) {
-			oldestTime = accessTime
-			oldestShard = shard
-		}
-	}
-
-	if oldestShard == nil {
-		return false
-	}
-
-	return oldestShard.evictOne()
-}
-
-// Delete removes a key from the cache
-func (m *MemoryCacheBackend) Delete(ctx context.Context, key string) error {
-	if m.closed.Load() {
-		return ErrBackendUnavailable
-	}
-
-	shard := m.getShard(key)
-	if shard.delete(key) {
-		m.deletes.Add(1)
-	}
-
-	return nil
-}
-
-// Exists checks if a key exists in the cache
-func (m *MemoryCacheBackend) Exists(ctx context.Context, key string) (bool, error) {
-	if m.closed.Load() {
-		return false, ErrBackendUnavailable
-	}
-
-	shard := m.getShard(key)
-	return shard.exists(key), nil
-}
-
-// Clear removes all items from the cache
-func (m *MemoryCacheBackend) Clear(ctx context.Context) error {
-	if m.closed.Load() {
-		return ErrBackendUnavailable
-	}
-
-	for _, shard := range m.shards {
-		shard.clear()
-	}
-
-	return nil
-}
-
-// Keys returns all keys matching the pattern (use "*" for all keys)
-func (m *MemoryCacheBackend) Keys(ctx context.Context, pattern string) ([]string, error) {
-	if m.closed.Load() {
-		return nil, ErrBackendUnavailable
-	}
-
-	var allKeys []string
-	for _, shard := range m.shards {
-		keys := shard.keys(pattern)
-		allKeys = append(allKeys, keys...)
-	}
-
-	return allKeys, nil
-}
-
-// Size returns the total number of items in the cache
-func (m *MemoryCacheBackend) Size(ctx context.Context) (int64, error) {
-	if m.closed.Load() {
-		return 0, ErrBackendUnavailable
-	}
-
-	var total int64
-	for _, shard := range m.shards {
-		size, _ := shard.stats()
-		total += size
-	}
-
-	return total, nil
-}
-
-// TTL returns the remaining time-to-live for a key
-func (m *MemoryCacheBackend) TTL(ctx context.Context, key string) (time.Duration, error) {
-	if m.closed.Load() {
-		return 0, ErrBackendUnavailable
-	}
-
-	shard := m.getShard(key)
-	ttl, exists := shard.ttl(key)
-	if !exists {
-		return 0, ErrCacheMiss
-	}
-
-	return ttl, nil
-}
-
-// Expire updates the TTL for an existing key
-func (m *MemoryCacheBackend) Expire(ctx context.Context, key string, ttl time.Duration) error {
-	if m.closed.Load() {
-		return ErrBackendUnavailable
-	}
-
-	shard := m.getShard(key)
-	if !shard.expire(key, ttl) {
-		return ErrCacheMiss
-	}
-
-	return nil
-}
-
-// GetStats returns statistics about the cache backend
-func (m *MemoryCacheBackend) GetStats(ctx context.Context) (*BackendStats, error) {
-	if m.closed.Load() {
-		return nil, ErrBackendUnavailable
-	}
-
-	// Aggregate stats from all shards
-	var totalSize, totalMemory int64
-	for _, shard := range m.shards {
-		size, memory := shard.stats()
-		totalSize += size
-		totalMemory += memory
-	}
-
-	m.mu.RLock()
-	lastError := m.lastError
-	lastErrorTime := m.lastErrorTime
-	m.mu.RUnlock()
-
-	avgGetLatency := time.Duration(0)
-	if getCount := m.getCount.Load(); getCount > 0 {
-		avgGetLatency = time.Duration(m.totalGetTime.Load() / getCount)
-	}
-
-	avgSetLatency := time.Duration(0)
-	if setCount := m.setCount.Load(); setCount > 0 {
-		avgSetLatency = time.Duration(m.totalSetTime.Load() / setCount)
-	}
-
-	return &BackendStats{
-		Type:              TypeMemory,
-		Hits:              m.hits.Load(),
-		Misses:            m.misses.Load(),
-		Sets:              m.sets.Load(),
-		Deletes:           m.deletes.Load(),
-		Errors:            m.errors.Load(),
-		Evictions:         m.evictions.Load(),
-		CurrentSize:       totalSize,
-		MaxSize:           m.maxSize,
-		MemoryUsage:       totalMemory,
-		AverageGetLatency: avgGetLatency,
-		AverageSetLatency: avgSetLatency,
-		LastError:         lastError,
-		LastErrorTime:     lastErrorTime,
-		Uptime:            time.Since(m.startTime),
-		StartTime:         m.startTime,
-	}, nil
-}
-
-// Ping checks if the backend is healthy
-func (m *MemoryCacheBackend) Ping(ctx context.Context) error {
-	if m.closed.Load() {
-		return ErrBackendUnavailable
-	}
-	return nil
-}
-
-// Close closes the backend and releases resources
-func (m *MemoryCacheBackend) Close() error {
-	if m.closed.Swap(true) {
-		return nil // Already closed
-	}
-
-	m.cleanupTicker.Stop()
-	close(m.cleanupDone)
-
-	// Clear all shards
-	for _, shard := range m.shards {
-		shard.clear()
-	}
-
-	return nil
-}
-
-// IsHealthy returns true if the backend is healthy
-func (m *MemoryCacheBackend) IsHealthy() bool {
-	return !m.closed.Load()
-}
-
-// Type returns the backend type
-func (m *MemoryCacheBackend) Type() BackendType {
-	return TypeMemory
-}
-
-// Capabilities returns the backend capabilities
-func (m *MemoryCacheBackend) Capabilities() *BackendCapabilities {
-	return &BackendCapabilities{
-		Distributed:         false,
-		Persistent:          false,
-		Eviction:            true,
-		TTL:                 true,
-		MaxKeySize:          1024,     // 1KB
-		MaxValueSize:        10485760, // 10MB
-		MaxKeys:             m.maxSize,
-		SupportsExpire:      true,
-		SupportsMultiGet:    true,
-		SupportsTransaction: false,
-		SupportsCompression: false,
-		RequiresSerialize:   false,
-	}
-}
-
-// GetShardCount returns the number of shards (for testing/monitoring)
-func (m *MemoryCacheBackend) GetShardCount() uint32 {
-	return m.shardCount
-}
-
-// GetShardStats returns per-shard statistics (for monitoring)
-func (m *MemoryCacheBackend) GetShardStats() []map[string]int64 {
-	stats := make([]map[string]int64, m.shardCount)
-	for i, shard := range m.shards {
-		size, memory := shard.stats()
-		stats[i] = map[string]int64{
-			"size":   size,
-			"memory": memory,
-		}
-	}
-	return stats
-}
-
-// Helper functions
-
-// estimateValueSize estimates the size of a value in bytes
-func estimateValueSize(value interface{}) int64 {
-	switch v := value.(type) {
-	case string:
-		return int64(len(v))
-	case []byte:
-		return int64(len(v))
-	case int, int32, int64, uint, uint32, uint64:
-		return 8
-	case float32, float64:
-		return 8
-	case bool:
-		return 1
-	default:
-		// For complex types, use a default estimate
-		return 256
-	}
-}
-
-// matchPattern checks if a key matches a pattern (simplified glob matching)
-func matchPattern(pattern, key string) bool {
-	if pattern == "*" {
-		return true
-	}
-	// Simplified pattern matching
-	if len(pattern) > 0 && pattern[0] == '*' {
-		suffix := pattern[1:]
-		return len(key) >= len(suffix) && key[len(key)-len(suffix):] == suffix
-	}
-	return key == pattern
-}

internal/cache/backends/memory_bench_test.go

@@ -1,182 +0,0 @@
-package backends
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/alicebob/miniredis/v2"
-)
-
-// setupBenchmarkRedis creates a miniredis instance for benchmarking
-func setupBenchmarkRedis(b *testing.B) string {
-	b.Helper()
-	mr, err := miniredis.Run()
-	if err != nil {
-		b.Fatal(err)
-	}
-	b.Cleanup(func() {
-		mr.Close()
-	})
-	return mr.Addr()
-}
-
-// BenchmarkRedisOperations_WithPooling benchmarks memory allocations with object pooling
-func BenchmarkRedisOperations_WithPooling(b *testing.B) {
-	addr := setupBenchmarkRedis(b)
-
-	config := &PoolConfig{
-		Address:        addr,
-		MaxConnections: 10,
-		ConnectTimeout: 5 * time.Second,
-	}
-
-	pool, err := NewConnectionPool(config)
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer pool.Close()
-
-	ctx := context.Background()
-
-	b.ReportAllocs()
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		conn, err := pool.Get(ctx)
-		if err != nil {
-			b.Fatal(err)
-		}
-
-		// Perform various operations
-		_, _ = conn.Do("SET", "bench-key", "bench-value")
-		_, _ = conn.Do("GET", "bench-key")
-		_, _ = conn.Do("EXISTS", "bench-key")
-		_, _ = conn.Do("DEL", "bench-key")
-
-		pool.Put(conn)
-	}
-}
-
-// BenchmarkRedisBackend_SetGet benchmarks the full backend with pooling
-func BenchmarkRedisBackend_SetGet(b *testing.B) {
-	addr := setupBenchmarkRedis(b)
-
-	backend, err := NewRedisBackend(&Config{
-		RedisAddr: addr,
-		PoolSize:  10,
-	})
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer backend.Close()
-
-	ctx := context.Background()
-	testData := []byte("benchmark test data with some content")
-
-	b.ReportAllocs()
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		// Set operation
-		err := backend.Set(ctx, "bench-key", testData, 0)
-		if err != nil {
-			b.Fatal(err)
-		}
-
-		// Get operation
-		_, _, _, err = backend.Get(ctx, "bench-key")
-		if err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-// BenchmarkRedisBackend_ConcurrentAccess benchmarks concurrent operations with pooling
-func BenchmarkRedisBackend_ConcurrentAccess(b *testing.B) {
-	addr := setupBenchmarkRedis(b)
-
-	backend, err := NewRedisBackend(&Config{
-		RedisAddr: addr,
-		PoolSize:  10,
-	})
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer backend.Close()
-
-	ctx := context.Background()
-	testData := []byte("concurrent benchmark data")
-
-	b.ReportAllocs()
-	b.ResetTimer()
-
-	b.RunParallel(func(pb *testing.PB) {
-		for pb.Next() {
-			_ = backend.Set(ctx, "concurrent-key", testData, 0)
-			_, _, _, _ = backend.Get(ctx, "concurrent-key")
-		}
-	})
-}
-
-// BenchmarkRESPProtocol_WriteRead benchmarks RESP protocol encoding/decoding
-func BenchmarkRESPProtocol_WriteRead(b *testing.B) {
-	addr := setupBenchmarkRedis(b)
-
-	config := &PoolConfig{
-		Address:        addr,
-		MaxConnections: 10,
-		ConnectTimeout: 5 * time.Second,
-	}
-
-	pool, err := NewConnectionPool(config)
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer pool.Close()
-
-	ctx := context.Background()
-	conn, err := pool.Get(ctx)
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer pool.Put(conn)
-
-	b.ReportAllocs()
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		// This tests the pooling of RESPReader/RESPWriter
-		_, _ = conn.Do("PING")
-	}
-}
-
-// BenchmarkConnectionPool_GetPut benchmarks connection pool operations
-func BenchmarkConnectionPool_GetPut(b *testing.B) {
-	addr := setupBenchmarkRedis(b)
-
-	config := &PoolConfig{
-		Address:        addr,
-		MaxConnections: 10,
-		ConnectTimeout: 5 * time.Second,
-	}
-
-	pool, err := NewConnectionPool(config)
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer pool.Close()
-
-	ctx := context.Background()
-
-	b.ReportAllocs()
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		conn, err := pool.Get(ctx)
-		if err != nil {
-			b.Fatal(err)
-		}
-		pool.Put(conn)
-	}
-}

internal/cache/backends/memory_shard.go

@@ -1,294 +0,0 @@
-package backends
-
-import (
-	"container/list"
-	"sync"
-	"time"
-)
-
-// cacheShard represents a single shard of the sharded cache
-// Each shard has its own lock for reduced contention
-type cacheShard struct {
-	items      map[string]*memoryCacheItem
-	lruList    *list.List
-	mu         sync.RWMutex
-	maxSize    int64
-	maxMemory  int64
-	size       int64
-	memoryUsed int64
-}
-
-// newCacheShard creates a new cache shard
-func newCacheShard(maxSize, maxMemory int64) *cacheShard {
-	return &cacheShard{
-		items:     make(map[string]*memoryCacheItem),
-		lruList:   list.New(),
-		maxSize:   maxSize,
-		maxMemory: maxMemory,
-	}
-}
-
-// get retrieves a value from this shard
-// Returns: value, exists, expired
-func (s *cacheShard) get(key string) (interface{}, bool, bool) {
-	s.mu.RLock()
-	item, exists := s.items[key]
-	s.mu.RUnlock()
-
-	if !exists {
-		return nil, false, false
-	}
-
-	if item.isExpired() {
-		return nil, true, true // exists but expired
-	}
-
-	// Update access time and LRU position under write lock
-	s.mu.Lock()
-	// Re-check item exists (could have been deleted)
-	item, exists = s.items[key]
-	if exists && !item.isExpired() {
-		item.accessedAt = time.Now()
-		item.accessCount++
-		if elem, ok := item.element.(*list.Element); ok && elem != nil {
-			s.lruList.MoveToFront(elem)
-		}
-	}
-	s.mu.Unlock()
-
-	if !exists || item.isExpired() {
-		return nil, false, false
-	}
-
-	return item.value, true, false
-}
-
-// set stores a value in this shard
-func (s *cacheShard) set(key string, value interface{}, expiresAt time.Time, size int64) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	// Check if we need to evict items
-	if s.maxSize > 0 && s.size >= s.maxSize {
-		s.evictLRULocked()
-	}
-	if s.maxMemory > 0 && s.memoryUsed+size > s.maxMemory {
-		s.evictLRULocked()
-	}
-
-	// Remove old item if exists
-	if oldItem, exists := s.items[key]; exists {
-		s.memoryUsed -= oldItem.size
-		if elem, ok := oldItem.element.(*list.Element); ok && elem != nil {
-			s.lruList.Remove(elem)
-		}
-		s.size--
-	}
-
-	now := time.Now()
-	item := &memoryCacheItem{
-		key:         key,
-		value:       value,
-		expiresAt:   expiresAt,
-		createdAt:   now,
-		accessedAt:  now,
-		accessCount: 0,
-		size:        size,
-	}
-
-	item.element = s.lruList.PushFront(item)
-	s.items[key] = item
-	s.size++
-	s.memoryUsed += size
-}
-
-// delete removes a key from this shard
-// Returns true if the key was deleted
-func (s *cacheShard) delete(key string) bool {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	item, exists := s.items[key]
-	if !exists {
-		return false
-	}
-
-	s.deleteItemLocked(item)
-	return true
-}
-
-// exists checks if a key exists (and is not expired)
-func (s *cacheShard) exists(key string) bool {
-	s.mu.RLock()
-	item, exists := s.items[key]
-	s.mu.RUnlock()
-
-	if !exists {
-		return false
-	}
-
-	return !item.isExpired()
-}
-
-// ttl returns the remaining TTL for a key
-func (s *cacheShard) ttl(key string) (time.Duration, bool) {
-	s.mu.RLock()
-	item, exists := s.items[key]
-	s.mu.RUnlock()
-
-	if !exists || item.isExpired() {
-		return 0, false
-	}
-
-	if item.expiresAt.IsZero() {
-		return 0, true // No expiration
-	}
-
-	remaining := time.Until(item.expiresAt)
-	if remaining < 0 {
-		return 0, false
-	}
-
-	return remaining, true
-}
-
-// expire updates the TTL for an existing key
-func (s *cacheShard) expire(key string, ttl time.Duration) bool {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	item, exists := s.items[key]
-	if !exists || item.isExpired() {
-		return false
-	}
-
-	if ttl > 0 {
-		item.expiresAt = time.Now().Add(ttl)
-	} else {
-		item.expiresAt = time.Time{} // Remove expiration
-	}
-
-	return true
-}
-
-// keys returns all non-expired keys matching the pattern
-func (s *cacheShard) keys(pattern string) []string {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-
-	var keys []string
-	for key, item := range s.items {
-		if !item.isExpired() && matchPattern(pattern, key) {
-			keys = append(keys, key)
-		}
-	}
-	return keys
-}
-
-// clear removes all items from this shard
-func (s *cacheShard) clear() {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	s.items = make(map[string]*memoryCacheItem)
-	s.lruList.Init()
-	s.size = 0
-	s.memoryUsed = 0
-}
-
-// cleanup removes expired items
-// Returns the number of items removed
-func (s *cacheShard) cleanup() int {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	var toRemove []*memoryCacheItem
-	for _, item := range s.items {
-		if item.isExpired() {
-			toRemove = append(toRemove, item)
-		}
-	}
-
-	for _, item := range toRemove {
-		s.deleteItemLocked(item)
-	}
-
-	return len(toRemove)
-}
-
-// stats returns statistics for this shard
-func (s *cacheShard) stats() (size, memory int64) {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	return s.size, s.memoryUsed
-}
-
-// deleteItemLocked removes an item (must be called with lock held)
-func (s *cacheShard) deleteItemLocked(item *memoryCacheItem) {
-	if elem, ok := item.element.(*list.Element); ok && elem != nil {
-		s.lruList.Remove(elem)
-	}
-	delete(s.items, item.key)
-	s.size--
-	s.memoryUsed -= item.size
-}
-
-// evictLRULocked evicts the least recently used item (must be called with lock held)
-func (s *cacheShard) evictLRULocked() bool {
-	if s.lruList.Len() == 0 {
-		return false
-	}
-
-	element := s.lruList.Back()
-	if element != nil {
-		item, ok := element.Value.(*memoryCacheItem)
-		if ok {
-			s.deleteItemLocked(item)
-			return true
-		}
-	}
-	return false
-}
-
-// evictOne evicts one item from this shard (for global limit enforcement)
-func (s *cacheShard) evictOne() bool {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.evictLRULocked()
-}
-
-// getOldestAccessTime returns the access time of the LRU item (oldest) in this shard
-// Returns zero time if shard is empty
-func (s *cacheShard) getOldestAccessTime() time.Time {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-
-	if s.lruList.Len() == 0 {
-		return time.Time{}
-	}
-
-	element := s.lruList.Back()
-	if element != nil {
-		item, ok := element.Value.(*memoryCacheItem)
-		if ok {
-			return item.accessedAt
-		}
-	}
-	return time.Time{}
-}
-
-// fnv32 computes FNV-1a hash of a string
-// This is a fast, well-distributed hash function
-func fnv32(key string) uint32 {
-	const (
-		offset32 = uint32(2166136261)
-		prime32  = uint32(16777619)
-	)
-
-	hash := offset32
-	for i := 0; i < len(key); i++ {
-		hash ^= uint32(key[i])
-		hash *= prime32
-	}
-	return hash
-}

internal/cache/backends/memory_shard_test.go

@@ -1,283 +0,0 @@
-package backends
-
-import (
-	"context"
-	"fmt"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestShardedCache_ShardDistribution tests that keys are distributed across shards
-func TestShardedCache_ShardDistribution(t *testing.T) {
-	t.Parallel()
-
-	// Create a cache with large enough size to have multiple shards
-	config := DefaultConfig()
-	config.MaxSize = 10000
-	config.MaxMemoryBytes = 100 * 1024 * 1024 // 100MB
-
-	backend, err := NewMemoryBackend(config)
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	// Add many items to see distribution
-	numItems := 1000
-	for i := 0; i < numItems; i++ {
-		key := fmt.Sprintf("dist-key-%d", i)
-		value := []byte(fmt.Sprintf("dist-value-%d", i))
-		err := backend.Set(ctx, key, value, time.Minute)
-		require.NoError(t, err)
-	}
-
-	// Check that items are distributed across multiple shards
-	shardStats := backend.MemoryCacheBackend.GetShardStats()
-	nonEmptyShards := 0
-	for _, stat := range shardStats {
-		if stat["size"] > 0 {
-			nonEmptyShards++
-		}
-	}
-
-	// With good hash distribution, we should have items in multiple shards
-	assert.Greater(t, nonEmptyShards, 1, "Items should be distributed across multiple shards")
-}
-
-// TestShardedCache_ShardCount tests that shard count adapts to cache size
-func TestShardedCache_ShardCount(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		maxSize         int
-		expectLowShards bool
-	}{
-		{5, true},      // Very small cache should have fewer shards
-		{100, true},    // Small cache should have fewer shards
-		{10000, false}, // Large cache should have default shards
-	}
-
-	for _, tt := range tests {
-		t.Run(fmt.Sprintf("MaxSize_%d", tt.maxSize), func(t *testing.T) {
-			config := DefaultConfig()
-			config.MaxSize = tt.maxSize
-
-			backend, err := NewMemoryBackend(config)
-			require.NoError(t, err)
-			defer backend.Close()
-
-			shardCount := backend.MemoryCacheBackend.GetShardCount()
-
-			if tt.expectLowShards {
-				assert.Less(t, shardCount, uint32(256), "Small cache should have fewer shards")
-			} else {
-				assert.Equal(t, uint32(256), shardCount, "Large cache should have default shard count")
-			}
-		})
-	}
-}
-
-// TestShardedCache_ConcurrentSameKey tests concurrent access to the same key
-func TestShardedCache_ConcurrentSameKey(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-	key := "concurrent-same-key"
-	initialValue := []byte("initial-value")
-
-	err = backend.Set(ctx, key, initialValue, time.Minute)
-	require.NoError(t, err)
-
-	var wg sync.WaitGroup
-	goroutines := 50
-	iterations := 100
-
-	for i := 0; i < goroutines; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			for j := 0; j < iterations; j++ {
-				// Mix of reads and writes
-				if j%3 == 0 {
-					newValue := []byte(fmt.Sprintf("value-%d-%d", id, j))
-					err := backend.Set(ctx, key, newValue, time.Minute)
-					assert.NoError(t, err)
-				} else {
-					_, _, _, err := backend.Get(ctx, key)
-					assert.NoError(t, err)
-				}
-			}
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Key should still exist
-	exists, err := backend.Exists(ctx, key)
-	require.NoError(t, err)
-	assert.True(t, exists)
-}
-
-// TestShardedCache_GlobalLRUEviction tests that global LRU is maintained
-func TestShardedCache_GlobalLRUEviction(t *testing.T) {
-	t.Parallel()
-
-	// Create a small cache to force eviction
-	config := DefaultConfig()
-	config.MaxSize = 10
-
-	backend, err := NewMemoryBackend(config)
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	// Add items
-	for i := 0; i < 10; i++ {
-		key := fmt.Sprintf("global-lru-%d", i)
-		value := []byte(fmt.Sprintf("value-%d", i))
-		err := backend.Set(ctx, key, value, time.Minute)
-		require.NoError(t, err)
-		// Small delay to ensure different access times
-		time.Sleep(time.Millisecond)
-	}
-
-	// Access some items to make them recently used
-	for i := 5; i < 10; i++ {
-		key := fmt.Sprintf("global-lru-%d", i)
-		_, _, _, err := backend.Get(ctx, key)
-		require.NoError(t, err)
-	}
-
-	// Add more items to trigger eviction
-	for i := 10; i < 15; i++ {
-		key := fmt.Sprintf("global-lru-%d", i)
-		value := []byte(fmt.Sprintf("value-%d", i))
-		err := backend.Set(ctx, key, value, time.Minute)
-		require.NoError(t, err)
-	}
-
-	// Recently accessed items (5-9) should still exist
-	for i := 5; i < 10; i++ {
-		key := fmt.Sprintf("global-lru-%d", i)
-		exists, err := backend.Exists(ctx, key)
-		require.NoError(t, err)
-		assert.True(t, exists, "Recently accessed item %d should exist", i)
-	}
-
-	// Check eviction stats
-	stats := backend.GetStats()
-	evictions := stats["evictions"].(int64)
-	assert.Greater(t, evictions, int64(0), "Should have evictions")
-}
-
-// TestShardedCache_StatsAggregation tests that stats are aggregated correctly
-func TestShardedCache_StatsAggregation(t *testing.T) {
-	t.Parallel()
-
-	config := DefaultConfig()
-	config.MaxSize = 10000
-
-	backend, err := NewMemoryBackend(config)
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	// Add items to multiple shards
-	numItems := 100
-	for i := 0; i < numItems; i++ {
-		key := fmt.Sprintf("stats-key-%d", i)
-		value := []byte(fmt.Sprintf("stats-value-%d", i))
-		err := backend.Set(ctx, key, value, time.Minute)
-		require.NoError(t, err)
-	}
-
-	// Read some items
-	for i := 0; i < numItems/2; i++ {
-		key := fmt.Sprintf("stats-key-%d", i)
-		backend.Get(ctx, key)
-	}
-
-	// Read non-existent items
-	for i := 0; i < 10; i++ {
-		backend.Get(ctx, fmt.Sprintf("nonexistent-%d", i))
-	}
-
-	stats := backend.GetStats()
-
-	// Verify stats
-	assert.Equal(t, int64(numItems), stats["sets"].(int64), "Sets should match")
-	assert.Equal(t, int64(numItems/2), stats["hits"].(int64), "Hits should match")
-	assert.Equal(t, int64(10), stats["misses"].(int64), "Misses should match")
-	assert.Equal(t, int64(numItems), stats["size"].(int64), "Size should match")
-
-	// Verify hit rate
-	hitRate := stats["hit_rate"].(float64)
-	expectedHitRate := float64(numItems/2) / float64(numItems/2+10)
-	assert.InDelta(t, expectedHitRate, hitRate, 0.01, "Hit rate should match")
-}
-
-// BenchmarkShardedCache_Parallel benchmarks parallel access
-func BenchmarkShardedCache_Parallel(b *testing.B) {
-	config := DefaultConfig()
-	config.MaxSize = 100000
-	config.MaxMemoryBytes = 100 * 1024 * 1024
-
-	backend, _ := NewMemoryBackend(config)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	// Pre-populate cache
-	for i := 0; i < 10000; i++ {
-		key := fmt.Sprintf("bench-key-%d", i)
-		value := []byte(fmt.Sprintf("bench-value-%d", i))
-		backend.Set(ctx, key, value, time.Hour)
-	}
-
-	b.ResetTimer()
-	b.RunParallel(func(pb *testing.PB) {
-		i := 0
-		for pb.Next() {
-			key := fmt.Sprintf("bench-key-%d", i%10000)
-			backend.Get(ctx, key)
-			i++
-		}
-	})
-}
-
-// BenchmarkShardedCache_MixedOps benchmarks mixed operations
-func BenchmarkShardedCache_MixedOps(b *testing.B) {
-	config := DefaultConfig()
-	config.MaxSize = 100000
-	config.MaxMemoryBytes = 100 * 1024 * 1024
-
-	backend, _ := NewMemoryBackend(config)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	b.ResetTimer()
-	b.RunParallel(func(pb *testing.PB) {
-		i := 0
-		for pb.Next() {
-			key := fmt.Sprintf("mixed-key-%d", i%1000)
-			if i%3 == 0 {
-				value := []byte(fmt.Sprintf("mixed-value-%d", i))
-				backend.Set(ctx, key, value, time.Hour)
-			} else {
-				backend.Get(ctx, key)
-			}
-			i++
-		}
-	})
-}

internal/cache/backends/memory_test.go

@@ -1,783 +0,0 @@
-package backends
-
-import (
-	"context"
-	"fmt"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestMemoryBackend_BasicOperations tests basic CRUD operations
-func TestMemoryBackend_BasicOperations(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	t.Run("SetAndGet", func(t *testing.T) {
-		key := "test-key"
-		value := []byte("test-value")
-		ttl := 1 * time.Minute
-
-		err := backend.Set(ctx, key, value, ttl)
-		require.NoError(t, err)
-
-		retrieved, remainingTTL, exists, err := backend.Get(ctx, key)
-		require.NoError(t, err)
-		assert.True(t, exists)
-		assert.Equal(t, value, retrieved)
-		assert.Greater(t, remainingTTL, 50*time.Second)
-		assert.LessOrEqual(t, remainingTTL, ttl)
-	})
-
-	t.Run("GetNonExistent", func(t *testing.T) {
-		_, _, exists, err := backend.Get(ctx, "non-existent")
-		require.NoError(t, err)
-		assert.False(t, exists)
-	})
-
-	t.Run("Delete", func(t *testing.T) {
-		key := "delete-key"
-		value := []byte("delete-value")
-
-		err := backend.Set(ctx, key, value, 1*time.Minute)
-		require.NoError(t, err)
-
-		deleted, err := backend.Delete(ctx, key)
-		require.NoError(t, err)
-		assert.True(t, deleted)
-
-		exists, err := backend.Exists(ctx, key)
-		require.NoError(t, err)
-		assert.False(t, exists)
-	})
-
-	t.Run("DeleteNonExistent", func(t *testing.T) {
-		deleted, err := backend.Delete(ctx, "non-existent-delete")
-		require.NoError(t, err)
-		assert.False(t, deleted)
-	})
-
-	t.Run("Exists", func(t *testing.T) {
-		key := "exists-key"
-		value := []byte("exists-value")
-
-		exists, err := backend.Exists(ctx, key)
-		require.NoError(t, err)
-		assert.False(t, exists)
-
-		err = backend.Set(ctx, key, value, 1*time.Minute)
-		require.NoError(t, err)
-
-		exists, err = backend.Exists(ctx, key)
-		require.NoError(t, err)
-		assert.True(t, exists)
-	})
-
-	t.Run("Clear", func(t *testing.T) {
-		// Add multiple items
-		for i := 0; i < 10; i++ {
-			key := fmt.Sprintf("clear-key-%d", i)
-			value := []byte(fmt.Sprintf("clear-value-%d", i))
-			err := backend.Set(ctx, key, value, 1*time.Minute)
-			require.NoError(t, err)
-		}
-
-		err := backend.Clear(ctx)
-		require.NoError(t, err)
-
-		stats := backend.GetStats()
-		size := stats["size"].(int64)
-		assert.Equal(t, int64(0), size)
-	})
-}
-
-// TestMemoryBackend_TTLExpiration tests TTL and expiration
-func TestMemoryBackend_TTLExpiration(t *testing.T) {
-	t.Parallel()
-
-	config := DefaultConfig()
-	config.CleanupInterval = 50 * time.Millisecond
-	backend, err := NewMemoryBackend(config)
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	t.Run("ShortTTL", func(t *testing.T) {
-		key := "short-ttl-key"
-		value := []byte("short-ttl-value")
-		shortTTL := 100 * time.Millisecond
-
-		err := backend.Set(ctx, key, value, shortTTL)
-		require.NoError(t, err)
-
-		// Verify exists immediately
-		exists, err := backend.Exists(ctx, key)
-		require.NoError(t, err)
-		assert.True(t, exists)
-
-		// Wait for expiration
-		time.Sleep(150 * time.Millisecond)
-
-		// Should be expired
-		_, _, exists, err = backend.Get(ctx, key)
-		require.NoError(t, err)
-		assert.False(t, exists)
-	})
-
-	t.Run("TTLDecrement", func(t *testing.T) {
-		key := "ttl-decrement-key"
-		value := []byte("ttl-decrement-value")
-		ttl := 2 * time.Second
-
-		err := backend.Set(ctx, key, value, ttl)
-		require.NoError(t, err)
-
-		// Check TTL immediately
-		_, ttl1, exists, err := backend.Get(ctx, key)
-		require.NoError(t, err)
-		assert.True(t, exists)
-
-		// Wait a bit
-		time.Sleep(500 * time.Millisecond)
-
-		// Check TTL again - should be less
-		_, ttl2, exists, err := backend.Get(ctx, key)
-		require.NoError(t, err)
-		assert.True(t, exists)
-		assert.Less(t, ttl2, ttl1, "TTL should decrease over time")
-	})
-
-	t.Run("CleanupExpiredItems", func(t *testing.T) {
-		// Set multiple items with short TTL
-		for i := 0; i < 5; i++ {
-			key := fmt.Sprintf("cleanup-key-%d", i)
-			value := []byte(fmt.Sprintf("cleanup-value-%d", i))
-			err := backend.Set(ctx, key, value, 50*time.Millisecond)
-			require.NoError(t, err)
-		}
-
-		// Wait for cleanup to run
-		time.Sleep(200 * time.Millisecond)
-
-		// All items should be cleaned up
-		for i := 0; i < 5; i++ {
-			key := fmt.Sprintf("cleanup-key-%d", i)
-			exists, err := backend.Exists(ctx, key)
-			require.NoError(t, err)
-			assert.False(t, exists, "Expired items should be cleaned up")
-		}
-	})
-}
-
-// TestMemoryBackend_LRUEviction tests LRU eviction
-func TestMemoryBackend_LRUEviction(t *testing.T) {
-	t.Parallel()
-
-	config := DefaultConfig()
-	config.MaxSize = 5
-	backend, err := NewMemoryBackend(config)
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	// Fill cache to max size
-	for i := 0; i < 5; i++ {
-		key := fmt.Sprintf("lru-key-%d", i)
-		value := []byte(fmt.Sprintf("lru-value-%d", i))
-		err := backend.Set(ctx, key, value, 1*time.Minute)
-		require.NoError(t, err)
-	}
-
-	// Access first item to make it most recently used
-	_, _, exists, err := backend.Get(ctx, "lru-key-0")
-	require.NoError(t, err)
-	assert.True(t, exists)
-
-	// Add a new item - should evict lru-key-1 (least recently used)
-	err = backend.Set(ctx, "lru-key-new", []byte("new-value"), 1*time.Minute)
-	require.NoError(t, err)
-
-	// lru-key-0 should still exist (was accessed recently)
-	exists, err = backend.Exists(ctx, "lru-key-0")
-	require.NoError(t, err)
-	assert.True(t, exists, "Recently accessed item should not be evicted")
-
-	// lru-key-1 should be evicted
-	exists, err = backend.Exists(ctx, "lru-key-1")
-	require.NoError(t, err)
-	assert.False(t, exists, "Least recently used item should be evicted")
-
-	// Check eviction count
-	stats := backend.GetStats()
-	evictions := stats["evictions"].(int64)
-	assert.Greater(t, evictions, int64(0), "Should have evictions")
-}
-
-// TestMemoryBackend_MemoryLimit tests memory-based eviction
-func TestMemoryBackend_MemoryLimit(t *testing.T) {
-	t.Parallel()
-
-	config := DefaultConfig()
-	config.MaxSize = 100
-	config.MaxMemoryBytes = 1024 // 1KB limit
-	backend, err := NewMemoryBackend(config)
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	// Add items until memory limit is reached
-	largeValue := make([]byte, 512) // 512 bytes each
-	for i := 0; i < 5; i++ {
-		key := fmt.Sprintf("mem-key-%d", i)
-		err := backend.Set(ctx, key, largeValue, 1*time.Minute)
-		require.NoError(t, err)
-	}
-
-	stats := backend.GetStats()
-	memory := stats["memory"].(int64)
-	assert.LessOrEqual(t, memory, config.MaxMemoryBytes, "Memory should not exceed limit")
-
-	evictions := stats["evictions"].(int64)
-	assert.Greater(t, evictions, int64(0), "Should have memory-based evictions")
-}
-
-// TestMemoryBackend_ConcurrentAccess tests thread safety
-func TestMemoryBackend_ConcurrentAccess(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-	var wg sync.WaitGroup
-	goroutines := 20
-	iterations := 50
-
-	// Concurrent writes
-	for i := 0; i < goroutines; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			for j := 0; j < iterations; j++ {
-				key := fmt.Sprintf("concurrent-key-%d-%d", id, j)
-				value := []byte(fmt.Sprintf("concurrent-value-%d-%d", id, j))
-
-				err := backend.Set(ctx, key, value, 1*time.Minute)
-				assert.NoError(t, err)
-
-				// Read back
-				retrieved, _, exists, err := backend.Get(ctx, key)
-				assert.NoError(t, err)
-				if exists {
-					assert.Equal(t, value, retrieved)
-				}
-
-				// Random deletes
-				if j%5 == 0 {
-					backend.Delete(ctx, key)
-				}
-			}
-		}(i)
-	}
-
-	wg.Wait()
-
-	// Verify stats are consistent
-	stats := backend.GetStats()
-	hits := stats["hits"].(int64)
-	misses := stats["misses"].(int64)
-	assert.Greater(t, hits+misses, int64(0), "Should have cache operations")
-}
-
-// TestMemoryBackend_UpdateExisting tests updating existing keys
-func TestMemoryBackend_UpdateExisting(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	key := "update-key"
-	value1 := []byte("original-value")
-	value2 := []byte("updated-value")
-
-	// Set original
-	err = backend.Set(ctx, key, value1, 1*time.Minute)
-	require.NoError(t, err)
-
-	// Update
-	err = backend.Set(ctx, key, value2, 2*time.Minute)
-	require.NoError(t, err)
-
-	// Verify updated
-	retrieved, ttl, exists, err := backend.Get(ctx, key)
-	require.NoError(t, err)
-	assert.True(t, exists)
-	assert.Equal(t, value2, retrieved)
-	assert.Greater(t, ttl, 1*time.Minute, "TTL should be updated")
-
-	// Size should not increase (same key)
-	stats := backend.GetStats()
-	size := stats["size"].(int64)
-	assert.Equal(t, int64(1), size, "Size should be 1 for one key")
-}
-
-// TestMemoryBackend_Stats tests statistics tracking
-func TestMemoryBackend_Stats(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	// Initial stats
-	stats := backend.GetStats()
-	assert.Equal(t, int64(0), stats["hits"].(int64))
-	assert.Equal(t, int64(0), stats["misses"].(int64))
-
-	// Add items and track hits/misses
-	backend.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
-	backend.Set(ctx, "key2", []byte("value2"), 1*time.Minute)
-
-	// Hit
-	backend.Get(ctx, "key1")
-	// Miss
-	backend.Get(ctx, "non-existent")
-
-	stats = backend.GetStats()
-	assert.Equal(t, int64(1), stats["hits"].(int64))
-	assert.Equal(t, int64(1), stats["misses"].(int64))
-
-	hitRate := stats["hit_rate"].(float64)
-	assert.InDelta(t, 0.5, hitRate, 0.01)
-}
-
-// TestMemoryBackend_EmptyValues tests handling of empty values
-func TestMemoryBackend_EmptyValues(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	key := "empty-key"
-	emptyValue := []byte{}
-
-	err = backend.Set(ctx, key, emptyValue, 1*time.Minute)
-	require.NoError(t, err)
-
-	retrieved, _, exists, err := backend.Get(ctx, key)
-	require.NoError(t, err)
-	assert.True(t, exists)
-	assert.Equal(t, 0, len(retrieved))
-}
-
-// TestMemoryBackend_LargeValues tests handling of large values
-func TestMemoryBackend_LargeValues(t *testing.T) {
-	t.Parallel()
-
-	config := DefaultConfig()
-	config.MaxMemoryBytes = 10 * 1024 * 1024 // 10MB
-	backend, err := NewMemoryBackend(config)
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	key := "large-key"
-	largeValue := make([]byte, 1024*1024) // 1MB
-
-	err = backend.Set(ctx, key, largeValue, 1*time.Minute)
-	require.NoError(t, err)
-
-	retrieved, _, exists, err := backend.Get(ctx, key)
-	require.NoError(t, err)
-	assert.True(t, exists)
-	assert.Equal(t, len(largeValue), len(retrieved))
-}
-
-// TestMemoryBackend_Close tests proper cleanup on close
-func TestMemoryBackend_Close(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-
-	ctx := context.Background()
-
-	// Add some items
-	for i := 0; i < 10; i++ {
-		key := fmt.Sprintf("close-key-%d", i)
-		value := []byte(fmt.Sprintf("close-value-%d", i))
-		backend.Set(ctx, key, value, 1*time.Minute)
-	}
-
-	// Close
-	err = backend.Close()
-	require.NoError(t, err)
-
-	// Operations after close should fail
-	err = backend.Set(ctx, "after-close", []byte("value"), 1*time.Minute)
-	assert.Error(t, err)
-	assert.Equal(t, ErrBackendClosed, err)
-
-	_, _, _, err = backend.Get(ctx, "close-key-0")
-	assert.Error(t, err)
-	assert.Equal(t, ErrBackendClosed, err)
-
-	// Closing again should be safe
-	err = backend.Close()
-	assert.NoError(t, err)
-}
-
-// TestMemoryBackend_Ping tests ping operation
-func TestMemoryBackend_Ping(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	err = backend.Ping(ctx)
-	assert.NoError(t, err)
-
-	// Close and ping should fail
-	backend.Close()
-	err = backend.Ping(ctx)
-	assert.Error(t, err)
-}
-
-// TestMemoryBackend_ValueIsolation tests that returned values are isolated
-func TestMemoryBackend_ValueIsolation(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	key := "isolation-key"
-	originalValue := []byte("original-value")
-
-	err = backend.Set(ctx, key, originalValue, 1*time.Minute)
-	require.NoError(t, err)
-
-	// Get value and modify it
-	retrieved, _, exists, err := backend.Get(ctx, key)
-	require.NoError(t, err)
-	assert.True(t, exists)
-
-	// Modify retrieved value
-	if len(retrieved) > 0 {
-		retrieved[0] = 'X'
-	}
-
-	// Get again - should be unchanged
-	retrieved2, _, exists, err := backend.Get(ctx, key)
-	require.NoError(t, err)
-	assert.True(t, exists)
-	assert.Equal(t, originalValue, retrieved2, "Original value should not be modified")
-}
-
-// TestMemoryBackend_Keys tests the Keys method with pattern matching
-func TestMemoryBackend_Keys(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	// Add test data
-	testKeys := []string{"user:1", "user:2", "session:abc", "session:def", "token:xyz"}
-	for _, key := range testKeys {
-		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
-		require.NoError(t, err)
-	}
-
-	t.Run("AllKeys", func(t *testing.T) {
-		keys, err := backend.Keys(ctx, "*")
-		require.NoError(t, err)
-		assert.Len(t, keys, 5)
-	})
-
-	t.Run("SpecificPattern", func(t *testing.T) {
-		// Simple exact match
-		keys, err := backend.Keys(ctx, "user:1")
-		require.NoError(t, err)
-		assert.Len(t, keys, 1)
-		assert.Contains(t, keys, "user:1")
-	})
-
-	t.Run("ExcludesExpired", func(t *testing.T) {
-		// Add an expired key
-		expiredKey := "expired:key"
-		err := backend.Set(ctx, expiredKey, []byte("value"), 1*time.Millisecond)
-		require.NoError(t, err)
-
-		// Wait for expiration
-		time.Sleep(10 * time.Millisecond)
-
-		keys, err := backend.Keys(ctx, "*")
-		require.NoError(t, err)
-		assert.NotContains(t, keys, expiredKey, "Expired keys should not be returned")
-	})
-
-	t.Run("AfterClose", func(t *testing.T) {
-		closedBackend, _ := NewMemoryBackend(DefaultConfig())
-		closedBackend.Close()
-
-		_, err := closedBackend.Keys(ctx, "*")
-		assert.Error(t, err)
-		assert.Equal(t, ErrBackendUnavailable, err)
-	})
-}
-
-// TestMemoryBackend_Size tests the Size method
-func TestMemoryBackend_Size(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	// Initially empty
-	size, err := backend.Size(ctx)
-	require.NoError(t, err)
-	assert.Equal(t, int64(0), size)
-
-	// Add items
-	for i := 0; i < 5; i++ {
-		key := fmt.Sprintf("key-%d", i)
-		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
-		require.NoError(t, err)
-	}
-
-	size, err = backend.Size(ctx)
-	require.NoError(t, err)
-	assert.Equal(t, int64(5), size)
-
-	// Delete one
-	backend.Delete(ctx, "key-0")
-
-	size, err = backend.Size(ctx)
-	require.NoError(t, err)
-	assert.Equal(t, int64(4), size)
-
-	// After close
-	backend.Close()
-	_, err = backend.Size(ctx)
-	assert.Error(t, err)
-	assert.Equal(t, ErrBackendUnavailable, err)
-}
-
-// TestMemoryBackend_TTL tests the TTL method
-func TestMemoryBackend_TTL(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	t.Run("ExistingKey", func(t *testing.T) {
-		key := "ttl-key"
-		ttl := 1 * time.Minute
-
-		err := backend.Set(ctx, key, []byte("value"), ttl)
-		require.NoError(t, err)
-
-		remaining, err := backend.TTL(ctx, key)
-		require.NoError(t, err)
-		assert.Greater(t, remaining, 50*time.Second)
-		assert.LessOrEqual(t, remaining, ttl)
-	})
-
-	t.Run("NonExistentKey", func(t *testing.T) {
-		_, err := backend.TTL(ctx, "non-existent")
-		assert.Error(t, err)
-		assert.Equal(t, ErrCacheMiss, err)
-	})
-
-	t.Run("NoExpiration", func(t *testing.T) {
-		key := "no-expiry"
-		// TTL of 0 typically means no expiration
-		err := backend.Set(ctx, key, []byte("value"), 0)
-		require.NoError(t, err)
-
-		remaining, err := backend.TTL(ctx, key)
-		require.NoError(t, err)
-		// No expiration returns 0
-		assert.Equal(t, time.Duration(0), remaining)
-	})
-
-	t.Run("AfterClose", func(t *testing.T) {
-		closedBackend, _ := NewMemoryBackend(DefaultConfig())
-		closedBackend.Close()
-
-		_, err := closedBackend.TTL(ctx, "key")
-		assert.Error(t, err)
-		assert.Equal(t, ErrBackendUnavailable, err)
-	})
-}
-
-// TestMemoryBackend_Expire tests the Expire method
-func TestMemoryBackend_Expire(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	ctx := context.Background()
-
-	t.Run("UpdateTTL", func(t *testing.T) {
-		key := "expire-key"
-		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
-		require.NoError(t, err)
-
-		// Update to shorter TTL
-		err = backend.Expire(ctx, key, 5*time.Second)
-		require.NoError(t, err)
-
-		// Check new TTL
-		remaining, err := backend.TTL(ctx, key)
-		require.NoError(t, err)
-		assert.LessOrEqual(t, remaining, 5*time.Second)
-	})
-
-	t.Run("NonExistentKey", func(t *testing.T) {
-		err := backend.Expire(ctx, "non-existent", 1*time.Minute)
-		assert.Error(t, err)
-		assert.Equal(t, ErrCacheMiss, err)
-	})
-
-	t.Run("RemoveExpiration", func(t *testing.T) {
-		key := "no-expire-key"
-		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
-		require.NoError(t, err)
-
-		// Set TTL to 0 to remove expiration
-		err = backend.Expire(ctx, key, 0)
-		require.NoError(t, err)
-
-		// TTL should now be 0
-		remaining, err := backend.TTL(ctx, key)
-		require.NoError(t, err)
-		assert.Equal(t, time.Duration(0), remaining)
-	})
-
-	t.Run("AfterClose", func(t *testing.T) {
-		closedBackend, _ := NewMemoryBackend(DefaultConfig())
-		closedBackend.Close()
-
-		err := closedBackend.Expire(ctx, "key", 1*time.Minute)
-		assert.Error(t, err)
-		assert.Equal(t, ErrBackendUnavailable, err)
-	})
-}
-
-// TestMemoryBackend_IsHealthy tests the IsHealthy method
-func TestMemoryBackend_IsHealthy(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-
-	// Should be healthy when open
-	assert.True(t, backend.IsHealthy())
-
-	// Should be unhealthy after close
-	backend.Close()
-	assert.False(t, backend.IsHealthy())
-}
-
-// TestMemoryBackend_Type tests the Type method
-func TestMemoryBackend_Type(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	backendType := backend.Type()
-	assert.Equal(t, TypeMemory, backendType)
-}
-
-// TestMemoryBackend_Capabilities tests the Capabilities method
-func TestMemoryBackend_Capabilities(t *testing.T) {
-	t.Parallel()
-
-	backend, err := NewMemoryBackend(DefaultConfig())
-	require.NoError(t, err)
-	defer backend.Close()
-
-	caps := backend.Capabilities()
-	require.NotNil(t, caps)
-
-	// Memory backend should not be distributed or persistent
-	assert.False(t, caps.Distributed)
-	assert.False(t, caps.Persistent)
-
-	// Should support eviction and TTL
-	assert.True(t, caps.Eviction)
-	assert.True(t, caps.TTL)
-	assert.True(t, caps.SupportsExpire)
-	assert.True(t, caps.SupportsMultiGet)
-
-	// Check limits
-	assert.Greater(t, caps.MaxKeySize, int64(0))
-	assert.Greater(t, caps.MaxValueSize, int64(0))
-}
-
-// TestMatchPattern tests the matchPattern helper function
-func TestMatchPattern(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		pattern string
-		key     string
-		matches bool
-	}{
-		{"*", "any-key", true},
-		{"*", "another", true},
-		{"user:1", "user:1", true},
-		{"user:1", "user:2", false},
-		{"*:suffix", "prefix:suffix", true},
-		{"*suffix", "prefix-suffix", true},
-		{"*abc", "xyzabc", true},
-		{"*abc", "xyz", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(fmt.Sprintf("%s-%s", tt.pattern, tt.key), func(t *testing.T) {
-			result := matchPattern(tt.pattern, tt.key)
-			assert.Equal(t, tt.matches, result)
-		})
-	}
-}

internal/cache/backends/memory_wrapper.go

@@ -1,143 +0,0 @@
-package backends
-
-import (
-	"context"
-	"time"
-)
-
-// MemoryBackend wraps MemoryCacheBackend to implement the CacheBackend interface
-type MemoryBackend struct {
-	*MemoryCacheBackend
-}
-
-// NewMemoryBackend creates a new memory backend from a config
-func NewMemoryBackend(config *Config) (*MemoryBackend, error) {
-	maxSize := int64(config.MaxSize)
-	if maxSize <= 0 {
-		maxSize = 1000
-	}
-
-	cacheBackend := NewMemoryCacheBackend(maxSize, config.MaxMemoryBytes, config.CleanupInterval)
-	return &MemoryBackend{
-		MemoryCacheBackend: cacheBackend,
-	}, nil
-}
-
-// Set stores a value in the cache with the specified TTL
-func (m *MemoryBackend) Set(ctx context.Context, key string, value []byte, ttl time.Duration) error {
-	err := m.MemoryCacheBackend.Set(ctx, key, value, ttl)
-	if err == ErrBackendUnavailable {
-		return ErrBackendClosed
-	}
-	return err
-}
-
-// Get retrieves a value from the cache
-func (m *MemoryBackend) Get(ctx context.Context, key string) ([]byte, time.Duration, bool, error) {
-	val, err := m.MemoryCacheBackend.Get(ctx, key)
-	if err != nil {
-		if err == ErrCacheMiss {
-			return nil, 0, false, nil
-		}
-		if err == ErrBackendUnavailable {
-			return nil, 0, false, ErrBackendClosed
-		}
-		return nil, 0, false, err
-	}
-
-	// Get TTL using the TTL method
-	ttl, ttlErr := m.MemoryCacheBackend.TTL(ctx, key)
-	if ttlErr != nil {
-		// If we can't get TTL, still return the value with 0 TTL
-		ttl = 0
-	}
-
-	// Convert interface{} to []byte
-	var valueBytes []byte
-	if val != nil {
-		if bytes, ok := val.([]byte); ok {
-			valueBytes = bytes
-		} else {
-			// If it's not already []byte, return an error
-			return nil, 0, false, ErrInvalidValue
-		}
-	}
-
-	return valueBytes, ttl, true, nil
-}
-
-// Delete removes a key from the cache
-func (m *MemoryBackend) Delete(ctx context.Context, key string) (bool, error) {
-	// Check if key exists first
-	exists, err := m.MemoryCacheBackend.Exists(ctx, key)
-	if err != nil {
-		return false, err
-	}
-
-	if !exists {
-		return false, nil
-	}
-
-	err = m.MemoryCacheBackend.Delete(ctx, key)
-	if err != nil {
-		return false, err
-	}
-	return true, nil
-}
-
-// Exists checks if a key exists in the cache
-func (m *MemoryBackend) Exists(ctx context.Context, key string) (bool, error) {
-	return m.MemoryCacheBackend.Exists(ctx, key)
-}
-
-// Clear removes all keys from the cache
-func (m *MemoryBackend) Clear(ctx context.Context) error {
-	return m.MemoryCacheBackend.Clear(ctx)
-}
-
-// GetStats returns cache statistics
-func (m *MemoryBackend) GetStats() map[string]interface{} {
-	stats, err := m.MemoryCacheBackend.GetStats(context.Background())
-	if err != nil {
-		return map[string]interface{}{
-			"error": err.Error(),
-		}
-	}
-
-	// Convert BackendStats to map
-	hitRate := float64(0)
-	total := stats.Hits + stats.Misses
-	if total > 0 {
-		hitRate = float64(stats.Hits) / float64(total)
-	}
-
-	return map[string]interface{}{
-		"type":        stats.Type,
-		"hits":        stats.Hits,
-		"misses":      stats.Misses,
-		"sets":        stats.Sets,
-		"deletes":     stats.Deletes,
-		"errors":      stats.Errors,
-		"evictions":   stats.Evictions,
-		"size":        stats.CurrentSize,
-		"max_size":    stats.MaxSize,
-		"memory":      stats.MemoryUsage,
-		"hit_rate":    hitRate,
-		"uptime":      stats.Uptime,
-		"start_time":  stats.StartTime,
-		"shard_count": m.MemoryCacheBackend.GetShardCount(),
-	}
-}
-
-// Close shuts down the cache backend and releases resources
-func (m *MemoryBackend) Close() error {
-	return m.MemoryCacheBackend.Close()
-}
-
-// Ping checks if the backend is healthy and responsive
-func (m *MemoryBackend) Ping(ctx context.Context) error {
-	return m.MemoryCacheBackend.Ping(ctx)
-}
-
-// Ensure MemoryBackend implements CacheBackend
-var _ CacheBackend = (*MemoryBackend)(nil)

internal/cache/backends/redis.go

@@ -17,6 +17,15 @@ var (
 	ErrPoolExhausted = errors.New("connection pool exhausted")
 )
 
+// NoExpiryTTL is the sentinel RedisBackend.Get reports for a key that has
+// no associated expiry (Redis PTTL -1). It is distinct from a returned
+// ttl of 0, which means the key has under a millisecond left (or vanished
+// between GET and PTTL): the caller must not treat those two cases the
+// same way — folding "no expiry" into 0 made a caller that repopulates a
+// local copy on ttl<=0 re-cache a dying entry for its full DefaultTTL
+// (FIX-31).
+const NoExpiryTTL time.Duration = -1
+
 // RedisBackend implements a Redis-based cache backend using pure Go
 type RedisBackend struct {
 	config        *Config
@@ -95,7 +104,15 @@ func (r *RedisBackend) Set(ctx context.Context, key string, value []byte, ttl ti
 		return ErrBackendClosed
 	}
 
+	// A NEGATIVE TTL means "already expired" (the stack's convention for a
+	// value whose validity has passed). Previously ttl<=0 fell through to a
+	// bare SET with no expiry, silently making the entry permanent. Zero here
+	// is the documented "no expiry" contract (see SetManyNoTTL), so only
+	// strictly-negative TTLs are skipped.
 	prefixedKey := r.prefixKey(key)
+	if ttl < 0 {
+		return nil
+	}
 
 	// Execute with retry logic
 	return r.executeWithRetry(ctx, func(conn *RedisConn) error {
@@ -120,6 +137,157 @@ func (r *RedisBackend) Set(ctx context.Context, key string, value []byte, ttl ti
 	})
 }
 
+// SetNX stores a value in Redis only if the key does not already exist,
+// atomically, using Redis SET key value NX PX <ttl-ms> — one server-side
+// command rather than a Get followed by a Set, so two callers racing the
+// same key (e.g. two Traefik replicas racing the same backchannel-logout
+// jti) can never both observe "absent". Backs UniversalCache.SetIfAbsent's
+// distributed case (FIX-17): CacheBackend has no such primitive, and
+// widening it would force every implementer to add an operation only this
+// one caller needs, so UniversalCache reaches this through an optional
+// interface type assertion instead.
+//
+// Returns (true, nil) when this call claimed the key, (false, nil) when the
+// key already existed (someone else claimed it first — not an error),
+// (false, ErrSetNXAmbiguous) when the command reached the wire but its
+// reply could not be read at all (timeout, EOF, connection reset) — Redis
+// may or may not have applied it — and (false, err) on any other genuine
+// backend failure, INCLUDING a definitive RESP '-' command-error reply
+// (-READONLY, -OOM, -MISCONF, ...): that proves Redis read and rejected the
+// command, so it is never ambiguous (R4 cache review).
+//
+// SetNX runs its own retry loop rather than executeWithRetry (FIX-17
+// round-2): Set's SETEX/PSETEX are idempotent, so retrying one after a lost
+// reply just repeats the same unconditional write. SET NX is not — retrying
+// it after a lost reply would see this call's OWN possible write and
+// misreport a first-ever claim as already-claimed. So SetNX retries a
+// failed connection acquisition (nothing was sent yet, safe to retry) but
+// never re-sends SET NX once doTracked reports the command was written.
+func (r *RedisBackend) SetNX(ctx context.Context, key string, value []byte, ttl time.Duration) (bool, error) {
+	if r.closed.Load() {
+		return false, ErrBackendClosed
+	}
+
+	// Mirrors Set's TTL convention: negative means "already expired", so
+	// there is nothing to claim.
+	prefixedKey := r.prefixKey(key)
+	if ttl < 0 {
+		return false, nil
+	}
+
+	var args []string
+	if ttl > 0 {
+		ttlMillis := ttl.Milliseconds()
+		if ttlMillis < 1 {
+			ttlMillis = 1
+		}
+		args = []string{prefixedKey, string(value), "NX", "PX", fmt.Sprintf("%d", ttlMillis)}
+	} else {
+		args = []string{prefixedKey, string(value), "NX"}
+	}
+
+	maxRetries := 3
+	baseDelay := 50 * time.Millisecond
+
+	for attempt := 0; attempt < maxRetries; attempt++ {
+		if ctx.Err() != nil {
+			return false, ctx.Err()
+		}
+
+		conn, err := r.pool.Get(ctx)
+		if err != nil {
+			if attempt == maxRetries-1 {
+				return false, fmt.Errorf("failed to get connection after %d attempts: %w", maxRetries, err)
+			}
+			delay := baseDelay * time.Duration(1<<uint(attempt))
+			select {
+			case <-ctx.Done():
+				return false, ctx.Err()
+			case <-time.After(delay):
+				continue
+			}
+		}
+
+		var (
+			resp  interface{}
+			sent  bool
+			doErr error
+		)
+		func() {
+			defer func() { r.pool.Put(conn) }()
+			resp, sent, doErr = conn.doTracked("SET", args...)
+		}()
+
+		if doErr == nil {
+			if _, strErr := RESPString(resp); strErr != nil {
+				return false, strErr
+			}
+			return true, nil
+		}
+
+		if errors.Is(doErr, ErrNilResponse) {
+			// NX condition failed: the key already existed before this
+			// call. A valid protocol outcome, not an error — the
+			// connection is healthy and nothing here should be retried.
+			return false, nil
+		}
+
+		if errors.Is(doErr, ErrCommandReply) {
+			// A RESP '-' reply (e.g. -READONLY, -OOM, -MISCONF) proves
+			// Redis read the command and refused it — unlike a lost reply,
+			// this is a DEFINITIVE outcome: the SET NX was never applied.
+			// Reporting it as ErrSetNXAmbiguous would make
+			// checkAndMarkLogoutJTIProcessed accept the caller's claim
+			// outright (the ambiguous branch exists precisely to avoid a
+			// false replay report for a write that may have landed), which
+			// here would let a captured logout token replay forever while
+			// Redis rejects writes. Surface it as a plain error instead, so
+			// the caller falls through to its own local fallback.
+			return false, doErr
+		}
+
+		if sent {
+			// The command reached the wire before reading its reply
+			// failed (timeout, EOF, connection reset): Redis may have
+			// applied it. This is checked BEFORE ctx.Err() (FIX-17
+			// round-3): UniversalCache.setIfAbsentBackend gives SetNX a
+			// 500ms context, and the pool's read deadline on this same
+			// write is also 500ms, started strictly after the ctx
+			// deadline began ticking — so when a reply is lost, ctx has
+			// almost always already expired by the time this line runs.
+			// Checking ctx.Err() first therefore reported
+			// context.DeadlineExceeded for what is actually an ambiguous
+			// outcome, and checkAndMarkLogoutJTIProcessed does not
+			// special-case a plain deadline error: it fell through to the
+			// mutex-guarded Get+Set fallback, whose Get saw this call's
+			// own possible write and misreported a first-ever logout
+			// token as a replay. Retrying here (instead of returning) would
+			// see this call's own possible write and misreport a
+			// first-ever claim as already-claimed, same reasoning as
+			// above — surface the ambiguity instead of guessing.
+			return false, ErrSetNXAmbiguous
+		}
+
+		if ctx.Err() != nil {
+			return false, ctx.Err()
+		}
+
+		if attempt == maxRetries-1 || !isRetryableError(doErr) {
+			return false, doErr
+		}
+
+		delay := baseDelay * time.Duration(1<<uint(attempt))
+		select {
+		case <-ctx.Done():
+			return false, ctx.Err()
+		case <-time.After(delay):
+			continue
+		}
+	}
+
+	return false, fmt.Errorf("operation failed after %d attempts", maxRetries)
+}
+
 // Get retrieves a value from Redis
 func (r *RedisBackend) Get(ctx context.Context, key string) ([]byte, time.Duration, bool, error) {
 	if r.closed.Load() {
@@ -149,10 +317,14 @@ func (r *RedisBackend) Get(ctx context.Context, key string) ([]byte, time.Durati
 			return err
 		}
 
-		// Get TTL
-		ttlResp, err := conn.Do("TTL", prefixedKey)
+		// Get TTL with millisecond precision (PTTL, not TTL). TTL's second
+		// precision maps both "no expiry" (-1) and "under one second left"
+		// to a reported ttl of 0 once truncated to whole seconds, so a
+		// caller cannot tell them apart (FIX-31). PTTL keeps "no expiry"
+		// distinct via NoExpiryTTL.
+		ttlResp, err := conn.Do("PTTL", prefixedKey)
 		if err != nil {
-			// If TTL fails, still return the value
+			// If PTTL fails, still return the value; report no TTL info.
 			r.hits.Add(1)
 			resultValue = []byte(value)
 			resultTTL = 0
@@ -160,10 +332,18 @@ func (r *RedisBackend) Get(ctx context.Context, key string) ([]byte, time.Durati
 			return nil
 		}
 
-		ttlSeconds, _ := RESPInt(ttlResp)
+		ttlMillis, _ := RESPInt(ttlResp)
 		var ttl time.Duration
-		if ttlSeconds > 0 {
-			ttl = time.Duration(ttlSeconds) * time.Second
+		switch {
+		case ttlMillis == -1:
+			// Key exists with no associated expiry.
+			ttl = NoExpiryTTL
+		case ttlMillis > 0:
+			ttl = time.Duration(ttlMillis) * time.Millisecond
+		default:
+			// -2 (key vanished between GET and PTTL) or 0 (under 1ms
+			// left): report "expire now", not "no expiry".
+			ttl = 0
 		}
 
 		r.hits.Add(1)
@@ -376,20 +556,30 @@ func (r *RedisBackend) executeWithRetry(ctx context.Context, operation func(*Red
 			}
 		}
 
-		// Execute the operation
-		err = operation(conn)
-		r.pool.Put(conn)
+		// Execute the operation, guaranteeing the borrowed connection is
+		// returned to the pool even if the operation panics (previously a
+		// panic here leaked the connection and desynced the pool counters;
+		// other pool call sites use defer for this).
+		func() {
+			defer func() { r.pool.Put(conn) }()
+			err = operation(conn)
+		}()
+
+		// Check err == nil BEFORE ctx.Err(): the operation already completed
+		// against the connection (op returned), so a nil error means Redis
+		// applied it. Reporting ctx.Err() first would tell the caller (e.g.
+		// UniversalCache.Set) that a write failed when it actually landed,
+		// which previously triggered a Delete that erased the just-applied
+		// value (FIX-04).
+		if err == nil {
+			return nil
+		}
 
 		// Check context after operation - if canceled, don't bother retrying
 		if ctx.Err() != nil {
 			return ctx.Err()
 		}
 
-		// If successful, return
-		if err == nil {
-			return nil
-		}
-
 		// If error is not retryable or last attempt, fail
 		if attempt == maxRetries-1 || !isRetryableError(err) {
 			return err
@@ -445,6 +635,13 @@ func (r *RedisBackend) SetMany(ctx context.Context, items map[string][]byte, ttl
 		return nil
 	}
 
+	if ttl < 0 {
+		// Already-expired TTL: nothing to persist (see Set's guard). Avoids
+		// creating permanent entries for past-dated values via the multi path.
+		// Zero retains the "no expiry" contract (see SetManyNoTTL).
+		return nil
+	}
+
 	// For single items, use regular Set
 	if len(items) == 1 {
 		for key, value := range items {
@@ -547,6 +744,7 @@ func (r *RedisBackend) GetMany(ctx context.Context, keys []string) (map[string][
 
 	// Process responses
 	result := make(map[string][]byte)
+	var firstErr error
 	for i, resp := range responses {
 		if resp == nil {
 			// Key doesn't exist
@@ -554,6 +752,17 @@ func (r *RedisBackend) GetMany(ctx context.Context, keys []string) (map[string][
 			continue
 		}
 
+		// A Redis command-error reply (e.g. LOADING, WRONGTYPE) is stored
+		// as an error value by Pipeline.Execute. It means the key lookup
+		// failed, not that the key is missing, so it must not be counted
+		// as a miss.
+		if respErr, ok := resp.(error); ok {
+			if firstErr == nil {
+				firstErr = fmt.Errorf("GetMany: command error for key %q: %w", keys[i], respErr)
+			}
+			continue
+		}
+
 		value, err := RESPString(resp)
 		if err != nil {
 			// Invalid response, skip this key
@@ -565,5 +774,9 @@ func (r *RedisBackend) GetMany(ctx context.Context, keys []string) (map[string][
 		result[keys[i]] = []byte(value)
 	}
 
+	if firstErr != nil {
+		return result, firstErr
+	}
+
 	return result, nil
 }

internal/cache/backends/redis_getmany_command_error_test.go

@@ -0,0 +1,46 @@
+package backends
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRedisBackend_GetMany_CommandErrorReplyIsNotAMiss is a regression test
+// for the review finding that RedisBackend.GetMany silently counted a Redis
+// command-error reply (for example WRONGTYPE) as a cache miss instead of
+// surfacing it as an error. Pipeline.Execute stores such a reply as an
+// error value in the responses slice; GetMany must recognize that value and
+// report it, not swallow it as "key not found". Per the todo acceptance
+// criteria, this must also not increment the misses counter.
+func TestRedisBackend_GetMany_CommandErrorReplyIsNotAMiss(t *testing.T) {
+	t.Parallel()
+
+	mr, backend := setupTestRedis(t)
+	ctx := context.Background()
+
+	require.NoError(t, backend.Set(ctx, "good-key", []byte("good-value"), time.Minute))
+
+	// Create a key holding a list, so a GET against it returns a RESP
+	// command-error reply (WRONGTYPE), not a nil/missing response.
+	_, err := mr.Lpush("test:bad-key", "listval")
+	require.NoError(t, err)
+
+	missesBefore := backend.GetStats()["misses"].(int64)
+	hitsBefore := backend.GetStats()["hits"].(int64)
+
+	results, err := backend.GetMany(ctx, []string{"good-key", "bad-key"})
+
+	require.Error(t, err, "GetMany must surface the WRONGTYPE command-error reply instead of masking it as a miss")
+	assert.Contains(t, err.Error(), "bad-key")
+	assert.Equal(t, []byte("good-value"), results["good-key"], "a command error on one key must not drop a good key's result")
+	assert.NotContains(t, results, "bad-key")
+
+	missesAfter := backend.GetStats()["misses"].(int64)
+	hitsAfter := backend.GetStats()["hits"].(int64)
+	assert.Equal(t, missesBefore, missesAfter, "a command-error reply must not increment the misses counter")
+	assert.Equal(t, hitsBefore+1, hitsAfter, "the good key must still count as exactly one hit")
+}

internal/cache/backends/redis_pool.go

@@ -67,6 +67,24 @@ func NewConnectionPool(config *PoolConfig) (*ConnectionPool, error) {
 	return pool, nil
 }
 
+// reserveConnectionSlot atomically reserves capacity for one new connection,
+// returning false when the pool is already at MaxConnections. The
+// reservation is released via totalConns.Add(-1) if the dial fails.
+func (p *ConnectionPool) reserveConnectionSlot() bool {
+	// Compare in int64: narrowing MaxConnections to int32 could wrap a
+	// large configured value to a negative limit and refuse every connection.
+	maxConns := int64(p.config.MaxConnections)
+	for {
+		cur := p.totalConns.Load()
+		if int64(cur) >= maxConns {
+			return false
+		}
+		if p.totalConns.CompareAndSwap(cur, cur+1) {
+			return true
+		}
+	}
+}
+
 // Get retrieves a connection from the pool or creates a new one
 func (p *ConnectionPool) Get(ctx context.Context) (*RedisConn, error) {
 	if p.closed.Load() {
@@ -83,6 +101,11 @@ func (p *ConnectionPool) Get(ctx context.Context) (*RedisConn, error) {
 
 		select {
 		case conn = <-p.connections:
+			if conn == nil {
+				// Pool channel was closed concurrently (Close) - receiving from a
+				// closed channel yields the zero value.
+				return nil, ErrBackendClosed
+			}
 			// Reuse existing connection - validate if health check enabled
 			if p.config.EnableHealthCheck && !p.isConnectionHealthy(conn) {
 				// Connection is stale, close it and try again
@@ -97,11 +120,15 @@ func (p *ConnectionPool) Get(ctx context.Context) (*RedisConn, error) {
 			return nil, ctx.Err()
 
 		default:
-			// No available connection, create new one if under limit
-			// #nosec G115 -- MaxConnections is a small config value that fits in int32
-			if p.totalConns.Load() < int32(p.config.MaxConnections) {
+			// No available connection, create new one if under limit.
+			// Reserve capacity atomically before dialing: checking
+			// totalConns then dialing is not atomic, so concurrent Gets
+			// could each pass the check and spike the live socket count
+			// far above MaxConnections (FD / Redis maxclients exhaustion).
+			if p.reserveConnectionSlot() {
 				conn, err = p.createConnection(ctx)
 				if err != nil {
+					p.totalConns.Add(-1) // release the reserved slot
 					// If this is the last attempt, return error
 					if attempt == maxAttempts-1 {
 						return nil, err
@@ -111,13 +138,17 @@ func (p *ConnectionPool) Get(ctx context.Context) (*RedisConn, error) {
 					continue
 				}
 				p.activeConns.Add(1)
-				p.totalConns.Add(1)
 				return conn, nil
 			}
 
 			// Pool exhausted, wait for a connection with timeout
 			select {
 			case conn = <-p.connections:
+				if conn == nil {
+					// Pool channel was closed concurrently (Close) - receiving from a
+					// closed channel yields the zero value.
+					return nil, ErrBackendClosed
+				}
 				// Validate connection if health check enabled
 				if p.config.EnableHealthCheck && !p.isConnectionHealthy(conn) {
 					_ = conn.Close()
@@ -148,6 +179,13 @@ func (p *ConnectionPool) Put(conn *RedisConn) {
 	p.puts.Add(1)
 	p.activeConns.Add(-1)
 
+	// Hold p.mu so this is mutually exclusive with Close (which closes
+	// p.connections under the same lock). Without it, a Put that passed
+	// the closed check could send on p.connections just after Close
+	// closed it, panicking "send on closed channel" at shutdown.
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
 	if p.closed.Load() || conn.closed.Load() {
 		_ = conn.Close()
 		p.totalConns.Add(-1)
@@ -260,10 +298,23 @@ type RedisConn struct {
 	mu           sync.Mutex
 }
 
-// Do executes a Redis command and returns the response
+// Do executes a Redis command and returns the response.
 func (c *RedisConn) Do(command string, args ...string) (interface{}, error) {
+	resp, _, err := c.doTracked(command, args...)
+	return resp, err
+}
+
+// doTracked is Do's implementation. It additionally reports whether the
+// command was already written to the connection when it failed: SetNX uses
+// this to tell "definitely not applied" (the write itself failed) from
+// "outcome unknown, may have applied" (the write succeeded but reading the
+// reply failed). SET NX is not safe to retry blindly the way Set's
+// idempotent SETEX/PSETEX is — a retried SET NX after a lost reply sees its
+// own possible write and reports "already claimed" for what may have been a
+// first-ever claim (FIX-17 round-2).
+func (c *RedisConn) doTracked(command string, args ...string) (interface{}, bool, error) {
 	if c.closed.Load() {
-		return nil, ErrBackendClosed
+		return nil, false, ErrBackendClosed
 	}
 
 	c.mu.Lock()
@@ -273,7 +324,7 @@ func (c *RedisConn) Do(command string, args ...string) (interface{}, error) {
 	// maxSafeArgs is set to (1<<20)-1 = 1,048,575 which is more than any reasonable Redis command
 	const maxSafeArgs = (1 << 20) - 1
 	if len(args) > maxSafeArgs {
-		return nil, errors.New("too many arguments: exceeds maximum safe count")
+		return nil, false, errors.New("too many arguments: exceeds maximum safe count")
 	}
 
 	// Build command arguments
@@ -283,11 +334,11 @@ func (c *RedisConn) Do(command string, args ...string) (interface{}, error) {
 	for _, s := range args {
 		// Protect against possible overflow
 		if len(s) > maxTotalArgBytes-totalBytes {
-			return nil, errors.New("arguments too large (would overflow maximum allowed total size)")
+			return nil, false, errors.New("arguments too large (would overflow maximum allowed total size)")
 		}
 		totalBytes += len(s)
 		if totalBytes > maxTotalArgBytes {
-			return nil, errors.New("total argument size exceeds maximum allowed")
+			return nil, false, errors.New("total argument size exceeds maximum allowed")
 		}
 	}
 	// Build command slice: prepend command to args
@@ -305,7 +356,7 @@ func (c *RedisConn) Do(command string, args ...string) (interface{}, error) {
 	writer.Release() // Return to pool immediately after use
 	if err != nil {
 		c.closed.Store(true)
-		return nil, err
+		return nil, false, err
 	}
 
 	// Set read timeout
@@ -318,13 +369,17 @@ func (c *RedisConn) Do(command string, args ...string) (interface{}, error) {
 	resp, err := reader.ReadResponse()
 	reader.Release() // Return to pool immediately after use
 	if err != nil {
-		if !errors.Is(err, ErrNilResponse) {
+		// A nil response or a Redis command error reply leaves the
+		// connection healthy — only an IO/parse error closes it.
+		if !errors.Is(err, ErrNilResponse) && !errors.Is(err, ErrCommandReply) {
 			c.closed.Store(true)
 		}
-		return nil, err
+		// The write above already succeeded, so the command reached the
+		// wire even though its reply did not come back.
+		return nil, true, err
 	}
 
-	return resp, nil
+	return resp, true, nil
 }
 
 // Close closes the connection
@@ -453,6 +508,14 @@ func (p *Pipeline) Execute() ([]interface{}, error) {
 				responses[i] = nil
 				continue
 			}
+			if errors.Is(err, ErrCommandReply) {
+				// A Redis command error reply: the connection is healthy
+				// and the remaining replies are still readable. Store the
+				// error value so per-command validation upstream can
+				// report it without aborting the batch.
+				responses[i] = err
+				continue
+			}
 			p.conn.closed.Store(true)
 			return responses[:i], fmt.Errorf("pipeline read error at command %d: %w", i, err)
 		}

internal/cache/backends/redis_pool_max_conns_test.go

@@ -0,0 +1,37 @@
+package backends
+
+import (
+	"math"
+	"strconv"
+	"testing"
+)
+
+// TestReserveConnectionSlotLargeMaxConnections pins the gosec G115 fix: the
+// limit was narrowed with int32(MaxConnections), so a value above MaxInt32
+// wrapped to a negative limit and every connection was refused.
+func TestReserveConnectionSlotLargeMaxConnections(t *testing.T) {
+	if strconv.IntSize < 64 {
+		t.Skip("int cannot exceed MaxInt32 on this platform")
+	}
+	p := &ConnectionPool{config: &PoolConfig{MaxConnections: math.MaxInt32 + 1}}
+	if !p.reserveConnectionSlot() {
+		t.Fatal("reserveConnectionSlot refused a connection although MaxConnections is far above the current count")
+	}
+	if got := p.totalConns.Load(); got != 1 {
+		t.Fatalf("totalConns = %d, want 1", got)
+	}
+}
+
+// TestReserveConnectionSlotRespectsLimit checks that the int64 comparison
+// still enforces a normal limit.
+func TestReserveConnectionSlotRespectsLimit(t *testing.T) {
+	p := &ConnectionPool{config: &PoolConfig{MaxConnections: 2}}
+	for i := 0; i < 2; i++ {
+		if !p.reserveConnectionSlot() {
+			t.Fatalf("reservation %d refused below the limit", i+1)
+		}
+	}
+	if p.reserveConnectionSlot() {
+		t.Fatal("reservation above MaxConnections was accepted")
+	}
+}

internal/cache/backends/redis_pool_test.go

@@ -367,7 +367,47 @@ func TestConnectionPool_Close(t *testing.T) {
 	require.NoError(t, err)
 }
 
-// TestConnectionPool_Timeouts tests various timeout scenarios
+// TestConnectionPool_GetDuringClose_NoNilRegression ensures a Get racing with
+// Close never yields a nil *RedisConn with a nil error (which previously
+// happened when the receive from the closed p.connections channel returned
+// the zero value), and never panics by calling Close on a nil receiver.
+func TestConnectionPool_GetDuringClose_NoNilRegression(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 1,
+		ConnectTimeout: 1 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+
+	// Fill the pool so a concurrent Get blocks waiting for a connection.
+	held, err := pool.Get(context.Background())
+	require.NoError(t, err)
+	defer pool.Put(held)
+
+	type result struct {
+		conn *RedisConn
+		err  error
+	}
+	resCh := make(chan result, 1)
+	go func() {
+		c, e := pool.Get(context.Background())
+		resCh <- result{c, e}
+	}()
+
+	// Give the goroutine time to reach the blocking receive on p.connections,
+	// then close the pool. Closing the channel unblocks the receive with the
+	// zero value; Get must surface ErrBackendClosed rather than (nil, nil).
+	time.Sleep(50 * time.Millisecond)
+	require.NoError(t, pool.Close())
+
+	res := <-resCh
+	require.Error(t, res.err, "Get after Close must return an error, not (nil, nil)")
+	assert.True(t, errors.Is(res.err, ErrBackendClosed), "want ErrBackendClosed, got %v", res.err)
+}
 func TestConnectionPool_Timeouts(t *testing.T) {
 	mr := NewMiniredisServer(t)
 
@@ -648,3 +688,47 @@ func TestRedisConn_RejectOversizedArgumentBytes(t *testing.T) {
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "arguments too large")
 }
+
+// TestConnectionPool_PutDuringClose_NoPanic hammers Put/Get concurrently with
+// Close. Before the fix, Put checked closed then sent on p.connections
+// without holding p.mu; if Close closed the channel in between, the send
+// panicked ("send on closed channel") at shutdown. Run under -race.
+func TestConnectionPool_PutDuringClose_NoPanic(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 5,
+		ConnectTimeout: 5 * time.Second,
+		ReadTimeout:    3 * time.Second,
+		WriteTimeout:   3 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+
+	ctx := context.Background()
+	stop := make(chan struct{})
+	var wg sync.WaitGroup
+	for g := 0; g < 8; g++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for {
+				select {
+				case <-stop:
+					return
+				default:
+				}
+				if conn, err := pool.Get(ctx); err == nil {
+					pool.Put(conn) // may race Close
+				}
+			}
+		}()
+	}
+
+	time.Sleep(5 * time.Millisecond)
+	_ = pool.Close()
+	close(stop)
+	wg.Wait()
+}

internal/cache/backends/resp.go

@@ -20,6 +20,11 @@ import (
 var (
 	ErrInvalidRESP = errors.New("invalid RESP response")
 	ErrNilResponse = errors.New("nil response")
+	// ErrCommandReply marks a RESP '-' (Redis command error) reply, e.g.
+	// WRONGTYPE or OOM. It is a valid protocol response — the connection
+	// is healthy and any remaining pipelined replies are still readable —
+	// as opposed to an IO/parse error which means the connection is dead.
+	ErrCommandReply = errors.New("redis command error reply")
 )
 
 // RESPWriter writes RESP protocol messages
@@ -110,7 +115,9 @@ func (r *RESPReader) readError() error {
 	if err != nil {
 		return err
 	}
-	return errors.New(line)
+	// Wrap so callers can distinguish a Redis command error reply (healthy
+	// connection) from an IO/parse error (dead connection).
+	return fmt.Errorf("%w: %s", ErrCommandReply, line)
 }
 
 // readInteger reads an integer (:1000\r\n)
@@ -170,11 +177,26 @@ func (r *RESPReader) readArray() (interface{}, error) {
 		return nil, ErrNilResponse
 	}
 
-	// Read each element
+	// Read each element. A nested "-ERR" reply and a nested nil value
+	// ("$-1" or "*-1") are both valid protocol values, not connection-level
+	// failures: store the element (the error, or nil) and keep reading so
+	// every element is drained off the wire. Leaving unread elements on the
+	// connection would let the next command's reader pick up this array's
+	// leftover bytes as its own reply (response desync) once Do returns the
+	// connection to the pool. Any other error (IO or protocol) still aborts
+	// the array, since the connection is no longer trustworthy.
 	result := make([]interface{}, length)
 	for i := 0; i < length; i++ {
 		elem, err := r.ReadResponse()
 		if err != nil {
+			if errors.Is(err, ErrCommandReply) {
+				result[i] = err
+				continue
+			}
+			if errors.Is(err, ErrNilResponse) {
+				result[i] = nil
+				continue
+			}
 			return nil, err
 		}
 		result[i] = elem

internal/cache/backends/resp_nested_error_test.go

@@ -0,0 +1,140 @@
+package backends
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRESPReader_ReadArray_NestedCommandErrorDrainsAllElements is a
+// regression test for the review finding that a nested "-ERR" reply inside
+// an array left the trailing array elements unread on the connection. A
+// nested command-error reply is a valid protocol value (the connection
+// stays healthy, see ErrCommandReply), so readArray must keep reading past
+// it instead of aborting the whole array read. Failing to drain the
+// trailing elements leaves them on the stream, where the next command's
+// reader would pick them up as its own reply (response desync).
+func TestRESPReader_ReadArray_NestedCommandErrorDrainsAllElements(t *testing.T) {
+	// *3: bulk "foo", a nested command-error reply, bulk "bar" - followed
+	// immediately by an independent "+PONG" reply on the same stream, as
+	// the next command's response would be.
+	input := "*3\r\n$3\r\nfoo\r\n-ERR boom\r\n$3\r\nbar\r\n+PONG\r\n"
+	reader := NewRESPReader(strings.NewReader(input))
+
+	result, err := reader.ReadResponse()
+	require.NoError(t, err, "a nested command-error reply must not fail the whole array read")
+
+	arr, ok := result.([]interface{})
+	require.True(t, ok, "expected an array result, got %T", result)
+	require.Len(t, arr, 3, "all three array elements must be present, including the one after the nested error")
+
+	assert.Equal(t, "foo", arr[0])
+
+	elemErr, ok := arr[1].(error)
+	require.True(t, ok, "the nested error element must be stored as an error value, got %T", arr[1])
+	assert.True(t, errors.Is(elemErr, ErrCommandReply), "want ErrCommandReply, got %v", elemErr)
+
+	assert.Equal(t, "bar", arr[2], "the element after the nested error must still be read off the wire")
+
+	// The reader must be positioned exactly at the start of the next reply,
+	// not partway through leftover array bytes.
+	next, err := reader.ReadResponse()
+	require.NoError(t, err, "the connection must not be desynced by the nested error")
+	assert.Equal(t, "PONG", next, "next command's reply must not be corrupted by unread array elements")
+}
+
+// TestRESPReader_ReadArray_NestedIOErrorStillAborts ensures a genuine
+// IO/parse error nested inside an array (as opposed to a valid "-ERR"
+// command-error reply) still aborts the array read, since the connection is
+// no longer trustworthy in that case.
+func TestRESPReader_ReadArray_NestedIOErrorStillAborts(t *testing.T) {
+	// Second element is a truncated bulk string (declares 5 bytes, supplies
+	// none) - a protocol/IO error, not a command-error reply.
+	input := "*2\r\n$3\r\nfoo\r\n$5\r\n"
+	reader := NewRESPReader(strings.NewReader(input))
+
+	_, err := reader.ReadResponse()
+	require.Error(t, err)
+	assert.False(t, errors.Is(err, ErrCommandReply), "a truncated bulk string is an IO error, not a command-error reply")
+}
+
+// TestRESPReader_ReadArray_NestedNilBulkStringDrainsAllElements is a
+// regression test for the same desync as the nested command-error case,
+// triggered by a nested "$-1" (nil bulk string) element instead of a
+// "-ERR" reply. readBulkString returns ErrNilResponse for "$-1", which is
+// not an IO or protocol error and does not make the connection
+// untrustworthy (see RedisConn.Do, which keeps the connection pooled on
+// ErrNilResponse). readArray must store nil for that element and keep
+// reading the rest of the array.
+func TestRESPReader_ReadArray_NestedNilBulkStringDrainsAllElements(t *testing.T) {
+	// *3: bulk "foo", a nested nil bulk string, bulk "bar" - followed
+	// immediately by an independent "+PONG" reply on the same stream, as
+	// the next command's response would be.
+	input := "*3\r\n$3\r\nfoo\r\n$-1\r\n$3\r\nbar\r\n+PONG\r\n"
+	reader := NewRESPReader(strings.NewReader(input))
+
+	result, err := reader.ReadResponse()
+	require.NoError(t, err, "a nested nil bulk string must not fail the whole array read")
+
+	arr, ok := result.([]interface{})
+	require.True(t, ok, "expected an array result, got %T", result)
+	require.Len(t, arr, 3, "all three array elements must be present, including the one after the nested nil")
+
+	assert.Equal(t, "foo", arr[0])
+	assert.Nil(t, arr[1], "the nested nil bulk string must be stored as a nil element")
+	assert.Equal(t, "bar", arr[2], "the element after the nested nil must still be read off the wire")
+
+	// The reader must be positioned exactly at the start of the next reply,
+	// not partway through leftover array bytes.
+	next, err := reader.ReadResponse()
+	require.NoError(t, err, "the connection must not be desynced by the nested nil bulk string")
+	assert.Equal(t, "PONG", next, "next command's reply must not be corrupted by unread array elements")
+}
+
+// TestRESPReader_ReadArray_NestedNilArrayDrainsAllElements is the same
+// regression as above for a nested "*-1" (nil array) element.
+func TestRESPReader_ReadArray_NestedNilArrayDrainsAllElements(t *testing.T) {
+	// *3: bulk "foo", a nested nil array, bulk "bar" - followed immediately
+	// by an independent "+PONG" reply on the same stream, as the next
+	// command's response would be.
+	input := "*3\r\n$3\r\nfoo\r\n*-1\r\n$3\r\nbar\r\n+PONG\r\n"
+	reader := NewRESPReader(strings.NewReader(input))
+
+	result, err := reader.ReadResponse()
+	require.NoError(t, err, "a nested nil array must not fail the whole array read")
+
+	arr, ok := result.([]interface{})
+	require.True(t, ok, "expected an array result, got %T", result)
+	require.Len(t, arr, 3, "all three array elements must be present, including the one after the nested nil")
+
+	assert.Equal(t, "foo", arr[0])
+	assert.Nil(t, arr[1], "the nested nil array must be stored as a nil element")
+	assert.Equal(t, "bar", arr[2], "the element after the nested nil must still be read off the wire")
+
+	// The reader must be positioned exactly at the start of the next reply,
+	// not partway through leftover array bytes.
+	next, err := reader.ReadResponse()
+	require.NoError(t, err, "the connection must not be desynced by the nested nil array")
+	assert.Equal(t, "PONG", next, "next command's reply must not be corrupted by unread array elements")
+}
+
+// TestRESPReader_ReadArray_TopLevelNilBulkStringStillErrors ensures the
+// top-level "$-1" contract is unchanged: only a nested nil is absorbed as
+// an element, a top-level nil bulk string still returns ErrNilResponse.
+func TestRESPReader_ReadArray_TopLevelNilBulkStringStillErrors(t *testing.T) {
+	reader := NewRESPReader(strings.NewReader("$-1\r\n"))
+	_, err := reader.ReadResponse()
+	assert.True(t, errors.Is(err, ErrNilResponse), "want ErrNilResponse, got %v", err)
+}
+
+// TestRESPReader_ReadArray_TopLevelNilArrayStillErrors ensures the
+// top-level "*-1" contract is unchanged: only a nested nil is absorbed as
+// an element, a top-level nil array still returns ErrNilResponse.
+func TestRESPReader_ReadArray_TopLevelNilArrayStillErrors(t *testing.T) {
+	reader := NewRESPReader(strings.NewReader("*-1\r\n"))
+	_, err := reader.ReadResponse()
+	assert.True(t, errors.Is(err, ErrNilResponse), "want ErrNilResponse, got %v", err)
+}

internal/cache/backends/resp_test.go

@@ -142,7 +142,12 @@ func TestRESPReader_ReadError(t *testing.T) {
 			_, err := reader.ReadResponse()
 
 			require.Error(t, err)
-			assert.Equal(t, tt.expectedError, err.Error())
+			// R177: a '-' reply is now wrapped with ErrCommandReply so
+			// callers can tell a Redis command error (healthy connection)
+			// apart from an IO/parse error. The command's message text is
+			// preserved verbatim inside the wrapped error.
+			assert.True(t, errors.Is(err, ErrCommandReply), "want ErrCommandReply, got %v", err)
+			assert.Contains(t, err.Error(), tt.expectedError)
 		})
 	}
 }

internal/cache/backends/review_fix17_setnx_test.go

@@ -0,0 +1,84 @@
+package backends
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestFIX17_RedisBackendSetNX_ClaimsOnlyWhenAbsent pins RedisBackend.SetNX's
+// contract: it stores the value and reports true only when the key does not
+// already exist, using Redis SET key value NX PX <ttl-ms> as one atomic
+// server-side operation, and never overwrites an existing key.
+func TestFIX17_RedisBackendSetNX_ClaimsOnlyWhenAbsent(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+	key := "fix17-setnx-key"
+
+	set, err := backend.SetNX(ctx, key, []byte("first"), time.Minute)
+	require.NoError(t, err)
+	assert.True(t, set, "first SetNX on an absent key must claim it")
+
+	set, err = backend.SetNX(ctx, key, []byte("second"), time.Minute)
+	require.NoError(t, err)
+	assert.False(t, set, "second SetNX on an already-claimed key must not claim it")
+
+	value, ttl, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	require.True(t, exists)
+	assert.Equal(t, "first", string(value), "the losing SetNX must not overwrite the winner's value")
+	assert.Greater(t, ttl, 50*time.Second, "the winning SetNX must have attached the requested TTL")
+}
+
+// TestFIX17_RedisBackendSetNX_ConcurrentSameKeyExactlyOneWinner drives many
+// goroutines through SetNX on the SAME key against a single miniredis
+// instance shared by every caller (simulating every Traefik replica sharing
+// one Redis-backed session-invalidation cache). Exactly one must win: this
+// is the primitive UniversalCache.SetIfAbsent relies on to close the
+// cross-replica gap the FIX-17 R36 fix left open (backchannelLogoutJTIMu is
+// process-local and cannot coordinate across replicas; Redis SET NX can).
+func TestFIX17_RedisBackendSetNX_ConcurrentSameKeyExactlyOneWinner(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+	key := "fix17-setnx-concurrent-key"
+
+	const n = 20
+	var wg sync.WaitGroup
+	results := make([]bool, n)
+	errs := make([]error, n)
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func(i int) {
+			defer wg.Done()
+			results[i], errs[i] = backend.SetNX(ctx, key, []byte("claimant"), time.Minute)
+		}(i)
+	}
+	wg.Wait()
+
+	wins := 0
+	for i := 0; i < n; i++ {
+		require.NoError(t, errs[i])
+		if results[i] {
+			wins++
+		}
+	}
+	assert.Equal(t, 1, wins, "exactly one of %d concurrent SetNX calls on the same key must win", n)
+}

internal/cache/backends/review_fix31_pttl_test.go

@@ -0,0 +1,73 @@
+package backends
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestFIX31_GetNoExpiryReturnsDistinctSentinel guards RedisBackend.Get
+// against the R59 follow-up: the old code read TTL (second precision),
+// which maps both "no expiry" (-1) and "under one second left" to a
+// reported ttl of 0. UniversalCache.Get then treated any ttl<=0 as
+// DefaultTTL, so a key on the verge of expiring in Redis got re-cached
+// locally for the cache's full DefaultTTL (up to 25h for the
+// session-invalidation cache).
+//
+// Get must now use PTTL (millisecond precision) and report NoExpiryTTL,
+// not 0, for a key with no associated expiry, so the caller can still
+// distinguish "no expiry" from "expiring now".
+// Fail-on-old: a key stored with no TTL reports ttl == 0, indistinguishable
+// from an about-to-expire key.
+func TestFIX31_GetNoExpiryReturnsDistinctSentinel(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+	key := "fix31-no-expiry-key"
+
+	// ttl=0 to Set takes the bare-SET path (no expiry attached).
+	require.NoError(t, backend.Set(ctx, key, []byte("v"), 0))
+
+	_, ttl, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	require.True(t, exists)
+	assert.Equal(t, NoExpiryTTL, ttl, "a key with no Redis expiry must report the distinct NoExpiryTTL sentinel, not 0")
+}
+
+// TestFIX31_GetWithRealTTLReportsPositiveDuration pins that a key with a
+// real remaining TTL still reports a normal positive duration (not the
+// sentinel, not zero) after switching from TTL to PTTL.
+func TestFIX31_GetWithRealTTLReportsPositiveDuration(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+	key := "fix31-real-ttl-key"
+
+	require.NoError(t, backend.Set(ctx, key, []byte("v"), 10*time.Second))
+
+	_, ttl, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	require.True(t, exists)
+	assert.NotEqual(t, NoExpiryTTL, ttl)
+	// A lower bound near the full 10s pins the millisecond-precision PTTL
+	// contract: if Get is ever reverted to second-precision TTL while still
+	// being read as milliseconds, a ~10s key reports ~10ms and this bound
+	// catches it (a bare ttl>0 check would not).
+	assert.Greater(t, ttl, 9*time.Second)
+	assert.LessOrEqual(t, ttl, 10*time.Second)
+}

internal/cache/backends/review_r110_test.go

@@ -0,0 +1,54 @@
+package backends
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestConnectionPool_CapHeldUnderBurst regresses the connection-pool cap
+// being non-atomic: ConnectionPool.Get checked `totalConns < MaxConnections`
+// and THEN dialed a new socket, so concurrent Gets could each pass the check
+// and spike the live connection count far above MaxConnections (FD / Redis
+// maxclients exhaustion under burst load). The cap must now be held
+// atomically so at most MaxConnections sockets are ever created at once.
+func TestConnectionPool_CapHeldUnderBurst(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	maxConns := 3
+	pool, err := NewConnectionPool(&PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: maxConns,
+		ConnectTimeout: 80 * time.Millisecond,
+		ReadTimeout:    50 * time.Millisecond,
+		WriteTimeout:   50 * time.Millisecond,
+	})
+	require.NoError(t, err)
+	defer pool.Close()
+
+	ctx := context.Background()
+	const workers = 50
+
+	var wg sync.WaitGroup
+	for i := 0; i < workers; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			conn, _ := pool.Get(ctx)
+			if conn != nil {
+				// Hold the connection (simulate an in-flight request) so the
+				// pool stays under pressure and the count is stable.
+				_ = conn
+			}
+		}()
+	}
+	wg.Wait()
+
+	stats := pool.Stats()
+	total := stats["total_connections"].(int32)
+	require.LessOrEqual(t, total, int32(maxConns),
+		"burst Gets must not create more than MaxConnections sockets (got %d)", total)
+}

internal/cache/backends/review_r115_test.go

@@ -0,0 +1,36 @@
+package backends
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestRedisBackend_SetNegativeTTL_NotPersistent guards the R115 negative-TTL
+// fix. The cache stack's convention is that a non-positive TTL means "already
+// expired". Previously RedisBackend.Set/SetMany fell through to a bare SET
+// when ttl<=0, writing an entry with NO expiry — i.e. an expired-dated value
+// became permanent. Now expired TTLs write nothing.
+func TestRedisBackend_SetNegativeTTL_NotPersistent(t *testing.T) {
+	_, backend := setupTestRedis(t)
+	ctx := context.Background()
+
+	// Single Set with an expired TTL must not create an entry.
+	require.NoError(t, backend.Set(ctx, "neg", []byte("v"), -time.Second))
+	_, _, exists, err := backend.Get(ctx, "neg")
+	require.NoError(t, err)
+	require.False(t, exists, "negative-TTL Set must not create a persistent entry")
+
+	// SetMany with multiple items and an expired TTL must not create entries.
+	require.NoError(t, backend.SetMany(ctx, map[string][]byte{
+		"a": []byte("1"),
+		"b": []byte("2"),
+	}, -time.Second))
+	for _, k := range []string{"a", "b"} {
+		_, _, exists, err := backend.Get(ctx, k)
+		require.NoError(t, err)
+		require.False(t, exists, "negative-TTL SetMany must not create a persistent entry for %q", k)
+	}
+}

internal/cache/backends/review_r141_test.go

@@ -0,0 +1,99 @@
+package backends
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+)
+
+// TestSingleflightCache_PanickingFetcherDoesNotDeadlock verifies that a
+// fetcher which panics (routines in this codebase treat panics as a normal
+// failure mode) does not wedge the singleflight entry: the leading caller
+// yields an error and waiting callers are released instead of blocking on
+// call.wg forever (R141).
+func TestSingleflightCache_PanickingFetcherDoesNotDeadlock(t *testing.T) {
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
+	requireNoErrorFatal(t, err)
+	defer backend.Close()
+
+	cache := NewSingleflightCache(backend)
+	ctx := context.Background()
+	key := "panic-key"
+
+	panicFetcher := func(ctx context.Context) ([]byte, time.Duration, error) {
+		panic("boom")
+	}
+
+	var wg sync.WaitGroup
+	var doneA, doneB = make(chan struct{}), make(chan struct{})
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		defer func() { _ = recover() }() // tolerate old code's out-of-band panic
+		_, _ = cache.GetOrFetch(ctx, key, panicFetcher)
+		close(doneA)
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		_, _ = cache.GetOrFetch(ctx, key, panicFetcher)
+		close(doneB)
+	}()
+
+	select {
+	case <-doneB:
+	case <-time.After(3 * time.Second):
+		t.Fatal("concurrent waiter hung on a panicking singleflight fetcher")
+	}
+	select {
+	case <-doneA:
+	case <-time.After(3 * time.Second):
+		t.Fatal("leading caller hung on its own panicking fetcher")
+	}
+	wg.Wait()
+
+	// After the entry is cleaned up, a well-behaved fetcher for the same
+	// key must execute normally (proves the entry was not permanently
+	// wedged by the panic).
+	ran := false
+	good := func(ctx context.Context) ([]byte, time.Duration, error) {
+		ran = true
+		return []byte("ok"), time.Minute, nil
+	}
+	// Poll until the deferred cleanup goroutine (singleflight.go's
+	// time.Sleep(100ms) + delete) has released the key, instead of sleeping
+	// a fixed margin over that 100ms delay (FIX-22): a late-firing cleanup
+	// timer under load let the next GetOrFetch join the finished call and
+	// receive its stale panic error back, making the fixed-sleep version
+	// flaky on loaded CI runners.
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		cache.mu.Lock()
+		_, stillPresent := cache.calls[key]
+		cache.mu.Unlock()
+		if !stillPresent {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("singleflight entry for key was never released after the panicking fetcher completed")
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	if _, err := cache.GetOrFetch(ctx, key, good); err != nil {
+		t.Fatalf("well-behaved fetcher after panic returned error: %v", err)
+	}
+	if !ran {
+		t.Fatal("well-behaved fetcher after panic did not execute")
+	}
+}
+
+func requireNoErrorFatal(t *testing.T, err error) {
+	t.Helper()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}

internal/cache/backends/review_r177_redis_test.go

@@ -0,0 +1,79 @@
+package backends
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestR177_RedisCommandErrorDoesNotCloseConn regresses the RESP command-error
+// conflation: a Redis '-' (command error) reply, e.g. WRONGTYPE or OOM, is
+// a valid protocol response — it does not mean the connection is dead.
+// Previously Do and Pipeline treated it as an IO error, marking the healthy
+// pooled connection closed (and for pipelines aborting the whole batch),
+// discarding a perfectly reusable connection.
+func TestR177_RedisCommandErrorDoesNotCloseConn(t *testing.T) {
+	mr := NewMiniredisServer(t)
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 5,
+		ConnectTimeout: 5 * time.Second,
+		ReadTimeout:    3 * time.Second,
+		WriteTimeout:   3 * time.Second,
+	}
+	ctx := context.Background()
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	conn, err := pool.Get(ctx)
+	require.NoError(t, err)
+	defer pool.Put(conn)
+
+	t.Run("single command error leaves conn healthy", func(t *testing.T) {
+		mr.SetError("ERR artificial") // every command returns '-ERR artificial'
+
+		_, err := conn.Do("GET", "k")
+		require.Error(t, err)
+		require.True(t, errors.Is(err, ErrCommandReply),
+			"expected a Redis command-reply error, got %v", err)
+
+		mr.SetError("") // clear; the connection must still be reusable
+
+		// On the buggy path Do marked the conn closed above, so this
+		// PING fails with "connection closed"; on the fixed path the
+		// conn is untouched and PING succeeds.
+		resp, err := conn.Do("PING")
+		require.NoError(t, err)
+		require.Equal(t, "PONG", resp)
+	})
+
+	t.Run("pipeline command error reads full batch and keeps conn", func(t *testing.T) {
+		mr.SetError("ERR artificial")
+
+		p := conn.NewPipeline()
+		p.Queue("SET", "k1", "v1")
+		p.Queue("SET", "k2", "v2")
+
+		// On the buggy path Execute returned after the first error (1
+		// response) and closed the conn; on the fixed path all replies
+		// are read (healthy conn), the batch is not aborted.
+		responses, err := p.Execute()
+		require.NoError(t, err, "batch must complete with per-command errors")
+		require.Len(t, responses, 2)
+		for i, r := range responses {
+			er, ok := r.(error)
+			require.True(t, ok, "response %d should carry an error value", i)
+			require.True(t, errors.Is(er, ErrCommandReply), "response %d should be a command-reply error", i)
+		}
+
+		mr.SetError("")
+		resp, err := conn.Do("PING")
+		require.NoError(t, err)
+		require.Equal(t, "PONG", resp)
+	})
+}

internal/cache/backends/review_r208_stress_test.go

@@ -0,0 +1,47 @@
+package backends
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+)
+
+// TestRedisBackendStressCloseConcurrent hammers a miniredis-backed
+// RedisBackend (pooled connections) from many goroutines while Close runs,
+// the pooled-conn use-after-close race class (R208).
+func TestRedisBackendStressCloseConcurrent(t *testing.T) {
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
+	if err != nil {
+		t.Fatalf("NewRedisBackend: %v", err)
+	}
+
+	var wg sync.WaitGroup
+	stop := make(chan struct{})
+	for g := 0; g < 8; g++ {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+			for i := 0; ; i++ {
+				select {
+				case <-stop:
+					return
+				default:
+				}
+				key := fmt.Sprintf("redis:k:%d:%d", id, i%256)
+				if i%2 == 0 {
+					_ = backend.Set(context.Background(), key, []byte("v"), time.Minute)
+				} else {
+					_, _, _, _ = backend.Get(context.Background(), key)
+				}
+			}
+		}(g)
+	}
+
+	time.Sleep(20 * time.Millisecond)
+	_ = backend.Close()
+	close(stop)
+	wg.Wait()
+}

internal/cache/backends/review_r212_stress_test.go

@@ -0,0 +1,86 @@
+package backends
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// TestSingleflightStressDedup hammers GetOrFetch with many concurrent
+// waiters on the SAME key behind a slow fetcher: exactly one fetch must
+// run and all waiters must share its result, with no race on
+// call.val/call.err read after wg.Wait() (R212). Run under -race.
+func TestSingleflightStressDedup(t *testing.T) {
+	mr := NewMiniredisServer(t)
+	backend, _ := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
+	sf := NewSingleflightCache(backend)
+
+	var fetches atomic.Int64
+	slow := func(context.Context) ([]byte, time.Duration, error) {
+		fetches.Add(1)
+		time.Sleep(5 * time.Millisecond)
+		return []byte("result"), time.Minute, nil
+	}
+
+	var wg sync.WaitGroup
+	for g := 0; g < 16; g++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for i := 0; i < 20; i++ {
+				v, err := sf.GetOrFetch(context.Background(), "k", slow)
+				if err != nil {
+					t.Errorf("GetOrFetch: %v", err)
+					return
+				}
+				if string(v) != "result" {
+					t.Errorf("unexpected value %q", v)
+					return
+				}
+			}
+		}()
+	}
+	wg.Wait()
+
+	if fetches.Load() < 1 || fetches.Load() > 20 {
+		t.Fatalf("expected dedup across concurrent waiters; fetcher ran %d times", fetches.Load())
+	}
+}
+
+// A panicking fetcher must not leave waiters blocked forever: they must all
+// receive the recovered error (R212).
+func TestSingleflightStressPanicUnblocks(t *testing.T) {
+	mr := NewMiniredisServer(t)
+	backend, _ := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
+	sf := NewSingleflightCache(backend)
+
+	panicFetcher := func(context.Context) ([]byte, time.Duration, error) {
+		panic("boom")
+	}
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		var wg sync.WaitGroup
+		for g := 0; g < 8; g++ {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				_, err := sf.GetOrFetch(context.Background(), "pk", panicFetcher)
+				if err == nil {
+					t.Error("expected error from panicking fetcher")
+				}
+			}()
+		}
+		wg.Wait()
+	}()
+
+	select {
+	case <-done:
+		// all waiters unblocked with the recovered error
+	case <-time.After(5 * time.Second):
+		t.Fatal("waiters stayed blocked after panicking fetcher (singleflight wedged)")
+	}
+}

internal/cache/backends/review_r2_fix17_setnx_reply_dropped_test.go

@@ -0,0 +1,171 @@
+package backends
+
+// Round-2 verifier regression (minor): RedisBackend.SetNX ran the Redis
+// SET key value NX PX command inside the shared executeWithRetry helper,
+// which blindly retries on a "connection"/"timeout"/"EOF" error by
+// re-issuing the whole operation closure. That is safe for Set (SETEX/
+// PSETEX overwrite unconditionally, so a retry after a lost reply is a
+// no-op repeat), but not for SET NX: if the first SET NX reached Redis and
+// applied, but its reply was lost before SetNX could read it, a retried
+// SET NX sees the caller's OWN write and reports (false, nil) —
+// "already claimed" — for what was actually a first-ever claim.
+//
+// dropReplyProxy below sits between the client and a real miniredis
+// instance, forwarding every request but swallowing the reply to exactly
+// one triggering command, reproducing that lost-reply window
+// deterministically.
+
+import (
+	"bytes"
+	"context"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// dropReplyProxy relays a single TCP connection to target, forwarding every
+// byte in both directions except: the first server->client chunk that
+// follows the FIRST client->server chunk containing trigger is swallowed
+// instead of forwarded, simulating a reply lost after Redis already
+// processed the command. Only the first occurrence of trigger arms a drop —
+// a caller's retry re-sending the same command (which necessarily contains
+// the same trigger substring) must relay normally, or the test could never
+// distinguish "retried and got a real answer" from "every attempt starved".
+type dropReplyProxy struct {
+	ln      net.Listener
+	target  string
+	trigger []byte
+
+	mu        sync.Mutex
+	triggered bool
+	dropNext  bool
+}
+
+func newDropReplyProxy(t *testing.T, target string, trigger []byte) *dropReplyProxy {
+	t.Helper()
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	p := &dropReplyProxy{ln: ln, target: target, trigger: trigger}
+	go p.acceptLoop()
+	t.Cleanup(func() { _ = ln.Close() })
+	return p
+}
+
+func (p *dropReplyProxy) Addr() string { return p.ln.Addr().String() }
+
+func (p *dropReplyProxy) acceptLoop() {
+	for {
+		client, err := p.ln.Accept()
+		if err != nil {
+			return
+		}
+		go p.handleConn(client)
+	}
+}
+
+func (p *dropReplyProxy) handleConn(client net.Conn) {
+	server, err := net.Dial("tcp", p.target)
+	if err != nil {
+		_ = client.Close()
+		return
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	go func() {
+		defer wg.Done()
+		buf := make([]byte, 4096)
+		for {
+			n, rerr := client.Read(buf)
+			if n > 0 {
+				chunk := buf[:n]
+				p.mu.Lock()
+				if !p.triggered && bytes.Contains(chunk, p.trigger) {
+					p.triggered = true
+					p.dropNext = true
+				}
+				p.mu.Unlock()
+				if _, werr := server.Write(chunk); werr != nil {
+					break
+				}
+			}
+			if rerr != nil {
+				break
+			}
+		}
+		_ = server.Close()
+	}()
+
+	go func() {
+		defer wg.Done()
+		buf := make([]byte, 4096)
+		for {
+			n, rerr := server.Read(buf)
+			if n > 0 {
+				p.mu.Lock()
+				drop := p.dropNext
+				p.dropNext = false
+				p.mu.Unlock()
+
+				if !drop {
+					if _, werr := client.Write(buf[:n]); werr != nil {
+						break
+					}
+				}
+				// drop == true: swallow this chunk, simulating a lost reply.
+			}
+			if rerr != nil {
+				break
+			}
+		}
+		_ = client.Close()
+	}()
+
+	wg.Wait()
+}
+
+// TestFIX17R2_RedisBackendSetNX_ReplyDropped_ReportsAmbiguousNotFalseClaim
+// pins that a SET NX whose reply is lost after the command reached Redis
+// must not be reported as (false, nil) — that reads as "someone else
+// already claimed it" when in fact THIS call may have (and, per the proxy,
+// did) claim it. It must instead report the request outcome as unknown
+// (ErrSetNXAmbiguous), and the key must actually exist in Redis (proving
+// the write really landed, so treating it as "not claimed" would have been
+// a false negative on a first-ever claim).
+func TestFIX17R2_RedisBackendSetNX_ReplyDropped_ReportsAmbiguousNotFalseClaim(t *testing.T) {
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	t.Cleanup(mr.Close)
+
+	proxy := newDropReplyProxy(t, mr.Addr(), []byte("NX"))
+
+	config := DefaultRedisConfig(proxy.Addr())
+	config.PoolSize = 1
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer func() { _ = backend.Close() }()
+
+	ctx := context.Background()
+	key := "first-claim"
+
+	claimed, setNXErr := backend.SetNX(ctx, key, []byte("v1"), time.Minute)
+
+	assert.False(t, claimed, "an ambiguous SetNX outcome must not report claimed=true")
+	require.Error(t, setNXErr, "a lost SET NX reply must surface as an error, not (false, nil) — nil reads as \"someone else already claimed it\"")
+	assert.Same(t, ErrSetNXAmbiguous, setNXErr, "a lost SET NX reply must surface as the ambiguous sentinel specifically")
+
+	// Confirm directly against miniredis (bypassing the proxy) that the
+	// write actually landed — this is what makes (false, nil) wrong: it
+	// would have told the caller "not claimed" about a key Redis already
+	// holds.
+	val, verr := mr.Get(config.RedisPrefix + key)
+	require.NoError(t, verr)
+	assert.Equal(t, "v1", val, "the SET NX must have actually applied in Redis despite the dropped reply")
+}

internal/cache/backends/review_r4_setnx_command_error_test.go

@@ -0,0 +1,166 @@
+package backends
+
+// R4 cache review (medium): RedisBackend.SetNX reported
+// backends.ErrSetNXAmbiguous for a definitive Redis command-error reply (a
+// RESP '-' line such as -READONLY, -OOM or -MISCONF), not only for a
+// genuinely lost reply. A command-error reply proves Redis rejected the
+// command outright — nothing was applied — so treating it as merely
+// "outcome unknown" let checkAndMarkLogoutJTIProcessed accept a logout
+// token's jti-claim outright instead of falling through to its process-local
+// fallback, so a captured logout token could be replayed indefinitely while
+// Redis rejects writes (e.g. a demoted read-only replica after a failover).
+//
+// errorReplyProxy relays a single TCP connection to a real miniredis
+// instance, but answers the FIRST command containing trigger with a
+// scripted RESP error line instead of forwarding it to the server —
+// modeling Redis actively refusing the write, as opposed to
+// review_r2_fix17_setnx_reply_dropped_test.go's dropReplyProxy, which
+// forwards the command and only swallows its reply.
+
+import (
+	"bytes"
+	"context"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type errorReplyProxy struct {
+	ln      net.Listener
+	target  string
+	trigger []byte
+	errLine []byte
+
+	mu        sync.Mutex
+	triggered bool
+}
+
+func newErrorReplyProxy(t *testing.T, target string, trigger, errLine []byte) *errorReplyProxy {
+	t.Helper()
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	p := &errorReplyProxy{ln: ln, target: target, trigger: trigger, errLine: errLine}
+	go p.acceptLoop()
+	t.Cleanup(func() { _ = ln.Close() })
+	return p
+}
+
+func (p *errorReplyProxy) Addr() string { return p.ln.Addr().String() }
+
+func (p *errorReplyProxy) acceptLoop() {
+	for {
+		client, err := p.ln.Accept()
+		if err != nil {
+			return
+		}
+		go p.handleConn(client)
+	}
+}
+
+func (p *errorReplyProxy) handleConn(client net.Conn) {
+	server, err := net.Dial("tcp", p.target)
+	if err != nil {
+		_ = client.Close()
+		return
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	// client -> server: intercept the first command containing trigger and
+	// answer it directly with errLine instead of forwarding it, so the
+	// command never reaches Redis at all (a definitive rejection, not a
+	// lost reply after Redis already applied the write).
+	go func() {
+		defer wg.Done()
+		buf := make([]byte, 4096)
+		for {
+			n, rerr := client.Read(buf)
+			if n > 0 {
+				chunk := buf[:n]
+				p.mu.Lock()
+				intercept := !p.triggered && bytes.Contains(chunk, p.trigger)
+				if intercept {
+					p.triggered = true
+				}
+				p.mu.Unlock()
+
+				if intercept {
+					if _, werr := client.Write(p.errLine); werr != nil {
+						break
+					}
+				} else if _, werr := server.Write(chunk); werr != nil {
+					break
+				}
+			}
+			if rerr != nil {
+				break
+			}
+		}
+		_ = server.Close()
+	}()
+
+	// server -> client: relay every real reply unchanged.
+	go func() {
+		defer wg.Done()
+		buf := make([]byte, 4096)
+		for {
+			n, rerr := server.Read(buf)
+			if n > 0 {
+				if _, werr := client.Write(buf[:n]); werr != nil {
+					break
+				}
+			}
+			if rerr != nil {
+				break
+			}
+		}
+		_ = client.Close()
+	}()
+
+	wg.Wait()
+}
+
+// TestR4_RedisBackendSetNX_CommandErrorReply_ReturnsDefiniteError pins that a
+// SET NX rejected outright by Redis (a RESP '-' error reply) is reported as
+// a plain, definitive error — never backends.ErrSetNXAmbiguous, which means
+// "may have applied, outcome unknown" and is reserved for a reply lost
+// after the write (timeout/EOF/reset), a different failure mode entirely.
+func TestR4_RedisBackendSetNX_CommandErrorReply_ReturnsDefiniteError(t *testing.T) {
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	t.Cleanup(mr.Close)
+
+	proxy := newErrorReplyProxy(t, mr.Addr(), []byte("NX"),
+		[]byte("-READONLY You can't write against a read only replica.\r\n"))
+
+	config := DefaultRedisConfig(proxy.Addr())
+	config.PoolSize = 1
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = backend.Close() })
+
+	ctx := context.Background()
+	key := "readonly-claim"
+
+	claimed, setNXErr := backend.SetNX(ctx, key, []byte("v1"), time.Minute)
+
+	assert.False(t, claimed, "a rejected SET NX must not report claimed=true")
+	require.Error(t, setNXErr, "a Redis command-error reply must surface as an error")
+	assert.NotSame(t, ErrSetNXAmbiguous, setNXErr,
+		"a definitive Redis rejection (-READONLY/-OOM/-MISCONF) is NOT ambiguous — "+
+			"it proves the command was never applied, so it must not be reported "+
+			"as ErrSetNXAmbiguous, which tells callers the write may have landed")
+
+	// Confirm directly against miniredis (bypassing the proxy) that the
+	// write never applied — the command was answered by the proxy, not
+	// forwarded.
+	_, verr := mr.Get(config.RedisPrefix + key)
+	assert.Error(t, verr, "the rejected SET NX must not have applied in Redis")
+}

internal/cache/backends/review_r80_test.go

@@ -0,0 +1,48 @@
+package backends
+
+import (
+	"context"
+	"net"
+	"testing"
+	"time"
+)
+
+// TestExecuteWithRetry_ReturnsConnOnPanic is a regression: executeWithRetry
+// returned the borrowed connection imperatively with no defer, so an operation
+// panic leaked the Redis connection out of the pool and desynced its counters.
+// The fix guarantees the connection is returned on all exit paths including
+// panic.
+func TestExecuteWithRetry_ReturnsConnOnPanic(t *testing.T) {
+	pool, err := NewConnectionPool(&PoolConfig{MaxConnections: 1, ConnectTimeout: 50 * time.Millisecond})
+	if err != nil {
+		t.Fatalf("NewConnectionPool: %v", err)
+	}
+
+	// Seed one available connection so executeWithRetry's Get succeeds without
+	// dialing (no Redis server needed).
+	pc, sw := net.Pipe()
+	defer sw.Close()
+	rc := &RedisConn{conn: pc, readTimeout: time.Second, writeTimeout: time.Second}
+	pool.Put(rc)
+
+	if got := len(pool.connections); got != 1 {
+		t.Fatalf("setup: expected one seeded connection, got %d", got)
+	}
+
+	r := &RedisBackend{pool: pool}
+
+	func() {
+		defer func() {
+			if v := recover(); v == nil {
+				t.Fatalf("expected operation to panic")
+			}
+		}()
+		_ = r.executeWithRetry(context.Background(), func(c *RedisConn) error {
+			panic("boom")
+		})
+	}()
+
+	if got := len(pool.connections); got != 1 {
+		t.Fatalf("expected connection returned to pool after operation panic, got %d", got)
+	}
+}

internal/cache/backends/singleflight.go

@@ -2,6 +2,7 @@ package backends
 
 import (
 	"context"
+	"fmt"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -80,8 +81,22 @@ func (s *SingleflightCache) GetOrFetch(ctx context.Context, key string, fetcher
 	s.calls[key] = call
 	s.mu.Unlock()
 
-	// Execute the fetcher
-	call.val, call.ttl, call.err = fetcher(ctx)
+	// Execute the fetcher. Recover any panic so call.wg.Done() below is
+	// always reached: a panicking fetcher would otherwise leave every
+	// waiter blocked forever on call.wg.Wait() and the call permanently
+	// wedged in s.calls (subsequent GetOrFetch calls for the key would
+	// block indefinitely). Routines here (BackgroundTask, Goroutine)
+	// treat panics as a normal failure mode, so this is reachable.
+	func() {
+		defer func() {
+			if r := recover(); r != nil {
+				if call.err == nil {
+					call.err = fmt.Errorf("singleflight fetcher panicked: %v", r)
+				}
+			}
+		}()
+		call.val, call.ttl, call.err = fetcher(ctx)
+	}()
 	call.done = true
 
 	// If successful, store in cache

internal/cache/backends/singleflight_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/alicebob/miniredis/v2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -17,7 +18,8 @@ import (
 func TestSingleflightCache_BasicGetOrFetch(t *testing.T) {
 	t.Parallel()
 
-	backend, err := NewMemoryBackend(DefaultConfig())
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
 	require.NoError(t, err)
 	defer backend.Close()
 
@@ -91,7 +93,8 @@ func TestSingleflightCache_BasicGetOrFetch(t *testing.T) {
 func TestSingleflightCache_Deduplication(t *testing.T) {
 	t.Parallel()
 
-	backend, err := NewMemoryBackend(DefaultConfig())
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
 	require.NoError(t, err)
 	defer backend.Close()
 
@@ -144,7 +147,8 @@ func TestSingleflightCache_Deduplication(t *testing.T) {
 func TestSingleflightCache_DifferentKeys(t *testing.T) {
 	t.Parallel()
 
-	backend, err := NewMemoryBackend(DefaultConfig())
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
 	require.NoError(t, err)
 	defer backend.Close()
 
@@ -193,7 +197,8 @@ func TestSingleflightCache_DifferentKeys(t *testing.T) {
 func TestSingleflightCache_ContextCancellation(t *testing.T) {
 	t.Parallel()
 
-	backend, err := NewMemoryBackend(DefaultConfig())
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
 	require.NoError(t, err)
 	defer backend.Close()
 
@@ -236,7 +241,8 @@ func TestSingleflightCache_ContextCancellation(t *testing.T) {
 func TestSingleflightCache_ErrorPropagation(t *testing.T) {
 	t.Parallel()
 
-	backend, err := NewMemoryBackend(DefaultConfig())
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
 	require.NoError(t, err)
 	defer backend.Close()
 
@@ -282,7 +288,8 @@ func TestSingleflightCache_ErrorPropagation(t *testing.T) {
 func TestSingleflightCache_PassthroughMethods(t *testing.T) {
 	t.Parallel()
 
-	backend, err := NewMemoryBackend(DefaultConfig())
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
 	require.NoError(t, err)
 	defer backend.Close()
 
@@ -359,7 +366,8 @@ func TestSingleflightCache_PassthroughMethods(t *testing.T) {
 func TestSingleflightCache_Stats(t *testing.T) {
 	t.Parallel()
 
-	backend, err := NewMemoryBackend(DefaultConfig())
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
 	require.NoError(t, err)
 	defer backend.Close()
 
@@ -404,7 +412,8 @@ func TestSingleflightCache_Stats(t *testing.T) {
 func TestSingleflightCache_ResetStats(t *testing.T) {
 	t.Parallel()
 
-	backend, err := NewMemoryBackend(DefaultConfig())
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
 	require.NoError(t, err)
 	defer backend.Close()
 
@@ -435,7 +444,8 @@ func TestSingleflightCache_ResetStats(t *testing.T) {
 func TestSingleflightCache_GetBackend(t *testing.T) {
 	t.Parallel()
 
-	backend, err := NewMemoryBackend(DefaultConfig())
+	mr := NewMiniredisServer(t)
+	backend, err := NewRedisBackend(DefaultRedisConfig(mr.GetAddr()))
 	require.NoError(t, err)
 	defer backend.Close()
 
@@ -446,7 +456,9 @@ func TestSingleflightCache_GetBackend(t *testing.T) {
 
 // BenchmarkSingleflightCache_Sequential benchmarks sequential access
 func BenchmarkSingleflightCache_Sequential(b *testing.B) {
-	backend, _ := NewMemoryBackend(DefaultConfig())
+	mr, _ := miniredis.Run()
+	defer mr.Close()
+	backend, _ := NewRedisBackend(DefaultRedisConfig(mr.Addr()))
 	defer backend.Close()
 
 	cache := NewSingleflightCache(backend)
@@ -465,7 +477,9 @@ func BenchmarkSingleflightCache_Sequential(b *testing.B) {
 
 // BenchmarkSingleflightCache_Concurrent benchmarks concurrent access
 func BenchmarkSingleflightCache_Concurrent(b *testing.B) {
-	backend, _ := NewMemoryBackend(DefaultConfig())
+	mr, _ := miniredis.Run()
+	defer mr.Close()
+	backend, _ := NewRedisBackend(DefaultRedisConfig(mr.Addr()))
 	defer backend.Close()
 
 	cache := NewSingleflightCache(backend)
@@ -489,7 +503,9 @@ func BenchmarkSingleflightCache_Concurrent(b *testing.B) {
 
 // BenchmarkSingleflightCache_HighContention benchmarks high contention scenario
 func BenchmarkSingleflightCache_HighContention(b *testing.B) {
-	backend, _ := NewMemoryBackend(DefaultConfig())
+	mr, _ := miniredis.Run()
+	defer mr.Close()
+	backend, _ := NewRedisBackend(DefaultRedisConfig(mr.Addr()))
 	defer backend.Close()
 
 	cache := NewSingleflightCache(backend)

internal/cache/backends/stringutil.go

@@ -0,0 +1,34 @@
+package backends
+
+// contains reports whether s contains substr, case-insensitively. Used by
+// RedisBackend's retry classification (redis.go) to match Redis error
+// messages against known-retryable patterns.
+//
+// Hand-rolled instead of strings.Contains + strings.ToLower to avoid an
+// allocation per call on the retry-check hot path.
+func contains(s, substr string) bool {
+	if len(substr) > len(s) {
+		return false
+	}
+	for i := 0; i <= len(s)-len(substr); i++ {
+		match := true
+		for j := 0; j < len(substr); j++ {
+			if toLower(s[i+j]) != toLower(substr[j]) {
+				match = false
+				break
+			}
+		}
+		if match {
+			return true
+		}
+	}
+	return false
+}
+
+// toLower converts a byte to lowercase (ASCII only).
+func toLower(b byte) byte {
+	if b >= 'A' && b <= 'Z' {
+		return b + 32
+	}
+	return b
+}

internal/cache/cache.go

@@ -1,414 +0,0 @@
-package cache
-
-import (
-	"container/list"
-	"context"
-	"encoding/json"
-	"fmt"
-	"sync"
-	"sync/atomic"
-	"time"
-)
-
-// Type defines the type of cache for optimized behavior
-type Type string
-
-const (
-	TypeToken    Type = "token"
-	TypeMetadata Type = "metadata"
-	TypeJWK      Type = "jwk"
-	TypeSession  Type = "session"
-	TypeGeneral  Type = "general"
-)
-
-// Logger interface for cache operations
-type Logger interface {
-	Debug(msg string)
-	Debugf(format string, args ...interface{})
-	Info(msg string)
-	Infof(format string, args ...interface{})
-	Error(msg string)
-	Errorf(format string, args ...interface{})
-}
-
-// Config provides configuration for the cache
-type Config struct {
-	Logger            Logger
-	JWKConfig         *JWKConfig
-	MetadataConfig    *MetadataConfig
-	TokenConfig       *TokenConfig
-	Type              Type
-	DefaultTTL        time.Duration
-	CleanupInterval   time.Duration
-	MaxMemoryBytes    int64
-	MaxSize           int
-	EnableMetrics     bool
-	EnableAutoCleanup bool
-	EnableMemoryLimit bool
-	EnableCompression bool
-}
-
-// TokenConfig provides token-specific cache configuration
-type TokenConfig struct {
-	BlacklistTTL        time.Duration
-	RefreshTokenTTL     time.Duration
-	EnableTokenRotation bool
-}
-
-// MetadataConfig provides metadata-specific cache configuration
-type MetadataConfig struct {
-	SecurityCriticalFields         []string
-	GracePeriod                    time.Duration
-	ExtendedGracePeriod            time.Duration
-	MaxGracePeriod                 time.Duration
-	SecurityCriticalMaxGracePeriod time.Duration
-}
-
-// JWKConfig provides JWK-specific cache configuration
-type JWKConfig struct {
-	RefreshInterval time.Duration
-	MinRefreshTime  time.Duration
-	MaxKeyAge       time.Duration
-}
-
-// Item represents a single cache entry
-type Item struct {
-	ExpiresAt    time.Time
-	LastAccessed time.Time
-	Value        interface{}
-	Metadata     map[string]interface{}
-	element      *list.Element
-	Key          string
-	CacheType    Type
-	Size         int64
-	AccessCount  int64
-}
-
-// Cache provides a single, unified cache implementation
-type Cache struct {
-	config        Config
-	ctx           context.Context
-	logger        Logger
-	cancel        context.CancelFunc
-	lruList       *list.List
-	items         map[string]*Item
-	stopCleanup   chan bool
-	wg            sync.WaitGroup
-	currentSize   int64
-	currentMemory int64
-	hits          int64
-	misses        int64
-	evictions     int64
-	sets          int64
-	mu            sync.RWMutex
-	closed        int32
-}
-
-// DefaultConfig returns a default cache configuration
-func DefaultConfig() Config {
-	return Config{
-		Type:              TypeGeneral,
-		MaxSize:           1000,
-		MaxMemoryBytes:    64 * 1024 * 1024, // 64MB
-		DefaultTTL:        10 * time.Minute,
-		CleanupInterval:   5 * time.Minute,
-		EnableAutoCleanup: true,
-		EnableMemoryLimit: true,
-		EnableMetrics:     true,
-	}
-}
-
-// New creates a new cache instance
-func New(config Config) *Cache {
-	if config.Logger == nil {
-		config.Logger = &noOpLogger{}
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	c := &Cache{
-		items:   make(map[string]*Item),
-		lruList: list.New(),
-		config:  config,
-		logger:  config.Logger,
-		ctx:     ctx,
-		cancel:  cancel,
-	}
-
-	if config.EnableAutoCleanup && config.CleanupInterval > 0 {
-		c.stopCleanup = make(chan bool)
-		c.startCleanupRoutine()
-	}
-
-	return c
-}
-
-// Set stores a value with TTL
-func (c *Cache) Set(key string, value interface{}, ttl time.Duration) error {
-	if atomic.LoadInt32(&c.closed) == 1 {
-		return fmt.Errorf("cache is closed")
-	}
-
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	// Calculate size
-	size := c.estimateSize(value)
-
-	// Check memory limit
-	if c.config.EnableMemoryLimit && c.currentMemory+size > c.config.MaxMemoryBytes {
-		c.evictLRU()
-	}
-
-	// Check size limit
-	if c.config.MaxSize > 0 && len(c.items) >= c.config.MaxSize {
-		c.evictLRU()
-	}
-
-	// Create or update item
-	item := &Item{
-		Key:          key,
-		Value:        value,
-		Size:         size,
-		ExpiresAt:    time.Now().Add(ttl),
-		LastAccessed: time.Now(),
-		AccessCount:  0,
-		CacheType:    c.config.Type,
-		Metadata:     make(map[string]interface{}),
-	}
-
-	// Remove old item if exists
-	if oldItem, exists := c.items[key]; exists {
-		c.lruList.Remove(oldItem.element)
-		c.currentMemory -= oldItem.Size
-		c.currentSize--
-	}
-
-	// Add new item
-	item.element = c.lruList.PushFront(item)
-	c.items[key] = item
-	c.currentMemory += size
-	c.currentSize++
-	atomic.AddInt64(&c.sets, 1)
-
-	c.logger.Debugf("Cache: Set key=%s, size=%d, ttl=%v", redactKey(key), size, ttl)
-	return nil
-}
-
-// Get retrieves a value from cache
-func (c *Cache) Get(key string) (interface{}, bool) {
-	if atomic.LoadInt32(&c.closed) == 1 {
-		return nil, false
-	}
-
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	item, exists := c.items[key]
-	if !exists {
-		atomic.AddInt64(&c.misses, 1)
-		return nil, false
-	}
-
-	// Check expiration
-	if time.Now().After(item.ExpiresAt) {
-		c.removeItem(key, item)
-		atomic.AddInt64(&c.misses, 1)
-		return nil, false
-	}
-
-	// Update LRU
-	c.lruList.MoveToFront(item.element)
-	item.LastAccessed = time.Now()
-	item.AccessCount++
-	atomic.AddInt64(&c.hits, 1)
-
-	return item.Value, true
-}
-
-// Delete removes a key from cache
-func (c *Cache) Delete(key string) {
-	if atomic.LoadInt32(&c.closed) == 1 {
-		return
-	}
-
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if item, exists := c.items[key]; exists {
-		c.removeItem(key, item)
-	}
-}
-
-// Clear removes all items from cache
-func (c *Cache) Clear() {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	c.items = make(map[string]*Item)
-	c.lruList.Init()
-	c.currentSize = 0
-	c.currentMemory = 0
-}
-
-// Size returns the number of items in cache
-func (c *Cache) Size() int {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	return len(c.items)
-}
-
-// SetMaxSize updates the maximum cache size
-func (c *Cache) SetMaxSize(size int) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.config.MaxSize = size
-
-	// Evict items if necessary
-	for len(c.items) > size && c.lruList.Len() > 0 {
-		c.evictLRU()
-	}
-}
-
-// GetStats returns cache statistics
-func (c *Cache) GetStats() map[string]interface{} {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-
-	return map[string]interface{}{
-		"size":       c.currentSize,
-		"memory":     c.currentMemory,
-		"hits":       atomic.LoadInt64(&c.hits),
-		"misses":     atomic.LoadInt64(&c.misses),
-		"evictions":  atomic.LoadInt64(&c.evictions),
-		"sets":       atomic.LoadInt64(&c.sets),
-		"hit_rate":   c.calculateHitRate(),
-		"cache_type": string(c.config.Type),
-	}
-}
-
-// Close gracefully shuts down the cache
-func (c *Cache) Close() error {
-	if !atomic.CompareAndSwapInt32(&c.closed, 0, 1) {
-		return fmt.Errorf("cache already closed")
-	}
-
-	c.cancel()
-	if c.config.EnableAutoCleanup {
-		close(c.stopCleanup)
-		c.wg.Wait()
-	}
-
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	// Clear inline to avoid double locking
-	c.items = make(map[string]*Item)
-	c.lruList.Init()
-	c.currentSize = 0
-	c.currentMemory = 0
-
-	return nil
-}
-
-// Cleanup removes expired items
-func (c *Cache) Cleanup() {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	now := time.Now()
-	var toRemove []string
-
-	for key, item := range c.items {
-		if now.After(item.ExpiresAt) {
-			toRemove = append(toRemove, key)
-		}
-	}
-
-	for _, key := range toRemove {
-		if item, exists := c.items[key]; exists {
-			c.removeItem(key, item)
-		}
-	}
-
-	c.logger.Debugf("Cache cleanup: removed %d expired items", len(toRemove))
-}
-
-// Private methods
-
-func (c *Cache) removeItem(key string, item *Item) {
-	c.lruList.Remove(item.element)
-	delete(c.items, key)
-	c.currentMemory -= item.Size
-	c.currentSize--
-}
-
-func (c *Cache) evictLRU() {
-	if elem := c.lruList.Back(); elem != nil {
-		item, _ := elem.Value.(*Item) // Safe to ignore: type assertion from known type
-		c.removeItem(item.Key, item)
-		atomic.AddInt64(&c.evictions, 1)
-		c.logger.Debugf("Cache: Evicted LRU item key=%s", redactKey(item.Key))
-	}
-}
-
-func (c *Cache) estimateSize(value interface{}) int64 {
-	// Simple size estimation
-	switch v := value.(type) {
-	case string:
-		return int64(len(v))
-	case []byte:
-		return int64(len(v))
-	case map[string]interface{}:
-		// Rough estimation for maps
-		data, _ := json.Marshal(v)
-		return int64(len(data))
-	default:
-		// Default size for unknown types
-		return 256
-	}
-}
-
-func (c *Cache) calculateHitRate() float64 {
-	hits := atomic.LoadInt64(&c.hits)
-	misses := atomic.LoadInt64(&c.misses)
-	total := hits + misses
-	if total == 0 {
-		return 0
-	}
-	return float64(hits) / float64(total)
-}
-
-func (c *Cache) startCleanupRoutine() {
-	c.wg.Add(1)
-	go func() {
-		defer c.wg.Done()
-		ticker := time.NewTicker(c.config.CleanupInterval)
-		defer ticker.Stop()
-
-		for {
-			select {
-			case <-ticker.C:
-				c.Cleanup()
-			case <-c.stopCleanup:
-				return
-			case <-c.ctx.Done():
-				return
-			}
-		}
-	}()
-}
-
-// noOpLogger provides a no-op logger implementation
-type noOpLogger struct{}
-
-func (l *noOpLogger) Debug(msg string)                                {}
-func (l *noOpLogger) Debugf(format string, args ...interface{})       {}
-func (l *noOpLogger) Info(msg string)                                 {}
-func (l *noOpLogger) Infof(format string, args ...interface{})        {}
-func (l *noOpLogger) Error(msg string)                                {}
-func (l *noOpLogger) Errorf(format string, args ...interface{})       {}
-func (l *noOpLogger) Warn(msg string)                                 {}
-func (l *noOpLogger) Warnf(format string, args ...interface{})        {}
-func (l *noOpLogger) Fatal(msg string)                                {}
-func (l *noOpLogger) Fatalf(format string, args ...interface{})       {}
-func (l *noOpLogger) WithField(key string, value interface{}) Logger  { return l }
-func (l *noOpLogger) WithFields(fields map[string]interface{}) Logger { return l }

internal/cache/compat.go

@@ -1,280 +0,0 @@
-// Package cache provides high-performance caching implementations for OIDC tokens, metadata, and JWKs.
-// It includes compatibility wrappers for backward compatibility with existing cache interfaces.
-package cache
-
-import (
-	"context"
-	"net/http"
-	"sync"
-	"time"
-)
-
-// CompatibilityWrapper provides backward compatibility with existing cache interfaces
-type CompatibilityWrapper struct {
-	cache *Cache
-}
-
-// NewCompatibilityWrapper creates a new compatibility wrapper
-func NewCompatibilityWrapper(cache *Cache) *CompatibilityWrapper {
-	return &CompatibilityWrapper{cache: cache}
-}
-
-// CacheInterface implementation for backward compatibility
-func (c *CompatibilityWrapper) Set(key string, value interface{}, ttl time.Duration) {
-	_ = c.cache.Set(key, value, ttl)
-}
-
-func (c *CompatibilityWrapper) Get(key string) (interface{}, bool) {
-	return c.cache.Get(key)
-}
-
-func (c *CompatibilityWrapper) Delete(key string) {
-	c.cache.Delete(key)
-}
-
-func (c *CompatibilityWrapper) SetMaxSize(size int) {
-	c.cache.SetMaxSize(size)
-}
-
-func (c *CompatibilityWrapper) Size() int {
-	return c.cache.Size()
-}
-
-func (c *CompatibilityWrapper) Clear() {
-	c.cache.Clear()
-}
-
-func (c *CompatibilityWrapper) Cleanup() {
-	c.cache.Cleanup()
-}
-
-func (c *CompatibilityWrapper) Close() {
-	_ = c.cache.Close()
-}
-
-func (c *CompatibilityWrapper) GetStats() map[string]interface{} {
-	return c.cache.GetStats()
-}
-
-// UniversalCacheCompat provides compatibility with the old UniversalCache
-type UniversalCacheCompat struct {
-	*Cache
-}
-
-// NewUniversalCacheCompat creates a compatibility wrapper for UniversalCache
-func NewUniversalCacheCompat(config Config) *UniversalCacheCompat {
-	return &UniversalCacheCompat{
-		Cache: New(config),
-	}
-}
-
-// Set wraps the cache Set method for compatibility
-func (u *UniversalCacheCompat) Set(key string, value interface{}, ttl time.Duration) error {
-	return u.Cache.Set(key, value, ttl)
-}
-
-// TokenCacheCompat provides compatibility with the old TokenCache
-type TokenCacheCompat struct {
-	cache *TokenCache
-}
-
-// NewTokenCacheCompat creates a compatibility wrapper for TokenCache
-func NewTokenCacheCompat() *TokenCacheCompat {
-	manager := GetGlobalManager(nil)
-	return &TokenCacheCompat{
-		cache: manager.GetTokenCache(),
-	}
-}
-
-// Set stores parsed token claims
-func (t *TokenCacheCompat) Set(token string, claims map[string]interface{}, expiration time.Duration) {
-	_ = t.cache.Set(token, claims, expiration)
-}
-
-// Get retrieves cached claims for a token
-func (t *TokenCacheCompat) Get(token string) (map[string]interface{}, bool) {
-	return t.cache.Get(token)
-}
-
-// Delete removes a token from cache
-func (t *TokenCacheCompat) Delete(token string) {
-	t.cache.Delete(token)
-}
-
-// MetadataCacheCompat provides compatibility with the old MetadataCache
-type MetadataCacheCompat struct {
-	cache  *MetadataCache
-	logger Logger
-	wg     *sync.WaitGroup
-}
-
-// NewMetadataCacheCompat creates a compatibility wrapper for MetadataCache
-func NewMetadataCacheCompat(wg *sync.WaitGroup) *MetadataCacheCompat {
-	manager := GetGlobalManager(nil)
-	return &MetadataCacheCompat{
-		cache:  manager.GetMetadataCache(),
-		logger: manager.logger,
-		wg:     wg,
-	}
-}
-
-// NewMetadataCacheCompatWithLogger creates a MetadataCache with specific logger
-func NewMetadataCacheCompatWithLogger(wg *sync.WaitGroup, logger Logger) *MetadataCacheCompat {
-	manager := GetGlobalManager(logger)
-	return &MetadataCacheCompat{
-		cache:  manager.GetMetadataCache(),
-		logger: logger,
-		wg:     wg,
-	}
-}
-
-// Set stores provider metadata with a TTL
-func (m *MetadataCacheCompat) Set(providerURL string, metadata *ProviderMetadata, ttl time.Duration) error {
-	return m.cache.Set(providerURL, metadata, ttl)
-}
-
-// Get retrieves provider metadata from cache
-func (m *MetadataCacheCompat) Get(providerURL string) (*ProviderMetadata, bool) {
-	return m.cache.Get(providerURL)
-}
-
-// Delete removes provider metadata
-func (m *MetadataCacheCompat) Delete(providerURL string) {
-	m.cache.Delete(providerURL)
-}
-
-// GetWithGracePeriod retrieves metadata with grace period support
-func (m *MetadataCacheCompat) GetWithGracePeriod(ctx context.Context, providerURL string) (*ProviderMetadata, bool) {
-	// For compatibility, just use regular Get
-	return m.cache.Get(providerURL)
-}
-
-// JWKCacheCompat provides compatibility with the old JWKCache
-type JWKCacheCompat struct {
-	cache *JWKCache
-}
-
-// NewJWKCacheCompat creates a compatibility wrapper for JWKCache
-func NewJWKCacheCompat() *JWKCacheCompat {
-	manager := GetGlobalManager(nil)
-	return &JWKCacheCompat{
-		cache: manager.GetJWKCache(),
-	}
-}
-
-// GetJWKS retrieves JWKS from cache or fetches from the remote URL if not cached
-func (j *JWKCacheCompat) GetJWKS(ctx context.Context, jwksURL string, httpClient *http.Client) (*JWKSet, error) {
-	// Check cache first
-	if jwks, found := j.cache.Get(jwksURL); found {
-		return jwks, nil
-	}
-
-	// For compatibility, we don't fetch from remote - that should be done by the caller
-	return nil, nil
-}
-
-// Set stores a JWK set
-func (j *JWKCacheCompat) Set(jwksURL string, jwks *JWKSet, ttl time.Duration) error {
-	return j.cache.Set(jwksURL, jwks, ttl)
-}
-
-// Cleanup is a no-op for compatibility
-func (j *JWKCacheCompat) Cleanup() {}
-
-// Close is a no-op for compatibility
-func (j *JWKCacheCompat) Close() {}
-
-// CacheManagerCompat provides compatibility with the old CacheManager
-type CacheManagerCompat struct {
-	manager *Manager
-	mu      sync.RWMutex
-}
-
-// GetGlobalCacheManagerCompat returns a singleton CacheManager instance
-func GetGlobalCacheManagerCompat(wg *sync.WaitGroup) *CacheManagerCompat {
-	return &CacheManagerCompat{
-		manager: GetGlobalManager(nil),
-	}
-}
-
-// GetSharedTokenBlacklist returns the shared token blacklist cache
-func (c *CacheManagerCompat) GetSharedTokenBlacklist() *CompatibilityWrapper {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	return NewCompatibilityWrapper(c.manager.GetRawTokenCache())
-}
-
-// GetSharedTokenCache returns the shared token cache
-func (c *CacheManagerCompat) GetSharedTokenCache() *TokenCacheCompat {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	return NewTokenCacheCompat()
-}
-
-// GetSharedMetadataCache returns the shared metadata cache
-func (c *CacheManagerCompat) GetSharedMetadataCache() *MetadataCacheCompat {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	return NewMetadataCacheCompat(nil)
-}
-
-// GetSharedJWKCache returns the shared JWK cache
-func (c *CacheManagerCompat) GetSharedJWKCache() *JWKCacheCompat {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	return NewJWKCacheCompat()
-}
-
-// Close gracefully shuts down all cache components
-func (c *CacheManagerCompat) Close() error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.manager.Close()
-}
-
-// UniversalCacheManagerCompat provides compatibility with UniversalCacheManager
-type UniversalCacheManagerCompat struct {
-	manager *Manager
-	logger  Logger
-}
-
-// GetUniversalCacheManagerCompat returns the global cache manager
-func GetUniversalCacheManagerCompat(logger Logger) *UniversalCacheManagerCompat {
-	return &UniversalCacheManagerCompat{
-		manager: GetGlobalManager(logger),
-		logger:  logger,
-	}
-}
-
-// GetTokenCache returns the token cache
-func (u *UniversalCacheManagerCompat) GetTokenCache() *UniversalCacheCompat {
-	return &UniversalCacheCompat{
-		Cache: u.manager.GetRawTokenCache(),
-	}
-}
-
-// GetMetadataCache returns the metadata cache
-func (u *UniversalCacheManagerCompat) GetMetadataCache() *UniversalCacheCompat {
-	return &UniversalCacheCompat{
-		Cache: u.manager.GetRawMetadataCache(),
-	}
-}
-
-// GetJWKCache returns the JWK cache
-func (u *UniversalCacheManagerCompat) GetJWKCache() *UniversalCacheCompat {
-	return &UniversalCacheCompat{
-		Cache: u.manager.GetRawJWKCache(),
-	}
-}
-
-// GetBlacklistCache returns the blacklist cache (uses token cache)
-func (u *UniversalCacheManagerCompat) GetBlacklistCache() *UniversalCacheCompat {
-	return &UniversalCacheCompat{
-		Cache: u.manager.GetRawTokenCache(),
-	}
-}
-
-// Close shuts down the cache manager
-func (u *UniversalCacheManagerCompat) Close() error {
-	return u.manager.Close()
-}

internal/cache/log_redact.go

@@ -1,22 +0,0 @@
-// Package cache provides the in-memory cache implementation for the Traefik
-// OIDC plugin.
-package cache
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-)
-
-// redactKey returns a short, deterministic hash prefix of a cache key for use
-// in debug/info log lines. Cache keys may include raw access / refresh / id
-// tokens (callers pass arbitrary strings) and CodeQL flags `key=%s`
-// formatters as a clear-text-logging sink for HTTP-header-sourced taint.
-// The hash preserves uniqueness in logs (same key → same hash) while keeping
-// the raw value out of disk-resident log streams.
-func redactKey(key string) string {
-	if key == "" {
-		return "(empty)"
-	}
-	sum := sha256.Sum256([]byte(key))
-	return hex.EncodeToString(sum[:4])
-}

internal/cache/manager.go

@@ -1,279 +0,0 @@
-package cache
-
-import (
-	"sync"
-	"time"
-)
-
-// Manager manages multiple cache instances with singleton pattern
-type Manager struct {
-	logger        Logger
-	tokenCache    *Cache
-	metadataCache *Cache
-	jwkCache      *Cache
-	sessionCache  *Cache
-	generalCache  *Cache
-	typedToken    *TokenCache
-	typedMetadata *MetadataCache
-	typedJWK      *JWKCache
-	typedSession  *SessionCache
-	mu            sync.RWMutex
-}
-
-var (
-	globalManager     *Manager
-	globalManagerOnce sync.Once
-)
-
-// GetGlobalManager returns the singleton cache manager instance
-func GetGlobalManager(logger Logger) *Manager {
-	globalManagerOnce.Do(func() {
-		globalManager = NewManager(logger)
-	})
-	return globalManager
-}
-
-// NewManager creates a new cache manager
-func NewManager(logger Logger) *Manager {
-	if logger == nil {
-		logger = &noOpLogger{}
-	}
-
-	m := &Manager{
-		logger: logger,
-	}
-
-	// Initialize core caches with appropriate configurations
-	m.initializeCaches()
-
-	return m
-}
-
-// initializeCaches creates all cache instances with appropriate configurations
-func (m *Manager) initializeCaches() {
-	// Token cache configuration
-	tokenConfig := Config{
-		Type:              TypeToken,
-		MaxSize:           5000,
-		MaxMemoryBytes:    32 * 1024 * 1024, // 32MB
-		DefaultTTL:        1 * time.Hour,
-		CleanupInterval:   5 * time.Minute,
-		EnableAutoCleanup: true,
-		EnableMemoryLimit: true,
-		EnableMetrics:     true,
-		Logger:            m.logger,
-		TokenConfig: &TokenConfig{
-			BlacklistTTL:        24 * time.Hour,
-			RefreshTokenTTL:     7 * 24 * time.Hour,
-			EnableTokenRotation: true,
-		},
-	}
-	m.tokenCache = New(tokenConfig)
-	m.typedToken = NewTokenCache(m.tokenCache)
-
-	// Metadata cache configuration
-	metadataConfig := Config{
-		Type:              TypeMetadata,
-		MaxSize:           100,
-		MaxMemoryBytes:    10 * 1024 * 1024, // 10MB
-		DefaultTTL:        24 * time.Hour,
-		CleanupInterval:   30 * time.Minute,
-		EnableAutoCleanup: true,
-		EnableMemoryLimit: true,
-		EnableMetrics:     true,
-		Logger:            m.logger,
-		MetadataConfig: &MetadataConfig{
-			GracePeriod:                    5 * time.Minute,
-			ExtendedGracePeriod:            15 * time.Minute,
-			MaxGracePeriod:                 1 * time.Hour,
-			SecurityCriticalMaxGracePeriod: 30 * time.Minute,
-			SecurityCriticalFields:         []string{"issuer", "jwks_uri"},
-		},
-	}
-	m.metadataCache = New(metadataConfig)
-	m.typedMetadata = NewMetadataCache(m.metadataCache, *metadataConfig.MetadataConfig)
-
-	// JWK cache configuration
-	jwkConfig := Config{
-		Type:              TypeJWK,
-		MaxSize:           50,
-		MaxMemoryBytes:    5 * 1024 * 1024, // 5MB
-		DefaultTTL:        1 * time.Hour,
-		CleanupInterval:   10 * time.Minute,
-		EnableAutoCleanup: true,
-		EnableMemoryLimit: true,
-		EnableMetrics:     true,
-		Logger:            m.logger,
-		JWKConfig: &JWKConfig{
-			RefreshInterval: 1 * time.Hour,
-			MinRefreshTime:  5 * time.Minute,
-			MaxKeyAge:       24 * time.Hour,
-		},
-	}
-	m.jwkCache = New(jwkConfig)
-	m.typedJWK = NewJWKCache(m.jwkCache)
-
-	// Session cache configuration
-	sessionConfig := Config{
-		Type:              TypeSession,
-		MaxSize:           10000,
-		MaxMemoryBytes:    64 * 1024 * 1024, // 64MB
-		DefaultTTL:        30 * time.Minute,
-		CleanupInterval:   5 * time.Minute,
-		EnableAutoCleanup: true,
-		EnableMemoryLimit: true,
-		EnableMetrics:     true,
-		Logger:            m.logger,
-	}
-	m.sessionCache = New(sessionConfig)
-	m.typedSession = NewSessionCache(m.sessionCache)
-
-	// General cache configuration
-	generalConfig := Config{
-		Type:              TypeGeneral,
-		MaxSize:           1000,
-		MaxMemoryBytes:    16 * 1024 * 1024, // 16MB
-		DefaultTTL:        10 * time.Minute,
-		CleanupInterval:   5 * time.Minute,
-		EnableAutoCleanup: true,
-		EnableMemoryLimit: true,
-		EnableMetrics:     true,
-		Logger:            m.logger,
-	}
-	m.generalCache = New(generalConfig)
-}
-
-// GetTokenCache returns the token cache instance
-func (m *Manager) GetTokenCache() *TokenCache {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-	return m.typedToken
-}
-
-// GetMetadataCache returns the metadata cache instance
-func (m *Manager) GetMetadataCache() *MetadataCache {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-	return m.typedMetadata
-}
-
-// GetJWKCache returns the JWK cache instance
-func (m *Manager) GetJWKCache() *JWKCache {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-	return m.typedJWK
-}
-
-// GetSessionCache returns the session cache instance
-func (m *Manager) GetSessionCache() *SessionCache {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-	return m.typedSession
-}
-
-// GetGeneralCache returns the general cache instance
-func (m *Manager) GetGeneralCache() *Cache {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-	return m.generalCache
-}
-
-// GetRawTokenCache returns the raw token cache for compatibility
-func (m *Manager) GetRawTokenCache() *Cache {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-	return m.tokenCache
-}
-
-// GetRawMetadataCache returns the raw metadata cache for compatibility
-func (m *Manager) GetRawMetadataCache() *Cache {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-	return m.metadataCache
-}
-
-// GetRawJWKCache returns the raw JWK cache for compatibility
-func (m *Manager) GetRawJWKCache() *Cache {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-	return m.jwkCache
-}
-
-// GetStats returns statistics for all caches
-func (m *Manager) GetStats() map[string]map[string]interface{} {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-
-	return map[string]map[string]interface{}{
-		"token":    m.tokenCache.GetStats(),
-		"metadata": m.metadataCache.GetStats(),
-		"jwk":      m.jwkCache.GetStats(),
-		"session":  m.sessionCache.GetStats(),
-		"general":  m.generalCache.GetStats(),
-	}
-}
-
-// ClearAll clears all cache instances
-func (m *Manager) ClearAll() {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	m.tokenCache.Clear()
-	m.metadataCache.Clear()
-	m.jwkCache.Clear()
-	m.sessionCache.Clear()
-	m.generalCache.Clear()
-}
-
-// Close gracefully shuts down all cache instances
-func (m *Manager) Close() error {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	var firstErr error
-
-	if err := m.tokenCache.Close(); err != nil {
-		firstErr = err
-	}
-	if err := m.metadataCache.Close(); err != nil && firstErr == nil {
-		firstErr = err
-	}
-	if err := m.jwkCache.Close(); err != nil && firstErr == nil {
-		firstErr = err
-	}
-	if err := m.sessionCache.Close(); err != nil && firstErr == nil {
-		firstErr = err
-	}
-	if err := m.generalCache.Close(); err != nil && firstErr == nil {
-		firstErr = err
-	}
-
-	return firstErr
-}
-
-// CleanupAll runs cleanup on all cache instances
-func (m *Manager) CleanupAll() {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-
-	m.tokenCache.Cleanup()
-	m.metadataCache.Cleanup()
-	m.jwkCache.Cleanup()
-	m.sessionCache.Cleanup()
-	m.generalCache.Cleanup()
-}
-
-// SetLogger updates the logger for all caches
-func (m *Manager) SetLogger(logger Logger) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	m.logger = logger
-	if logger != nil {
-		m.tokenCache.logger = logger
-		m.metadataCache.logger = logger
-		m.jwkCache.logger = logger
-		m.sessionCache.logger = logger
-		m.generalCache.logger = logger
-	}
-}

internal/cache/resilience/circuit_breaker.go

@@ -132,7 +132,15 @@ func (cb *CircuitBreaker) AllowRequest() bool {
 
 		if shouldRetry {
 			cb.setState(StateHalfOpen)
-			return true
+			// Count this probe toward the half-open gate. Previously the
+			// open→half-open transition returned true without incrementing
+			// halfOpenRequests, so N goroutines arriving at the cooldown
+			// simultaneously all transitioned and passed as an unbounded
+			// burst (the half-open branch below is only reached by
+			// requests that race in after the first transition) (R152).
+			current := cb.halfOpenRequests.Add(1)
+			// int64 comparison: narrowing HalfOpenMaxRequests to int32 could wrap.
+			return int64(current) <= int64(cb.config.HalfOpenMaxRequests)
 		}
 		return false
 

internal/cache/resilience/circuit_breaker_backend.go

@@ -14,6 +14,17 @@ type CircuitBreakerBackend struct {
 	cb      *CircuitBreaker
 }
 
+// backendSetNXer is the optional distributed check-and-set primitive a
+// wrapped backend can provide (backends.RedisBackend does, via Redis SET key
+// value NX PX <ttl-ms>). Declared locally, matching by method set rather
+// than by name, because backends.CacheBackend itself does not require it —
+// only UniversalCache.SetIfAbsent (FIX-17) needs it, and widening
+// CacheBackend would force every implementer to add a method only that one
+// caller uses.
+type backendSetNXer interface {
+	SetNX(ctx context.Context, key string, value []byte, ttl time.Duration) (bool, error)
+}
+
 // NewCircuitBreakerBackend creates a new circuit breaker wrapped backend
 func NewCircuitBreakerBackend(b backends.CacheBackend, config *CircuitBreakerConfig) backends.CacheBackend {
 	if config == nil {
@@ -101,6 +112,34 @@ func (c *CircuitBreakerBackend) Clear(ctx context.Context) error {
 	return err
 }
 
+// SetNX forwards to the wrapped backend's SetNX when it provides one,
+// through the same circuit-breaker accounting as every other operation.
+// Round-2 fix for FIX-17's cross-replica gap: without this passthrough,
+// UniversalCache.SetIfAbsent's optional-interface type assertion against a
+// CircuitBreakerBackend-wrapped Redis backend always failed, silently
+// degrading the backchannel-logout jti replay check to a per-process-only
+// guarantee for any deployment with enableCircuitBreaker on (recommended in
+// docs/REDIS.md). When the wrapped backend does not implement SetNX at all,
+// reports backends.ErrSetNXUnsupported rather than guessing.
+func (c *CircuitBreakerBackend) SetNX(ctx context.Context, key string, value []byte, ttl time.Duration) (bool, error) {
+	nx, ok := c.backend.(backendSetNXer)
+	if !ok {
+		return false, backends.ErrSetNXUnsupported
+	}
+
+	if !c.cb.AllowRequest() {
+		return false, backends.ErrCircuitOpen
+	}
+
+	claimed, err := nx.SetNX(ctx, key, value, ttl)
+	if err == nil {
+		c.cb.RecordSuccess()
+	} else {
+		c.cb.RecordFailure()
+	}
+	return claimed, err
+}
+
 // GetStats returns statistics including circuit breaker state
 func (c *CircuitBreakerBackend) GetStats() map[string]interface{} {
 	stats := c.backend.GetStats()

internal/cache/resilience/circuit_breaker_half_open_limit_test.go

@@ -0,0 +1,32 @@
+package resilience
+
+import (
+	"math"
+	"strconv"
+	"testing"
+	"time"
+)
+
+// TestHalfOpenProbeLargeHalfOpenMaxRequests pins the gosec G115 fix: the
+// half-open gate compared against int32(HalfOpenMaxRequests), so a value
+// above MaxInt32 wrapped negative and the first half-open probe was rejected.
+// The short sleep waits out the breaker's own open Timeout.
+func TestHalfOpenProbeLargeHalfOpenMaxRequests(t *testing.T) {
+	if strconv.IntSize < 64 {
+		t.Skip("int cannot exceed MaxInt32 on this platform")
+	}
+	cb := NewCircuitBreaker(&CircuitBreakerConfig{
+		MaxFailures:         1,
+		Timeout:             time.Millisecond,
+		HalfOpenMaxRequests: math.MaxInt32 + 1,
+		ResetTimeout:        time.Second,
+	})
+	cb.RecordFailure()
+	if cb.GetState() != StateOpen {
+		t.Fatalf("state = %v, want open after MaxFailures", cb.GetState())
+	}
+	time.Sleep(20 * time.Millisecond)
+	if !cb.AllowRequest() {
+		t.Fatal("first half-open probe rejected although HalfOpenMaxRequests is large")
+	}
+}

internal/cache/resilience/health_check_backend.go

@@ -64,6 +64,26 @@ func (h *HealthCheckBackend) Get(ctx context.Context, key string) ([]byte, time.
 	return value, ttl, exists, err
 }
 
+// SetNX forwards to the wrapped backend's SetNX when it provides one and
+// tracks health from the outcome. Round-2 fix for FIX-17's cross-replica
+// gap: without this passthrough, UniversalCache.SetIfAbsent's
+// optional-interface type assertion against a HealthCheckBackend-wrapped
+// Redis backend always failed, silently degrading the backchannel-logout
+// jti replay check to a per-process-only guarantee for any deployment with
+// enableHealthCheck on (recommended in docs/REDIS.md). When the wrapped
+// backend does not implement SetNX at all, reports
+// backends.ErrSetNXUnsupported rather than guessing.
+func (h *HealthCheckBackend) SetNX(ctx context.Context, key string, value []byte, ttl time.Duration) (bool, error) {
+	nx, ok := h.backend.(backendSetNXer)
+	if !ok {
+		return false, backends.ErrSetNXUnsupported
+	}
+
+	claimed, err := nx.SetNX(ctx, key, value, ttl)
+	h.recordResult(err == nil)
+	return claimed, err
+}
+
 // Delete removes a key and tracks health
 func (h *HealthCheckBackend) Delete(ctx context.Context, key string) (bool, error) {
 	deleted, err := h.backend.Delete(ctx, key)

internal/cache/resilience/health_check_backend_test.go

@@ -0,0 +1,142 @@
+package resilience
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// fakeBackend is a minimal CacheBackend whose Ping can be toggled to fail,
+// so HealthCheckBackend's status transition can be driven deterministically.
+type fakeBackend struct {
+	mu   sync.Mutex
+	data map[string][]byte
+	fail atomic.Bool
+}
+
+func newFakeBackend() *fakeBackend {
+	return &fakeBackend{data: make(map[string][]byte)}
+}
+
+func (f *fakeBackend) Set(_ context.Context, key string, value []byte, _ time.Duration) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.data[key] = value
+	return nil
+}
+
+func (f *fakeBackend) Get(_ context.Context, key string) ([]byte, time.Duration, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	v, ok := f.data[key]
+	return v, 0, ok, nil
+}
+
+func (f *fakeBackend) Delete(_ context.Context, key string) (bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	_, ok := f.data[key]
+	delete(f.data, key)
+	return ok, nil
+}
+
+func (f *fakeBackend) Exists(_ context.Context, key string) (bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	_, ok := f.data[key]
+	return ok, nil
+}
+
+func (f *fakeBackend) Clear(_ context.Context) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.data = make(map[string][]byte)
+	return nil
+}
+
+func (f *fakeBackend) GetStats() map[string]interface{} { return map[string]interface{}{} }
+
+func (f *fakeBackend) Close() error { return nil }
+
+func (f *fakeBackend) Ping(_ context.Context) error {
+	if f.fail.Load() {
+		return errors.New("injected ping failure")
+	}
+	return nil
+}
+
+// TestHealthCheckBackendTransitions covers the previously 0%-covered
+// HealthCheckBackend wrapper: optimistic start, eventual transition to
+// unhealthy under backend failures, and recovery once the backend returns.
+func TestHealthCheckBackendTransitions(t *testing.T) {
+	bt := newFakeBackend()
+	cfg := &HealthCheckConfig{
+		CheckInterval:      5 * time.Millisecond,
+		Timeout:            20 * time.Millisecond,
+		HealthyThreshold:   1,
+		UnhealthyThreshold: 2,
+	}
+	hc := NewHealthCheckBackend(bt, cfg).(*HealthCheckBackend)
+	t.Cleanup(func() { _ = hc.Close() })
+
+	// Optimistic start: healthy before any check runs.
+	if !hc.IsHealthy() {
+		t.Fatal("expected optimistic healthy start")
+	}
+
+	// Delegation: Set/Get pass through the wrapper to the backend.
+	ctx := context.Background()
+	if err := hc.Set(ctx, "k", []byte("v"), time.Minute); err != nil {
+		t.Fatalf("Set through wrapper: %v", err)
+	}
+	if got, _, ok, _ := hc.Get(ctx, "k"); !ok || string(got) != "v" {
+		t.Fatalf("Get through wrapper returned ok=%v value=%q", ok, got)
+	}
+
+	// Fail the backend: the health loop must mark it unhealthy.
+	bt.fail.Store(true)
+	waitFor(t, 3*time.Second, "backend to become unhealthy", func() bool {
+		return !hc.IsHealthy()
+	})
+
+	// Restore the backend: it must recover to healthy.
+	bt.fail.Store(false)
+	waitFor(t, 3*time.Second, "backend to recover", hc.IsHealthy)
+
+	// Stats expose health state.
+	if _, ok := hc.GetStats()["health"]; !ok {
+		t.Fatal("expected health key in GetStats")
+	}
+
+	// Remaining delegation methods route through the wrapper cleanly.
+	if ok, err := hc.Exists(ctx, "k"); err != nil || !ok {
+		t.Fatalf("Exists through wrapper: ok=%v err=%v", ok, err)
+	}
+	if ok, err := hc.Delete(ctx, "k"); err != nil || !ok {
+		t.Fatalf("Delete through wrapper: ok=%v err=%v", ok, err)
+	}
+	if err := hc.Set(ctx, "k", []byte("v"), time.Minute); err != nil {
+		t.Fatalf("Set for Clear: %v", err)
+	}
+	if err := hc.Clear(ctx); err != nil {
+		t.Fatalf("Clear through wrapper: %v", err)
+	}
+	if err := hc.Ping(ctx); err != nil {
+		t.Fatalf("Ping through wrapper: %v", err)
+	}
+}
+
+func waitFor(t *testing.T, d time.Duration, what string, cond func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(d)
+	for time.Now().Before(deadline) {
+		if cond() {
+			return
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for %s", what)
+}

internal/cache/resilience/review_r152_test.go

@@ -0,0 +1,51 @@
+package resilience
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+// TestCircuitBreaker_HalfOpenGateNotExceeded guards the R152 fix to
+// AllowRequest: the open→half-open transition returned true without
+// incrementing halfOpenRequests, so the very probe that opens the
+// half-open window was free — allowing exactly one more request than
+// the configured gate (on a serial refusal loop: gate+1 pass). The
+// probe must be counted so cumulative half-open admissions stay
+// within HalfOpenMaxRequests.
+func TestCircuitBreaker_HalfOpenGateNotExceeded(t *testing.T) {
+	config := &CircuitBreakerConfig{
+		MaxFailures:         2,
+		Timeout:             50 * time.Millisecond,
+		HalfOpenMaxRequests: 2,
+	}
+	cb := NewCircuitBreaker(config)
+	ctx := context.Background()
+
+	// Open the circuit.
+	for i := 0; i < 2; i++ {
+		cb.Execute(ctx, func() error { return errors.New("boom") })
+	}
+	if cb.GetState() != StateOpen {
+		t.Fatal("expected open after failures")
+	}
+
+	time.Sleep(100 * time.Millisecond) // past timeout → cooldown expired
+
+	// Serially offer gate+overflow admission slots. The transition probe
+	// must count toward the gate; un-fixed code allows one extra.
+	allowed := 0
+	for i := 0; i < config.HalfOpenMaxRequests+5; i++ {
+		if !cb.AllowRequest() {
+			break
+		}
+		allowed++
+	}
+	if allowed > config.HalfOpenMaxRequests {
+		t.Fatalf("half-open gate exceeded: %d admitted, max %d", allowed, config.HalfOpenMaxRequests)
+	}
+	if allowed == 0 {
+		t.Fatal("at least one probe must be allowed once the cooldown expires")
+	}
+}

internal/cache/typed_cache.go

@@ -1,329 +0,0 @@
-package cache
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"time"
-
-	"github.com/lukaszraczylo/traefikoidc/internal/pool"
-)
-
-// TypedCache provides a type-safe wrapper around Cache for specific types
-type TypedCache[T any] struct {
-	cache  *Cache
-	prefix string
-}
-
-// NewTypedCache creates a new typed cache wrapper
-func NewTypedCache[T any](cache *Cache, prefix string) *TypedCache[T] {
-	return &TypedCache[T]{
-		cache:  cache,
-		prefix: prefix,
-	}
-}
-
-// Set stores a typed value
-func (tc *TypedCache[T]) Set(key string, value T, ttl time.Duration) error {
-	prefixedKey := tc.prefix + key
-	return tc.cache.Set(prefixedKey, value, ttl)
-}
-
-// Get retrieves a typed value
-func (tc *TypedCache[T]) Get(key string) (T, bool) {
-	var zero T
-	prefixedKey := tc.prefix + key
-
-	value, exists := tc.cache.Get(prefixedKey)
-	if !exists {
-		return zero, false
-	}
-
-	// Try direct type assertion first
-	if typedValue, ok := value.(T); ok {
-		return typedValue, true
-	}
-
-	// If that fails, try JSON marshaling/unmarshaling for complex types
-	// Use pooled buffer for encoding
-	pm := pool.Get()
-	buf := pm.GetBuffer(256)
-	defer pm.PutBuffer(buf)
-
-	encoder := pm.GetJSONEncoder(buf)
-	defer pm.PutJSONEncoder(encoder)
-
-	if err := encoder.Encode(value); err != nil {
-		return zero, false
-	}
-
-	// Decode using pooled decoder
-	var result T
-	decoder := pm.GetJSONDecoder(bytes.NewReader(buf.Bytes()))
-	defer pm.PutJSONDecoder(decoder)
-
-	if err := decoder.Decode(&result); err != nil {
-		return zero, false
-	}
-
-	return result, true
-}
-
-// Delete removes a typed value
-func (tc *TypedCache[T]) Delete(key string) {
-	prefixedKey := tc.prefix + key
-	tc.cache.Delete(prefixedKey)
-}
-
-// Clear removes all items with the prefix
-func (tc *TypedCache[T]) Clear() {
-	// Note: This clears the entire underlying cache
-	// In a production system, you might want to implement prefix-based clearing
-	tc.cache.Clear()
-}
-
-// Size returns the size of the underlying cache
-func (tc *TypedCache[T]) Size() int {
-	return tc.cache.Size()
-}
-
-// TokenCache provides specialized caching for JWT tokens
-type TokenCache struct {
-	cache *TypedCache[map[string]interface{}]
-}
-
-// NewTokenCache creates a new token cache
-func NewTokenCache(baseCache *Cache) *TokenCache {
-	return &TokenCache{
-		cache: NewTypedCache[map[string]interface{}](baseCache, "token:"),
-	}
-}
-
-// Set stores parsed token claims
-func (tc *TokenCache) Set(token string, claims map[string]interface{}, expiration time.Duration) error {
-	return tc.cache.Set(token, claims, expiration)
-}
-
-// Get retrieves cached claims for a token
-func (tc *TokenCache) Get(token string) (map[string]interface{}, bool) {
-	return tc.cache.Get(token)
-}
-
-// Delete removes a token from cache
-func (tc *TokenCache) Delete(token string) {
-	tc.cache.Delete(token)
-}
-
-// SetBlacklisted marks a token as blacklisted
-func (tc *TokenCache) SetBlacklisted(token string, ttl time.Duration) error {
-	blacklistKey := "blacklist:" + token
-	// Store blacklisted status as a map to match the type
-	blacklistData := map[string]interface{}{"blacklisted": true}
-	return tc.cache.Set(blacklistKey, blacklistData, ttl)
-}
-
-// IsBlacklisted checks if a token is blacklisted
-func (tc *TokenCache) IsBlacklisted(token string) bool {
-	blacklistKey := "blacklist:" + token
-	value, exists := tc.cache.Get(blacklistKey)
-	if !exists {
-		return false
-	}
-	// Check if the blacklist data indicates blacklisted status
-	if data, ok := value["blacklisted"]; ok {
-		blacklisted, _ := data.(bool)
-		return blacklisted
-	}
-	return false
-}
-
-// MetadataCache provides specialized caching for provider metadata
-type MetadataCache struct {
-	cache  *Cache
-	config MetadataConfig
-}
-
-// ProviderMetadata represents OIDC provider metadata
-type ProviderMetadata struct {
-	Issuer                string   `json:"issuer"`
-	AuthorizationEndpoint string   `json:"authorization_endpoint"`
-	TokenEndpoint         string   `json:"token_endpoint"`
-	UserInfoEndpoint      string   `json:"userinfo_endpoint"`
-	JWKSUri               string   `json:"jwks_uri"`
-	ScopesSupported       []string `json:"scopes_supported"`
-}
-
-// NewMetadataCache creates a new metadata cache
-func NewMetadataCache(baseCache *Cache, config MetadataConfig) *MetadataCache {
-	return &MetadataCache{
-		cache:  baseCache,
-		config: config,
-	}
-}
-
-// Set stores provider metadata with grace period support
-func (mc *MetadataCache) Set(providerURL string, metadata *ProviderMetadata, ttl time.Duration) error {
-	if metadata == nil {
-		return fmt.Errorf("metadata cannot be nil")
-	}
-
-	key := "metadata:" + providerURL
-
-	// Apply grace period if configured
-	if mc.config.GracePeriod > 0 {
-		ttl += mc.config.GracePeriod
-	}
-
-	// Store as JSON for consistency
-	data, err := json.Marshal(metadata)
-	if err != nil {
-		return fmt.Errorf("failed to marshal metadata: %w", err)
-	}
-
-	return mc.cache.Set(key, data, ttl)
-}
-
-// Get retrieves provider metadata from cache
-func (mc *MetadataCache) Get(providerURL string) (*ProviderMetadata, bool) {
-	key := "metadata:" + providerURL
-	value, exists := mc.cache.Get(key)
-	if !exists {
-		return nil, false
-	}
-
-	// Handle different value types
-	var data []byte
-	switch v := value.(type) {
-	case []byte:
-		data = v
-	case string:
-		data = []byte(v)
-	default:
-		return nil, false
-	}
-
-	var metadata ProviderMetadata
-	if err := json.Unmarshal(data, &metadata); err != nil {
-		return nil, false
-	}
-
-	return &metadata, true
-}
-
-// Delete removes provider metadata
-func (mc *MetadataCache) Delete(providerURL string) {
-	key := "metadata:" + providerURL
-	mc.cache.Delete(key)
-}
-
-// JWKCache provides specialized caching for JWK sets
-type JWKCache struct {
-	cache *Cache
-}
-
-// JWKSet represents a set of JSON Web Keys
-type JWKSet struct {
-	Keys []JWK `json:"keys"`
-}
-
-// JWK represents a JSON Web Key
-type JWK struct {
-	Kid string   `json:"kid"`
-	Kty string   `json:"kty"`
-	Use string   `json:"use"`
-	N   string   `json:"n"`
-	E   string   `json:"e"`
-	X5c []string `json:"x5c,omitempty"`
-}
-
-// NewJWKCache creates a new JWK cache
-func NewJWKCache(baseCache *Cache) *JWKCache {
-	return &JWKCache{
-		cache: baseCache,
-	}
-}
-
-// Set stores a JWK set
-func (jc *JWKCache) Set(jwksURL string, jwks *JWKSet, ttl time.Duration) error {
-	if jwks == nil {
-		return fmt.Errorf("JWK set cannot be nil")
-	}
-
-	key := "jwk:" + jwksURL
-	return jc.cache.Set(key, jwks, ttl)
-}
-
-// Get retrieves a JWK set from cache
-func (jc *JWKCache) Get(jwksURL string) (*JWKSet, bool) {
-	key := "jwk:" + jwksURL
-	value, exists := jc.cache.Get(key)
-	if !exists {
-		return nil, false
-	}
-
-	jwks, ok := value.(*JWKSet)
-	if !ok {
-		// Try JSON conversion
-		data, err := json.Marshal(value)
-		if err != nil {
-			return nil, false
-		}
-
-		var result JWKSet
-		if err := json.Unmarshal(data, &result); err != nil {
-			return nil, false
-		}
-		return &result, true
-	}
-
-	return jwks, true
-}
-
-// Delete removes a JWK set from cache
-func (jc *JWKCache) Delete(jwksURL string) {
-	key := "jwk:" + jwksURL
-	jc.cache.Delete(key)
-}
-
-// SessionCache provides specialized caching for sessions
-type SessionCache struct {
-	cache *TypedCache[SessionData]
-}
-
-// SessionData represents session information
-type SessionData struct {
-	ExpiresAt    time.Time              `json:"expires_at"`
-	Claims       map[string]interface{} `json:"claims"`
-	ID           string                 `json:"id"`
-	UserID       string                 `json:"user_id"`
-	AccessToken  string                 `json:"access_token"`
-	RefreshToken string                 `json:"refresh_token"`
-}
-
-// NewSessionCache creates a new session cache
-func NewSessionCache(baseCache *Cache) *SessionCache {
-	return &SessionCache{
-		cache: NewTypedCache[SessionData](baseCache, "session:"),
-	}
-}
-
-// Set stores session data
-func (sc *SessionCache) Set(sessionID string, data SessionData, ttl time.Duration) error {
-	return sc.cache.Set(sessionID, data, ttl)
-}
-
-// Get retrieves session data
-func (sc *SessionCache) Get(sessionID string) (SessionData, bool) {
-	return sc.cache.Get(sessionID)
-}
-
-// Delete removes a session
-func (sc *SessionCache) Delete(sessionID string) {
-	sc.cache.Delete(sessionID)
-}
-
-// Exists checks if a session exists
-func (sc *SessionCache) Exists(sessionID string) bool {
-	_, exists := sc.cache.Get(sessionID)
-	return exists
-}

internal/cleanup/cleanup_test.go

@@ -879,6 +879,15 @@ func TestWorkerPool_GetMetrics(t *testing.T) {
 
 	wg.Wait()
 
+	// executeTask increments tasksProcessed in a deferred call that runs
+	// after the task returns, so a task's own wg.Done() can fire before its
+	// count is recorded. Wait for the metric instead of assuming wg.Wait()
+	// saw both increments.
+	deadline := time.Now().Add(2 * time.Second)
+	for atomic.LoadInt64(&pool.metrics.tasksProcessed) < 2 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+
 	metrics := pool.GetMetrics()
 
 	if metrics["workers"].(int) != 2 {

internal/compat/compatibility.go

@@ -1,320 +0,0 @@
-// Package compat provides backward compatibility layer during refactoring
-package compat
-
-import (
-	"fmt"
-	"reflect"
-	"sync"
-)
-
-// CompatibilityLayer provides backward compatibility during the migration
-type CompatibilityLayer struct {
-	mappings     map[string]string // old path -> new path
-	converters   map[string]Converter
-	deprecations map[string]string // deprecated field -> warning message
-	mu           sync.RWMutex
-}
-
-// Converter is a function that converts old value format to new format
-type Converter func(oldValue interface{}) (newValue interface{}, err error)
-
-// Global compatibility layer instance
-var (
-	layer     *CompatibilityLayer
-	layerOnce sync.Once
-)
-
-// GetLayer returns the global compatibility layer instance
-func GetLayer() *CompatibilityLayer {
-	layerOnce.Do(func() {
-		layer = &CompatibilityLayer{
-			mappings:     make(map[string]string),
-			converters:   make(map[string]Converter),
-			deprecations: make(map[string]string),
-		}
-		layer.initialize()
-	})
-	return layer
-}
-
-// initialize sets up default compatibility mappings
-func (c *CompatibilityLayer) initialize() {
-	// Configuration path mappings (old -> new)
-	c.RegisterMapping("ProviderURL", "Provider.IssuerURL")
-	c.RegisterMapping("ClientID", "Provider.ClientID")
-	c.RegisterMapping("ClientSecret", "Provider.ClientSecret")
-	c.RegisterMapping("CallbackURL", "Provider.RedirectURL")
-	c.RegisterMapping("LogoutURL", "Provider.LogoutURL")
-	c.RegisterMapping("SessionEncryptionKey", "Session.EncryptionKey")
-	c.RegisterMapping("Scopes", "Provider.Scopes")
-	c.RegisterMapping("RateLimit", "Middleware.RateLimit")
-	c.RegisterMapping("RefreshGracePeriodSeconds", "Token.RefreshGracePeriod")
-
-	// Redis configuration mappings
-	c.RegisterMapping("RedisAddr", "Redis.Addresses[0]")
-	c.RegisterMapping("RedisPassword", "Redis.Password")
-	c.RegisterMapping("RedisDB", "Redis.DB")
-
-	// Session configuration mappings
-	c.RegisterMapping("SessionName", "Session.Name")
-	c.RegisterMapping("SessionMaxAge", "Session.MaxAge")
-	c.RegisterMapping("SessionSecret", "Session.Secret")
-	c.RegisterMapping("SessionChunkSize", "Session.ChunkSize")
-
-	// Security configuration mappings
-	c.RegisterMapping("ForceHTTPS", "Security.ForceHTTPS")
-	c.RegisterMapping("EnablePKCE", "Security.EnablePKCE")
-	c.RegisterMapping("AllowedUsers", "Security.AllowedUsers")
-	c.RegisterMapping("AllowedUserDomains", "Security.AllowedUserDomains")
-	c.RegisterMapping("AllowedRolesAndGroups", "Security.AllowedRolesAndGroups")
-	c.RegisterMapping("ExcludedURLs", "Security.ExcludedURLs")
-
-	// Register converters for complex transformations
-	c.RegisterConverter("RefreshGracePeriodSeconds", func(oldValue interface{}) (interface{}, error) {
-		// Convert seconds (int) to duration string
-		if seconds, ok := oldValue.(int); ok {
-			return fmt.Sprintf("%ds", seconds), nil
-		}
-		return oldValue, nil
-	})
-
-	// Register deprecations
-	c.RegisterDeprecation("LogLevel", "LogLevel is deprecated, use Logging.Level instead")
-	c.RegisterDeprecation("HTTPClient", "HTTPClient is deprecated, configure via Transport settings")
-}
-
-// RegisterMapping registers a field mapping from old to new path
-func (c *CompatibilityLayer) RegisterMapping(oldPath, newPath string) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.mappings[oldPath] = newPath
-}
-
-// RegisterConverter registers a value converter for a field
-func (c *CompatibilityLayer) RegisterConverter(field string, converter Converter) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.converters[field] = converter
-}
-
-// RegisterDeprecation registers a deprecation warning for a field
-func (c *CompatibilityLayer) RegisterDeprecation(field, message string) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.deprecations[field] = message
-}
-
-// GetMapping returns the new path for an old configuration path
-func (c *CompatibilityLayer) GetMapping(oldPath string) (string, bool) {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	newPath, exists := c.mappings[oldPath]
-	return newPath, exists
-}
-
-// Convert applies conversion logic to a value
-func (c *CompatibilityLayer) Convert(field string, value interface{}) (interface{}, error) {
-	c.mu.RLock()
-	converter, exists := c.converters[field]
-	c.mu.RUnlock()
-
-	if !exists {
-		return value, nil
-	}
-
-	return converter(value)
-}
-
-// CheckDeprecation checks if a field is deprecated and returns warning message
-func (c *CompatibilityLayer) CheckDeprecation(field string) (string, bool) {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	message, deprecated := c.deprecations[field]
-	return message, deprecated
-}
-
-// MigrateMap migrates an old configuration map to new structure
-func (c *CompatibilityLayer) MigrateMap(oldConfig map[string]interface{}) (map[string]interface{}, []string) {
-	newConfig := make(map[string]interface{})
-	warnings := []string{}
-
-	for key, value := range oldConfig {
-		// Check for deprecation
-		if warning, deprecated := c.CheckDeprecation(key); deprecated {
-			warnings = append(warnings, warning)
-		}
-
-		// Get new path
-		newPath, hasMappming := c.GetMapping(key)
-		if !hasMappming {
-			// No mapping, use as-is
-			newConfig[key] = value
-			continue
-		}
-
-		// Apply converter if exists
-		convertedValue, err := c.Convert(key, value)
-		if err != nil {
-			warnings = append(warnings, fmt.Sprintf("Failed to convert %s: %v", key, err))
-			convertedValue = value
-		}
-
-		// Set value at new path
-		setNestedValue(newConfig, newPath, convertedValue)
-	}
-
-	return newConfig, warnings
-}
-
-// setNestedValue sets a value in a nested map structure using dot notation
-func setNestedValue(m map[string]interface{}, path string, value interface{}) {
-	keys := splitPath(path)
-	if len(keys) == 0 {
-		return
-	}
-
-	current := m
-	for i := 0; i < len(keys)-1; i++ {
-		key := keys[i]
-
-		// Check if this key has array notation
-		if isArrayPath(key) {
-			// Handle array notation (e.g., "Addresses[0]")
-			continue // Skip array handling for now, will be handled in actual migration
-		}
-
-		if _, exists := current[key]; !exists {
-			current[key] = make(map[string]interface{})
-		}
-
-		// Ensure it's a map
-		if next, ok := current[key].(map[string]interface{}); ok {
-			current = next
-		} else {
-			// Can't traverse further, create new map
-			newMap := make(map[string]interface{})
-			current[key] = newMap
-			current = newMap
-		}
-	}
-
-	// Set the final value
-	finalKey := keys[len(keys)-1]
-	current[finalKey] = value
-}
-
-// splitPath splits a configuration path into segments
-func splitPath(path string) []string {
-	segments := []string{}
-	current := ""
-
-	for i := 0; i < len(path); i++ {
-		if path[i] == '.' {
-			if current != "" {
-				segments = append(segments, current)
-				current = ""
-			}
-		} else {
-			current += string(path[i])
-		}
-	}
-
-	if current != "" {
-		segments = append(segments, current)
-	}
-
-	return segments
-}
-
-// isArrayPath checks if a path segment contains array notation
-func isArrayPath(segment string) bool {
-	for _, char := range segment {
-		if char == '[' {
-			return true
-		}
-	}
-	return false
-}
-
-// ConfigAdapter provides an adapter interface for old code to work with new config
-type ConfigAdapter struct {
-	newConfig interface{}
-	oldPaths  map[string]func() interface{}
-	mu        sync.RWMutex
-}
-
-// NewConfigAdapter creates a new configuration adapter
-func NewConfigAdapter(newConfig interface{}) *ConfigAdapter {
-	adapter := &ConfigAdapter{
-		newConfig: newConfig,
-		oldPaths:  make(map[string]func() interface{}),
-	}
-	return adapter
-}
-
-// RegisterGetter registers a getter function for an old path
-func (a *ConfigAdapter) RegisterGetter(oldPath string, getter func() interface{}) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	a.oldPaths[oldPath] = getter
-}
-
-// Get retrieves a value using old path notation
-func (a *ConfigAdapter) Get(oldPath string) (interface{}, bool) {
-	a.mu.RLock()
-	getter, exists := a.oldPaths[oldPath]
-	a.mu.RUnlock()
-
-	if !exists {
-		// Try to get from new config using reflection
-		return a.getFromNewConfig(oldPath)
-	}
-
-	return getter(), true
-}
-
-// getFromNewConfig attempts to retrieve value from new config using reflection
-func (a *ConfigAdapter) getFromNewConfig(path string) (interface{}, bool) {
-	// Check if there's a mapping for this path
-	compat := GetLayer()
-	if newPath, hasMappming := compat.GetMapping(path); hasMappming {
-		return a.getNestedField(newPath)
-	}
-
-	// Try direct access
-	return a.getNestedField(path)
-}
-
-// getNestedField retrieves a nested field value using reflection
-func (a *ConfigAdapter) getNestedField(path string) (interface{}, bool) {
-	segments := splitPath(path)
-	if len(segments) == 0 {
-		return nil, false
-	}
-
-	v := reflect.ValueOf(a.newConfig)
-
-	// Dereference pointer if needed
-	if v.Kind() == reflect.Ptr {
-		v = v.Elem()
-	}
-
-	for _, segment := range segments {
-		if v.Kind() != reflect.Struct {
-			return nil, false
-		}
-
-		field := v.FieldByName(segment)
-		if !field.IsValid() {
-			return nil, false
-		}
-
-		v = field
-	}
-
-	if v.IsValid() && v.CanInterface() {
-		return v.Interface(), true
-	}
-
-	return nil, false
-}

internal/compat/compatibility_test.go

@@ -1,495 +0,0 @@
-//go:build !yaegi
-
-package compat
-
-import (
-	"sync"
-	"testing"
-)
-
-func TestGetLayer_Singleton(t *testing.T) {
-	// Reset global state
-	layerOnce = sync.Once{}
-	layer = nil
-
-	layer1 := GetLayer()
-	layer2 := GetLayer()
-
-	if layer1 != layer2 {
-		t.Error("Expected GetLayer to return same instance")
-	}
-}
-
-func TestGetLayer_Initialize(t *testing.T) {
-	// Reset global state
-	layerOnce = sync.Once{}
-	layer = nil
-
-	l := GetLayer()
-
-	// Check default mappings exist
-	if _, exists := l.GetMapping("ProviderURL"); !exists {
-		t.Error("Expected ProviderURL mapping to exist")
-	}
-
-	if _, exists := l.GetMapping("ClientID"); !exists {
-		t.Error("Expected ClientID mapping to exist")
-	}
-
-	// Check deprecations exist
-	if _, deprecated := l.CheckDeprecation("LogLevel"); !deprecated {
-		t.Error("Expected LogLevel to be marked deprecated")
-	}
-}
-
-func TestRegisterMapping(t *testing.T) {
-	l := &CompatibilityLayer{
-		mappings:     make(map[string]string),
-		converters:   make(map[string]Converter),
-		deprecations: make(map[string]string),
-	}
-
-	l.RegisterMapping("OldField", "New.Field")
-
-	newPath, exists := l.GetMapping("OldField")
-	if !exists {
-		t.Error("Expected mapping to exist")
-	}
-
-	if newPath != "New.Field" {
-		t.Errorf("Expected 'New.Field', got '%s'", newPath)
-	}
-}
-
-func TestRegisterConverter(t *testing.T) {
-	l := &CompatibilityLayer{
-		mappings:     make(map[string]string),
-		converters:   make(map[string]Converter),
-		deprecations: make(map[string]string),
-	}
-
-	converter := func(oldValue interface{}) (interface{}, error) {
-		if str, ok := oldValue.(string); ok {
-			return str + "_converted", nil
-		}
-		return oldValue, nil
-	}
-
-	l.RegisterConverter("TestField", converter)
-
-	result, err := l.Convert("TestField", "test")
-	if err != nil {
-		t.Errorf("Unexpected error: %v", err)
-	}
-
-	if result != "test_converted" {
-		t.Errorf("Expected 'test_converted', got '%v'", result)
-	}
-}
-
-func TestConvert_NoConverter(t *testing.T) {
-	l := &CompatibilityLayer{
-		mappings:     make(map[string]string),
-		converters:   make(map[string]Converter),
-		deprecations: make(map[string]string),
-	}
-
-	// No converter registered
-	result, err := l.Convert("UnknownField", "value")
-	if err != nil {
-		t.Errorf("Expected no error, got %v", err)
-	}
-
-	if result != "value" {
-		t.Error("Expected original value when no converter exists")
-	}
-}
-
-func TestRegisterDeprecation(t *testing.T) {
-	l := &CompatibilityLayer{
-		mappings:     make(map[string]string),
-		converters:   make(map[string]Converter),
-		deprecations: make(map[string]string),
-	}
-
-	l.RegisterDeprecation("OldField", "This field is deprecated")
-
-	message, deprecated := l.CheckDeprecation("OldField")
-	if !deprecated {
-		t.Error("Expected field to be deprecated")
-	}
-
-	if message != "This field is deprecated" {
-		t.Errorf("Expected deprecation message, got '%s'", message)
-	}
-}
-
-func TestCheckDeprecation_NotDeprecated(t *testing.T) {
-	l := &CompatibilityLayer{
-		mappings:     make(map[string]string),
-		converters:   make(map[string]Converter),
-		deprecations: make(map[string]string),
-	}
-
-	_, deprecated := l.CheckDeprecation("NewField")
-	if deprecated {
-		t.Error("Expected field not to be deprecated")
-	}
-}
-
-func TestMigrateMap_BasicMapping(t *testing.T) {
-	l := &CompatibilityLayer{
-		mappings:     make(map[string]string),
-		converters:   make(map[string]Converter),
-		deprecations: make(map[string]string),
-	}
-
-	l.RegisterMapping("OldField", "New.Field")
-
-	oldConfig := map[string]interface{}{
-		"OldField": "value123",
-	}
-
-	newConfig, warnings := l.MigrateMap(oldConfig)
-
-	if len(warnings) != 0 {
-		t.Errorf("Expected no warnings, got %d", len(warnings))
-	}
-
-	// Check nested structure
-	if newMap, ok := newConfig["New"].(map[string]interface{}); ok {
-		if val, exists := newMap["Field"]; !exists || val != "value123" {
-			t.Errorf("Expected nested field value 'value123', got %v", val)
-		}
-	} else {
-		t.Error("Expected nested map structure")
-	}
-}
-
-func TestMigrateMap_WithDeprecation(t *testing.T) {
-	l := &CompatibilityLayer{
-		mappings:     make(map[string]string),
-		converters:   make(map[string]Converter),
-		deprecations: make(map[string]string),
-	}
-
-	l.RegisterMapping("DeprecatedField", "New.Field")
-	l.RegisterDeprecation("DeprecatedField", "Field is deprecated")
-
-	oldConfig := map[string]interface{}{
-		"DeprecatedField": "value",
-	}
-
-	_, warnings := l.MigrateMap(oldConfig)
-
-	if len(warnings) != 1 {
-		t.Errorf("Expected 1 warning, got %d", len(warnings))
-	}
-
-	if warnings[0] != "Field is deprecated" {
-		t.Errorf("Expected deprecation warning, got '%s'", warnings[0])
-	}
-}
-
-func TestMigrateMap_WithConverter(t *testing.T) {
-	l := &CompatibilityLayer{
-		mappings:     make(map[string]string),
-		converters:   make(map[string]Converter),
-		deprecations: make(map[string]string),
-	}
-
-	l.RegisterMapping("Seconds", "Duration")
-	l.RegisterConverter("Seconds", func(oldValue interface{}) (interface{}, error) {
-		if seconds, ok := oldValue.(int); ok {
-			return seconds * 1000, nil // Convert to milliseconds
-		}
-		return oldValue, nil
-	})
-
-	oldConfig := map[string]interface{}{
-		"Seconds": 60,
-	}
-
-	newConfig, _ := l.MigrateMap(oldConfig)
-
-	if val, ok := newConfig["Duration"]; !ok || val != 60000 {
-		t.Errorf("Expected Duration to be 60000, got %v", val)
-	}
-}
-
-func TestMigrateMap_NoMapping(t *testing.T) {
-	l := &CompatibilityLayer{
-		mappings:     make(map[string]string),
-		converters:   make(map[string]Converter),
-		deprecations: make(map[string]string),
-	}
-
-	oldConfig := map[string]interface{}{
-		"UnmappedField": "value",
-	}
-
-	newConfig, _ := l.MigrateMap(oldConfig)
-
-	if val, ok := newConfig["UnmappedField"]; !ok || val != "value" {
-		t.Error("Expected unmapped field to be copied as-is")
-	}
-}
-
-func TestSplitPath(t *testing.T) {
-	tests := []struct {
-		path     string
-		expected []string
-	}{
-		{"Simple", []string{"Simple"}},
-		{"Nested.Path", []string{"Nested", "Path"}},
-		{"Deep.Nested.Path", []string{"Deep", "Nested", "Path"}},
-		{"", []string{}},
-		{"Single", []string{"Single"}},
-	}
-
-	for _, tt := range tests {
-		result := splitPath(tt.path)
-		if len(result) != len(tt.expected) {
-			t.Errorf("Path '%s': expected %d segments, got %d", tt.path, len(tt.expected), len(result))
-			continue
-		}
-
-		for i, segment := range result {
-			if segment != tt.expected[i] {
-				t.Errorf("Path '%s': segment %d expected '%s', got '%s'", tt.path, i, tt.expected[i], segment)
-			}
-		}
-	}
-}
-
-func TestIsArrayPath(t *testing.T) {
-	tests := []struct {
-		segment  string
-		expected bool
-	}{
-		{"Addresses[0]", true},
-		{"Items[5]", true},
-		{"Simple", false},
-		{"NoArray", false},
-		{"[start", true},
-	}
-
-	for _, tt := range tests {
-		result := isArrayPath(tt.segment)
-		if result != tt.expected {
-			t.Errorf("Segment '%s': expected %v, got %v", tt.segment, tt.expected, result)
-		}
-	}
-}
-
-func TestSetNestedValue_SingleLevel(t *testing.T) {
-	m := make(map[string]interface{})
-	setNestedValue(m, "Field", "value")
-
-	if val, ok := m["Field"]; !ok || val != "value" {
-		t.Error("Expected single level field to be set")
-	}
-}
-
-func TestSetNestedValue_MultiLevel(t *testing.T) {
-	m := make(map[string]interface{})
-	setNestedValue(m, "Parent.Child", "value")
-
-	parent, ok := m["Parent"].(map[string]interface{})
-	if !ok {
-		t.Fatal("Expected Parent to be a map")
-	}
-
-	if val, ok := parent["Child"]; !ok || val != "value" {
-		t.Error("Expected nested field to be set")
-	}
-}
-
-func TestSetNestedValue_DeepNesting(t *testing.T) {
-	m := make(map[string]interface{})
-	setNestedValue(m, "Level1.Level2.Level3", "deep_value")
-
-	level1, ok := m["Level1"].(map[string]interface{})
-	if !ok {
-		t.Fatal("Expected Level1 to be a map")
-	}
-
-	level2, ok := level1["Level2"].(map[string]interface{})
-	if !ok {
-		t.Fatal("Expected Level2 to be a map")
-	}
-
-	if val, ok := level2["Level3"]; !ok || val != "deep_value" {
-		t.Error("Expected deeply nested field to be set")
-	}
-}
-
-// ConfigAdapter tests
-
-func TestNewConfigAdapter(t *testing.T) {
-	config := map[string]interface{}{"key": "value"}
-	adapter := NewConfigAdapter(config)
-
-	if adapter == nil {
-		t.Fatal("Expected adapter to be created")
-	}
-
-	if adapter.newConfig == nil {
-		t.Error("Expected config to be stored")
-	}
-}
-
-func TestConfigAdapter_RegisterGetter(t *testing.T) {
-	adapter := NewConfigAdapter(nil)
-
-	called := false
-	adapter.RegisterGetter("TestPath", func() interface{} {
-		called = true
-		return "test_value"
-	})
-
-	val, exists := adapter.Get("TestPath")
-	if !exists {
-		t.Error("Expected getter to exist")
-	}
-
-	if val != "test_value" {
-		t.Errorf("Expected 'test_value', got %v", val)
-	}
-
-	if !called {
-		t.Error("Expected getter function to be called")
-	}
-}
-
-type TestConfig struct {
-	Provider struct {
-		IssuerURL string
-		ClientID  string
-	}
-	Session struct {
-		EncryptionKey string
-	}
-}
-
-func TestConfigAdapter_GetNestedField(t *testing.T) {
-	config := &TestConfig{}
-	config.Provider.IssuerURL = "https://test.com"
-	config.Provider.ClientID = "test-client"
-	config.Session.EncryptionKey = "secret123"
-
-	adapter := NewConfigAdapter(config)
-
-	// Test nested field access
-	val, exists := adapter.getNestedField("Provider.IssuerURL")
-	if !exists {
-		t.Error("Expected field to exist")
-	}
-
-	if val != "https://test.com" {
-		t.Errorf("Expected 'https://test.com', got %v", val)
-	}
-
-	// Test another nested field
-	val2, exists2 := adapter.getNestedField("Provider.ClientID")
-	if !exists2 || val2 != "test-client" {
-		t.Error("Expected ClientID to be accessible")
-	}
-
-	// Test non-existent field
-	_, exists3 := adapter.getNestedField("NonExistent.Field")
-	if exists3 {
-		t.Error("Expected non-existent field to return false")
-	}
-}
-
-// Race condition tests
-
-func TestCompatibilityLayer_ConcurrentAccess(t *testing.T) {
-	l := &CompatibilityLayer{
-		mappings:     make(map[string]string),
-		converters:   make(map[string]Converter),
-		deprecations: make(map[string]string),
-	}
-
-	var wg sync.WaitGroup
-
-	// Concurrent registrations
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			l.RegisterMapping(string(rune('A'+idx%26)), "New.Field")
-		}(i)
-	}
-
-	// Concurrent reads
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			_, _ = l.GetMapping(string(rune('A' + idx%26)))
-		}(i)
-	}
-
-	wg.Wait()
-}
-
-func TestCompatibilityLayer_ConcurrentMigrate(t *testing.T) {
-	l := &CompatibilityLayer{
-		mappings:     make(map[string]string),
-		converters:   make(map[string]Converter),
-		deprecations: make(map[string]string),
-	}
-
-	l.RegisterMapping("OldField", "New.Field")
-
-	var wg sync.WaitGroup
-
-	// Concurrent migrations
-	for i := 0; i < 50; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			oldConfig := map[string]interface{}{
-				"OldField": "value",
-			}
-			_, _ = l.MigrateMap(oldConfig)
-		}()
-	}
-
-	wg.Wait()
-}
-
-func TestConfigAdapter_ConcurrentAccess(t *testing.T) {
-	config := &TestConfig{}
-	config.Provider.IssuerURL = "https://test.com"
-
-	adapter := NewConfigAdapter(config)
-
-	var wg sync.WaitGroup
-
-	// Concurrent getter registrations
-	for i := 0; i < 50; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			path := string(rune('A' + idx%26))
-			adapter.RegisterGetter(path, func() interface{} {
-				return "value"
-			})
-		}(i)
-	}
-
-	// Concurrent gets
-	for i := 0; i < 50; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			path := string(rune('A' + idx%26))
-			_, _ = adapter.Get(path)
-		}(i)
-	}
-
-	wg.Wait()
-}

internal/dcrstorage/file.go

@@ -78,15 +78,23 @@ func (s *FileStore) Save(ctx context.Context, providerURL string, creds *ClientR
 		return fmt.Errorf("failed to create credentials directory: %w", err)
 	}
 
-	data, err := json.MarshalIndent(creds, "", "  ")
+	data, err := json.MarshalIndent(creds, "", "  ") // #nosec G117 -- ClientSecret is the credential this store must persist (file mode 0600)
 	if err != nil {
 		return fmt.Errorf("failed to marshal credentials: %w", err)
 	}
 
-	// Write with restrictive permissions (owner read/write only)
-	if err := os.WriteFile(filePath, data, 0600); err != nil {
+	// Write with restrictive permissions (owner read/write only). Write to a
+	// temp file and atomically rename so a crash mid-write can never leave a
+	// truncated credentials file (which would force an avoidable client
+	// re-registration on the next start).
+	tmpPath := filePath + ".tmp"
+	if err := os.WriteFile(tmpPath, data, 0600); err != nil {
 		return fmt.Errorf("failed to write credentials file: %w", err)
 	}
+	if err := os.Rename(tmpPath, filePath); err != nil {
+		_ = os.Remove(tmpPath) // best-effort cleanup
+		return fmt.Errorf("failed to commit credentials file: %w", err)
+	}
 
 	s.logger.Debugf("Saved client credentials to %s", filePath)
 	return nil

internal/dcrstorage/redis.go

@@ -71,8 +71,8 @@ func (s *RedisStore) Save(ctx context.Context, providerURL string, creds *Client
 
 	key := s.makeKey(providerURL)
 
-	// Calculate TTL based on client_secret_expires_at if available
-	ttl := 30 * 24 * time.Hour // Default: 30 days
+	// Calculate TTL based on client_secret_expires_at if available.
+	var ttl time.Duration
 	if creds.ClientSecretExpiresAt > 0 {
 		expiresAt := time.Unix(creds.ClientSecretExpiresAt, 0)
 		ttl = time.Until(expiresAt)
@@ -83,10 +83,17 @@ func (s *RedisStore) Save(ctx context.Context, providerURL string, creds *Client
 		if ttl > time.Minute {
 			ttl -= time.Minute
 		}
+	} else {
+		// RFC 7591: client_secret_expires_at == 0 means the secret never
+		// expires (areCredentialsValid treats it as always-valid). Persist it
+		// effectively-permanently: a bounded TTL (previously 30 days) would
+		// evict a valid non-expiring credential mid-use, forcing a needless
+		// re-registration and orphaning the previous client at the IdP.
+		ttl = 100 * 365 * 24 * time.Hour
 	}
 
 	// Serialize credentials to JSON for storage
-	data, err := json.Marshal(creds)
+	data, err := json.Marshal(creds) // #nosec G117 -- ClientSecret is the credential this store must persist in Redis
 	if err != nil {
 		return fmt.Errorf("failed to marshal credentials: %w", err)
 	}

internal/dcrstorage/review_r116_test.go

@@ -0,0 +1,64 @@
+package dcrstorage
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+)
+
+// recordingCache captures the TTL each Set received, so a test can assert the
+// exact TTL semantic without depending on wall-clock time.
+type recordingCache struct {
+	mu      sync.Mutex
+	setTTLs map[string]time.Duration
+}
+
+func newRecordingCache() *recordingCache {
+	return &recordingCache{setTTLs: make(map[string]time.Duration)}
+}
+
+func (c *recordingCache) Get(key string) (any, bool) { return nil, false }
+func (c *recordingCache) Delete(key string)          {}
+func (c *recordingCache) Set(key string, value any, ttl time.Duration) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.setTTLs[key] = ttl
+	return nil
+}
+
+// TestRedisStore_NoExpiry_EffectivePermanent guards the R116 fix: an IdP that
+// reports client_secret_expires_at == 0 (RFC 7591: never expires) must be
+// persisted effectively-permanently. Previously such credentials were given a
+// 30-day default TTL, so a valid non-expiring credential was evicted mid-use,
+// forcing a needless re-registration and orphaning the old client at the IdP.
+func TestRedisStore_NoExpiry_EffectivePermanent(t *testing.T) {
+	t.Parallel()
+
+	cache := newRecordingCache()
+	store := NewRedisStore(cache, "", nil)
+
+	creds := &ClientRegistrationResponse{
+		ClientID:              "noexp",
+		ClientSecret:          "secret",
+		ClientSecretExpiresAt: 0, // never expires
+	}
+
+	if err := store.Save(context.Background(), "https://noexp.example.com", creds); err != nil {
+		t.Fatalf("failed to save: %v", err)
+	}
+
+	key := store.makeKey("https://noexp.example.com")
+	cache.mu.Lock()
+	ttl, ok := cache.setTTLs[key]
+	cache.mu.Unlock()
+	if !ok {
+		t.Fatal("expected credential to be written to cache")
+	}
+
+	// Effective permanence: well beyond any realistic rotation horizon. The
+	// old behavior was a 30-day default, so require >= 1 year.
+	if ttl < 365*24*time.Hour {
+		t.Fatalf("expected effectively-permanent TTL (>=1y) for exp==0, got %v", ttl)
+	}
+}

internal/dcrstorage/storage_test.go

@@ -2,6 +2,7 @@ package dcrstorage
 
 import (
 	"context"
+	"encoding/json"
 	"os"
 	"path/filepath"
 	"sync"
@@ -462,3 +463,69 @@ func TestFileStore_DirectoryCreation(t *testing.T) {
 		t.Error("Failed to load credentials from nested directory")
 	}
 }
+
+// TestFileStore_AtomicWrite guards the temp-file + rename implementation:
+// after a successful Save the committed file is a valid JSON document, no
+// ".tmp" scratch file is left behind, and the file mode is 0600.
+func TestFileStore_AtomicWrite(t *testing.T) {
+	t.Parallel()
+
+	tempDir := t.TempDir()
+	basePath := filepath.Join(tempDir, "credentials.json")
+	store := NewFileStore(basePath, nil)
+
+	ctx := context.Background()
+	providerURL := "https://auth.example.com"
+	creds := &ClientRegistrationResponse{
+		ClientID:     "atomic-client",
+		ClientSecret: "s3cret",
+	}
+
+	if err := store.Save(ctx, providerURL, creds); err != nil {
+		t.Fatalf("Save failed: %v", err)
+	}
+
+	filePath := store.GetFilePath(providerURL)
+
+	// No scratch file should remain.
+	if _, err := os.Stat(filePath + ".tmp"); !os.IsNotExist(err) {
+		t.Errorf("expected no %q scratch file after Save, stat err=%v", filePath+".tmp", err)
+	}
+
+	// Committed file must be valid JSON.
+	raw, err := os.ReadFile(filePath)
+	if err != nil {
+		t.Fatalf("failed to read committed file: %v", err)
+	}
+	var parsed ClientRegistrationResponse
+	if err := json.Unmarshal(raw, &parsed); err != nil {
+		t.Fatalf("committed file is not valid JSON: %v", err)
+	}
+	if parsed.ClientID != creds.ClientID || parsed.ClientSecret != creds.ClientSecret {
+		t.Errorf("committed content mismatch: got %q/%q", parsed.ClientID, parsed.ClientSecret)
+	}
+
+	// Mode should be owner read/write.
+	info, err := os.Stat(filePath)
+	if err != nil {
+		t.Fatalf("failed to stat committed file: %v", err)
+	}
+	if info.Mode().Perm() != 0600 {
+		t.Errorf("expected mode 0600, got %v", info.Mode().Perm())
+	}
+
+	// Overwriting an existing file must also be atomic and leave no residue.
+	if err := store.Save(ctx, providerURL, &ClientRegistrationResponse{ClientID: "updated"}); err != nil {
+		t.Fatalf("second Save failed: %v", err)
+	}
+	if _, err := os.Stat(filePath + ".tmp"); !os.IsNotExist(err) {
+		t.Errorf("expected no %q scratch file after overwrite", filePath+".tmp")
+	}
+	loaded, err := store.Load(ctx, providerURL)
+	if err != nil {
+		t.Fatalf("Load after overwrite failed: %v", err)
+	}
+	if loaded == nil || loaded.ClientID != "updated" {
+		t.Errorf("overwrite not reflected: %+v", loaded)
+	}
+}

internal/features/flags.go

@@ -1,235 +0,0 @@
-// Package features provides feature flag management for safe rollback during refactoring
-package features
-
-import (
-	"os"
-	"strings"
-	"sync"
-	"sync/atomic"
-)
-
-// FeatureFlag represents a feature flag for controlling new functionality
-type FeatureFlag struct {
-	name        string
-	description string
-	callbacks   []func(bool)
-	mu          sync.RWMutex
-	enabled     atomic.Bool
-}
-
-// FeatureManager manages all feature flags in the application
-type FeatureManager struct {
-	flags map[string]*FeatureFlag
-	mu    sync.RWMutex
-}
-
-var (
-	// Global feature manager instance
-	manager     *FeatureManager
-	managerOnce sync.Once
-)
-
-// Feature flag names
-const (
-	// UseUnifiedConfig enables the new unified configuration system
-	UseUnifiedConfig = "USE_UNIFIED_CONFIG"
-
-	// UseNewFileStructure enables the new modularized file structure
-	UseNewFileStructure = "USE_NEW_FILE_STRUCTURE"
-
-	// UseStandardErrors enables the standardized error package
-	UseStandardErrors = "USE_STANDARD_ERRORS"
-
-	// UseEnhancedLogging enables the enhanced logging system
-	UseEnhancedLogging = "USE_ENHANCED_LOGGING"
-
-	// UseOptimizedTests enables the consolidated test suite
-	UseOptimizedTests = "USE_OPTIMIZED_TESTS"
-
-	// UseRedisRESP enables the custom Redis RESP implementation
-	UseRedisRESP = "USE_REDIS_RESP"
-)
-
-// GetManager returns the global feature manager instance
-func GetManager() *FeatureManager {
-	managerOnce.Do(func() {
-		manager = &FeatureManager{
-			flags: make(map[string]*FeatureFlag),
-		}
-		manager.initialize()
-	})
-	return manager
-}
-
-// initialize sets up default feature flags
-func (m *FeatureManager) initialize() {
-	// Phase 0: Feature flags setup
-	m.Register(UseUnifiedConfig, "Enable unified configuration package", false)
-	m.Register(UseNewFileStructure, "Enable modularized file structure", false)
-	m.Register(UseStandardErrors, "Enable standardized error handling", false)
-	m.Register(UseEnhancedLogging, "Enable enhanced logging system", false)
-	m.Register(UseOptimizedTests, "Enable optimized test suite", false)
-	m.Register(UseRedisRESP, "Enable custom Redis RESP implementation", false)
-
-	// Load from environment variables
-	m.LoadFromEnv()
-}
-
-// Register creates a new feature flag
-func (m *FeatureManager) Register(name, description string, defaultValue bool) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	flag := &FeatureFlag{
-		name:        name,
-		description: description,
-		callbacks:   make([]func(bool), 0),
-	}
-	flag.enabled.Store(defaultValue)
-	m.flags[name] = flag
-}
-
-// IsEnabled checks if a feature flag is enabled
-func (m *FeatureManager) IsEnabled(name string) bool {
-	m.mu.RLock()
-	flag, exists := m.flags[name]
-	m.mu.RUnlock()
-
-	if !exists {
-		return false
-	}
-
-	return flag.enabled.Load()
-}
-
-// Enable turns on a feature flag
-func (m *FeatureManager) Enable(name string) {
-	m.setFlag(name, true)
-}
-
-// Disable turns off a feature flag
-func (m *FeatureManager) Disable(name string) {
-	m.setFlag(name, false)
-}
-
-// Toggle switches a feature flag state
-func (m *FeatureManager) Toggle(name string) {
-	m.mu.RLock()
-	flag, exists := m.flags[name]
-	m.mu.RUnlock()
-
-	if exists {
-		newValue := !flag.enabled.Load()
-		m.setFlag(name, newValue)
-	}
-}
-
-// setFlag updates a feature flag value and triggers callbacks
-func (m *FeatureManager) setFlag(name string, value bool) {
-	m.mu.RLock()
-	flag, exists := m.flags[name]
-	m.mu.RUnlock()
-
-	if !exists {
-		return
-	}
-
-	oldValue := flag.enabled.Swap(value)
-
-	// Only trigger callbacks if value actually changed
-	if oldValue != value {
-		flag.mu.RLock()
-		callbacks := flag.callbacks
-		flag.mu.RUnlock()
-
-		for _, callback := range callbacks {
-			callback(value)
-		}
-	}
-}
-
-// OnChange registers a callback to be called when a feature flag changes
-func (m *FeatureManager) OnChange(name string, callback func(bool)) {
-	m.mu.RLock()
-	flag, exists := m.flags[name]
-	m.mu.RUnlock()
-
-	if exists {
-		flag.mu.Lock()
-		flag.callbacks = append(flag.callbacks, callback)
-		flag.mu.Unlock()
-	}
-}
-
-// LoadFromEnv loads feature flag values from environment variables
-func (m *FeatureManager) LoadFromEnv() {
-	m.mu.RLock()
-	flags := make(map[string]*FeatureFlag)
-	for name, flag := range m.flags {
-		flags[name] = flag
-	}
-	m.mu.RUnlock()
-
-	for name, flag := range flags {
-		envVar := "FEATURE_" + name
-		if value := os.Getenv(envVar); value != "" {
-			enabled := strings.EqualFold(value, "true") || value == "1"
-			flag.enabled.Store(enabled)
-		}
-	}
-}
-
-// GetAll returns all feature flags and their states
-func (m *FeatureManager) GetAll() map[string]bool {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-
-	result := make(map[string]bool)
-	for name, flag := range m.flags {
-		result[name] = flag.enabled.Load()
-	}
-	return result
-}
-
-// Reset resets all feature flags to their default values
-func (m *FeatureManager) Reset() {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	for _, flag := range m.flags {
-		flag.enabled.Store(false)
-		flag.callbacks = make([]func(bool), 0)
-	}
-}
-
-// Helper functions for common checks
-
-// IsUnifiedConfigEnabled checks if unified config is enabled
-func IsUnifiedConfigEnabled() bool {
-	return GetManager().IsEnabled(UseUnifiedConfig)
-}
-
-// IsNewFileStructureEnabled checks if new file structure is enabled
-func IsNewFileStructureEnabled() bool {
-	return GetManager().IsEnabled(UseNewFileStructure)
-}
-
-// IsStandardErrorsEnabled checks if standard errors are enabled
-func IsStandardErrorsEnabled() bool {
-	return GetManager().IsEnabled(UseStandardErrors)
-}
-
-// IsEnhancedLoggingEnabled checks if enhanced logging is enabled
-func IsEnhancedLoggingEnabled() bool {
-	return GetManager().IsEnabled(UseEnhancedLogging)
-}
-
-// IsOptimizedTestsEnabled checks if optimized tests are enabled
-func IsOptimizedTestsEnabled() bool {
-	return GetManager().IsEnabled(UseOptimizedTests)
-}
-
-// IsRedisRESPEnabled checks if custom Redis RESP is enabled
-func IsRedisRESPEnabled() bool {
-	return GetManager().IsEnabled(UseRedisRESP)
-}

internal/features/flags_test.go

@@ -1,483 +0,0 @@
-//go:build !yaegi
-
-package features
-
-import (
-	"os"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-func TestFeatureManager_Register(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("TEST_FEATURE", "Test feature", false)
-
-	if !m.flags["TEST_FEATURE"].enabled.Load() == false {
-		t.Error("Expected feature to be disabled by default")
-	}
-
-	m.Register("TEST_ENABLED", "Test enabled feature", true)
-	if m.flags["TEST_ENABLED"].enabled.Load() != true {
-		t.Error("Expected feature to be enabled")
-	}
-}
-
-func TestFeatureManager_IsEnabled(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("TEST_FEATURE", "Test feature", true)
-
-	if !m.IsEnabled("TEST_FEATURE") {
-		t.Error("Expected feature to be enabled")
-	}
-
-	if m.IsEnabled("NON_EXISTENT") {
-		t.Error("Expected non-existent feature to return false")
-	}
-}
-
-func TestFeatureManager_EnableDisable(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("TEST_FEATURE", "Test feature", false)
-
-	// Enable the feature
-	m.Enable("TEST_FEATURE")
-	if !m.IsEnabled("TEST_FEATURE") {
-		t.Error("Expected feature to be enabled")
-	}
-
-	// Disable the feature
-	m.Disable("TEST_FEATURE")
-	if m.IsEnabled("TEST_FEATURE") {
-		t.Error("Expected feature to be disabled")
-	}
-
-	// Enable/Disable non-existent feature should not panic
-	m.Enable("NON_EXISTENT")
-	m.Disable("NON_EXISTENT")
-}
-
-func TestFeatureManager_Toggle(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("TEST_FEATURE", "Test feature", false)
-
-	// Toggle from false to true
-	m.Toggle("TEST_FEATURE")
-	if !m.IsEnabled("TEST_FEATURE") {
-		t.Error("Expected feature to be enabled after toggle")
-	}
-
-	// Toggle from true to false
-	m.Toggle("TEST_FEATURE")
-	if m.IsEnabled("TEST_FEATURE") {
-		t.Error("Expected feature to be disabled after toggle")
-	}
-
-	// Toggle non-existent feature should not panic
-	m.Toggle("NON_EXISTENT")
-}
-
-func TestFeatureManager_OnChange(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("TEST_FEATURE", "Test feature", false)
-
-	var callbackCalled atomic.Bool
-	var callbackValue atomic.Bool
-
-	m.OnChange("TEST_FEATURE", func(enabled bool) {
-		callbackCalled.Store(true)
-		callbackValue.Store(enabled)
-	})
-
-	// Enable should trigger callback
-	m.Enable("TEST_FEATURE")
-
-	// Wait briefly for callback
-	time.Sleep(10 * time.Millisecond)
-
-	if !callbackCalled.Load() {
-		t.Error("Expected callback to be called")
-	}
-
-	if !callbackValue.Load() {
-		t.Error("Expected callback value to be true")
-	}
-
-	// Setting to same value should NOT trigger callback again
-	callbackCalled.Store(false)
-	m.Enable("TEST_FEATURE")
-	time.Sleep(10 * time.Millisecond)
-
-	if callbackCalled.Load() {
-		t.Error("Expected callback NOT to be called when value doesn't change")
-	}
-}
-
-func TestFeatureManager_LoadFromEnv(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("TEST_FEATURE", "Test feature", false)
-	m.Register("TEST_FEATURE_2", "Test feature 2", false)
-
-	// Set environment variables
-	os.Setenv("FEATURE_TEST_FEATURE", "true")
-	os.Setenv("FEATURE_TEST_FEATURE_2", "1")
-	defer func() {
-		os.Unsetenv("FEATURE_TEST_FEATURE")
-		os.Unsetenv("FEATURE_TEST_FEATURE_2")
-	}()
-
-	m.LoadFromEnv()
-
-	if !m.IsEnabled("TEST_FEATURE") {
-		t.Error("Expected TEST_FEATURE to be enabled from env")
-	}
-
-	if !m.IsEnabled("TEST_FEATURE_2") {
-		t.Error("Expected TEST_FEATURE_2 to be enabled from env (value=1)")
-	}
-}
-
-func TestFeatureManager_LoadFromEnv_FalseValues(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("TEST_FEATURE", "Test feature", true) // Default true
-
-	// Set to false
-	os.Setenv("FEATURE_TEST_FEATURE", "false")
-	defer os.Unsetenv("FEATURE_TEST_FEATURE")
-
-	m.LoadFromEnv()
-
-	if m.IsEnabled("TEST_FEATURE") {
-		t.Error("Expected TEST_FEATURE to be disabled from env")
-	}
-}
-
-func TestFeatureManager_GetAll(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("FEATURE_1", "Feature 1", true)
-	m.Register("FEATURE_2", "Feature 2", false)
-
-	all := m.GetAll()
-
-	if len(all) != 2 {
-		t.Errorf("Expected 2 features, got %d", len(all))
-	}
-
-	if !all["FEATURE_1"] {
-		t.Error("Expected FEATURE_1 to be enabled")
-	}
-
-	if all["FEATURE_2"] {
-		t.Error("Expected FEATURE_2 to be disabled")
-	}
-}
-
-func TestFeatureManager_Reset(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("FEATURE_1", "Feature 1", true)
-	m.Register("FEATURE_2", "Feature 2", true)
-
-	var callbackCalled atomic.Int32
-	m.OnChange("FEATURE_1", func(enabled bool) {
-		callbackCalled.Add(1)
-	})
-
-	m.Reset()
-
-	// All features should be disabled
-	if m.IsEnabled("FEATURE_1") {
-		t.Error("Expected FEATURE_1 to be disabled after reset")
-	}
-
-	if m.IsEnabled("FEATURE_2") {
-		t.Error("Expected FEATURE_2 to be disabled after reset")
-	}
-
-	// Callbacks should be cleared
-	m.Enable("FEATURE_1")
-	time.Sleep(10 * time.Millisecond)
-
-	if callbackCalled.Load() != 0 {
-		t.Error("Expected callbacks to be cleared after reset")
-	}
-}
-
-func TestGetManager_Singleton(t *testing.T) {
-	// Reset global state for clean test
-	managerOnce = sync.Once{}
-	manager = nil
-
-	m1 := GetManager()
-	m2 := GetManager()
-
-	if m1 != m2 {
-		t.Error("Expected GetManager to return same instance")
-	}
-}
-
-func TestGetManager_Initialize(t *testing.T) {
-	// Reset global state for clean test
-	managerOnce = sync.Once{}
-	manager = nil
-
-	m := GetManager()
-
-	// Should have default feature flags
-	all := m.GetAll()
-	if len(all) < 6 {
-		t.Errorf("Expected at least 6 default feature flags, got %d", len(all))
-	}
-
-	// Check specific flags exist
-	flags := []string{
-		UseUnifiedConfig,
-		UseNewFileStructure,
-		UseStandardErrors,
-		UseEnhancedLogging,
-		UseOptimizedTests,
-		UseRedisRESP,
-	}
-
-	for _, flag := range flags {
-		if _, exists := m.flags[flag]; !exists {
-			t.Errorf("Expected default flag %s to exist", flag)
-		}
-	}
-}
-
-func TestHelperFunctions(t *testing.T) {
-	// Reset global state
-	managerOnce = sync.Once{}
-	manager = nil
-
-	// Test IsUnifiedConfigEnabled
-	if IsUnifiedConfigEnabled() {
-		t.Error("Expected unified config to be disabled by default")
-	}
-
-	GetManager().Enable(UseUnifiedConfig)
-	if !IsUnifiedConfigEnabled() {
-		t.Error("Expected unified config to be enabled")
-	}
-
-	// Reset for next test
-	GetManager().Reset()
-
-	// Test IsNewFileStructureEnabled
-	if IsNewFileStructureEnabled() {
-		t.Error("Expected new file structure to be disabled by default")
-	}
-
-	GetManager().Enable(UseNewFileStructure)
-	if !IsNewFileStructureEnabled() {
-		t.Error("Expected new file structure to be enabled")
-	}
-
-	// Test IsStandardErrorsEnabled
-	GetManager().Reset()
-	GetManager().Enable(UseStandardErrors)
-	if !IsStandardErrorsEnabled() {
-		t.Error("Expected standard errors to be enabled")
-	}
-
-	// Test IsEnhancedLoggingEnabled
-	GetManager().Reset()
-	GetManager().Enable(UseEnhancedLogging)
-	if !IsEnhancedLoggingEnabled() {
-		t.Error("Expected enhanced logging to be enabled")
-	}
-
-	// Test IsOptimizedTestsEnabled
-	GetManager().Reset()
-	GetManager().Enable(UseOptimizedTests)
-	if !IsOptimizedTestsEnabled() {
-		t.Error("Expected optimized tests to be enabled")
-	}
-
-	// Test IsRedisRESPEnabled
-	GetManager().Reset()
-	GetManager().Enable(UseRedisRESP)
-	if !IsRedisRESPEnabled() {
-		t.Error("Expected Redis RESP to be enabled")
-	}
-}
-
-// Race condition tests
-func TestFeatureManager_ConcurrentAccess(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("TEST_FEATURE", "Test feature", false)
-
-	var wg sync.WaitGroup
-	iterations := 100
-
-	// Concurrent enables
-	for i := 0; i < iterations; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			m.Enable("TEST_FEATURE")
-		}()
-	}
-
-	// Concurrent disables
-	for i := 0; i < iterations; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			m.Disable("TEST_FEATURE")
-		}()
-	}
-
-	// Concurrent reads
-	for i := 0; i < iterations; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			_ = m.IsEnabled("TEST_FEATURE")
-		}()
-	}
-
-	wg.Wait()
-
-	// Should not panic - final state is not deterministic but that's ok
-}
-
-func TestFeatureManager_ConcurrentCallbacks(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("TEST_FEATURE", "Test feature", false)
-
-	var callbackCount atomic.Int32
-	var wg sync.WaitGroup
-
-	// Register multiple callbacks concurrently
-	for i := 0; i < 10; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			m.OnChange("TEST_FEATURE", func(enabled bool) {
-				callbackCount.Add(1)
-			})
-		}()
-	}
-
-	wg.Wait()
-
-	// Toggle the feature
-	m.Toggle("TEST_FEATURE")
-
-	// Wait for callbacks
-	time.Sleep(50 * time.Millisecond)
-
-	// All 10 callbacks should have been called
-	if callbackCount.Load() != 10 {
-		t.Errorf("Expected 10 callbacks, got %d", callbackCount.Load())
-	}
-}
-
-func TestFeatureManager_ConcurrentGetAll(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	for i := 0; i < 5; i++ {
-		m.Register(string(rune('A'+i)), "Feature", false)
-	}
-
-	var wg sync.WaitGroup
-
-	// Concurrent GetAll calls
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			all := m.GetAll()
-			if len(all) != 5 {
-				t.Errorf("Expected 5 flags, got %d", len(all))
-			}
-		}()
-	}
-
-	// Concurrent modifications
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			flag := string(rune('A' + (idx % 5)))
-			if idx%2 == 0 {
-				m.Enable(flag)
-			} else {
-				m.Disable(flag)
-			}
-		}(i)
-	}
-
-	wg.Wait()
-}
-
-func TestFeatureManager_LoadFromEnv_Concurrent(t *testing.T) {
-	m := &FeatureManager{
-		flags: make(map[string]*FeatureFlag),
-	}
-
-	m.Register("FEATURE_1", "Feature 1", false)
-	m.Register("FEATURE_2", "Feature 2", false)
-
-	os.Setenv("FEATURE_FEATURE_1", "true")
-	os.Setenv("FEATURE_FEATURE_2", "true")
-	defer func() {
-		os.Unsetenv("FEATURE_FEATURE_1")
-		os.Unsetenv("FEATURE_FEATURE_2")
-	}()
-
-	var wg sync.WaitGroup
-
-	// Load from env concurrently
-	for i := 0; i < 10; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			m.LoadFromEnv()
-		}()
-	}
-
-	wg.Wait()
-
-	// Both should be enabled
-	if !m.IsEnabled("FEATURE_1") || !m.IsEnabled("FEATURE_2") {
-		t.Error("Expected features to be enabled from env")
-	}
-}

internal/pool/export_test.go

@@ -0,0 +1,54 @@
+package pool
+
+import (
+	"sync"
+	"testing"
+)
+
+// resetGlobalTransportPoolForTest clears the process-global transport pool so the
+// next call to GetTransportPool returns a fresh instance, and cancels the
+// current pool's cleanup goroutine. Required for order-independent tests that
+// replace the global pool: the singleton is sync.Once-guarded, so without a
+// reset a consumed Once leaves GetTransportPool returning nil and later callers
+// panic on a nil receiver (see TestCreateHTTPClient_Fallback).
+//
+// Test-only: kept in a _test.go file so it never compiles into the plugin
+// binary that imports this package (FIX-39).
+func resetGlobalTransportPoolForTest() {
+	if globalTransportPool != nil && globalTransportPool.cancel != nil {
+		globalTransportPool.cancel()
+	}
+	transportPoolOnce = sync.Once{}
+	globalTransportPool = nil
+}
+
+// TestGetTransportPool_ConcurrentFirstCall pins FIX-39: GetTransportPool must
+// not read globalTransportPool outside the sync.Once guard. An unsynchronized
+// nil pre-check races the write inside Once.Do when two goroutines call
+// GetTransportPool for the first time concurrently, so this test only passes
+// under -race once the pre-check is removed.
+func TestGetTransportPool_ConcurrentFirstCall(t *testing.T) {
+	resetGlobalTransportPoolForTest()
+	defer resetGlobalTransportPoolForTest()
+
+	const n = 50
+	results := make([]*TransportPool, n)
+	var wg sync.WaitGroup
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func(i int) {
+			defer wg.Done()
+			results[i] = GetTransportPool()
+		}(i)
+	}
+	wg.Wait()
+
+	if results[0] == nil {
+		t.Fatal("GetTransportPool returned nil")
+	}
+	for i := 1; i < n; i++ {
+		if results[i] != results[0] {
+			t.Fatalf("GetTransportPool returned different instances across concurrent first calls: results[0]=%p results[%d]=%p", results[0], i, results[i])
+		}
+	}
+}

internal/pool/review_r146_test.go

@@ -0,0 +1,64 @@
+package pool
+
+import (
+	"crypto/tls"
+	"testing"
+	"time"
+)
+
+// TestTransportPool_ConfigKeyDistinguishesMinTLSVersion guards the R146
+// fix in internal/pool/transport.go configKey: the key previously
+// omitted MinTLSVersion (and all timeouts), so two configs differing
+// only in the TLS minimum version collided on one key and silently
+// shared a single transport with whoever-arrived-first's settings — a
+// possible TLS-version downgrade. Distinct TLS minimum versions must
+// yield non-shared transports with the requested MinVersion.
+func TestTransportPool_ConfigKeyDistinguishesMinTLSVersion(t *testing.T) {
+	p := &TransportPool{
+		transports:  make(map[string]*sharedTransport),
+		maxConns:    20,
+		clientCount: 0,
+		maxClients:  100, // high so the at-cap path isn't taken
+	}
+
+	cfg12 := TransportConfig{MinTLSVersion: tls.VersionTLS12}
+	cfg13 := TransportConfig{MinTLSVersion: tls.VersionTLS13}
+
+	a := p.GetTransport(cfg12)
+	b := p.GetTransport(cfg13)
+
+	if a == b {
+		t.Fatal("two configs differing only in MinTLSVersion must not share a transport")
+	}
+	if a.TLSClientConfig == nil || a.TLSClientConfig.MinVersion != tls.VersionTLS12 {
+		t.Fatalf("transport A must use TLS1.2, got %+v", a.TLSClientConfig)
+	}
+	if b.TLSClientConfig == nil || b.TLSClientConfig.MinVersion != tls.VersionTLS13 {
+		t.Fatalf("transport B must use TLS1.3, got %+v", b.TLSClientConfig)
+	}
+}
+
+// TestTransportPool_ConfigKeyDistinguishesTimeouts guards the R146 fix
+// for the timeout fields: configs differing only in a timeout must not
+// collide and share one transport.
+func TestTransportPool_ConfigKeyDistinguishesTimeouts(t *testing.T) {
+	p := &TransportPool{
+		transports:  make(map[string]*sharedTransport),
+		maxConns:    20,
+		clientCount: 0,
+		maxClients:  100,
+	}
+
+	cfgFast := TransportConfig{MinTLSVersion: tls.VersionTLS12, DialTimeout: time.Second}
+	cfgSlow := TransportConfig{MinTLSVersion: tls.VersionTLS12, DialTimeout: 30 * time.Second}
+
+	a := p.GetTransport(cfgFast)
+	b := p.GetTransport(cfgSlow)
+
+	if a == nil || b == nil {
+		t.Fatal("both transports must be created")
+	}
+	if a == b {
+		t.Fatal("two configs differing only in DialTimeout must not share a transport")
+	}
+}

internal/pool/review_r227_test.go

@@ -0,0 +1,78 @@
+package pool
+
+import (
+	"crypto/tls"
+	"net/http"
+	"testing"
+	"time"
+)
+
+// TestTransportPool_TLSMatchesNormalizesDefault covers the previously
+// 0%-covered tlsMatches security guard (R146): two transports share the
+// pool only when their TLS posture (certificate verification and
+// minimum protocol version) matches, with 0 normalized to the TLS1.2
+// default that createTransport applies.
+func TestTransportPool_TLSMatchesNormalizesDefault(t *testing.T) {
+	p := &TransportPool{}
+
+	// 0 (createTransport's default) must be equivalent to explicit TLS1.2.
+	if !p.tlsMatches(TransportConfig{}, TransportConfig{MinTLSVersion: tls.VersionTLS12}) {
+		t.Fatal("zero and explicit TLS1.2 minimum must match after normalization")
+	}
+
+	// Differing verification posture must never match.
+	if p.tlsMatches(
+		TransportConfig{InsecureSkipVerify: true},
+		TransportConfig{InsecureSkipVerify: false},
+	) {
+		t.Fatal("configs differing in InsecureSkipVerify must not match")
+	}
+
+	// Differing minimum TLS version must never match.
+	if p.tlsMatches(
+		TransportConfig{MinTLSVersion: tls.VersionTLS12},
+		TransportConfig{MinTLSVersion: tls.VersionTLS13},
+	) {
+		t.Fatal("configs differing in MinTLSVersion must not match")
+	}
+}
+
+// TestTransportPool_NoTLSMismatchReuse drives getExistingTransport
+// directly: a strict-verifying caller must never be handed a pooled
+// InsecureSkipVerify transport (silent cert-verification bypass, R146);
+// it falls back to nil so the caller builds a safe verifying client.
+func TestTransportPool_NoTLSMismatchReuse(t *testing.T) {
+	p := &TransportPool{
+		transports: map[string]*sharedTransport{
+			"insecure": {
+				transport: &http.Transport{},
+				config:    TransportConfig{InsecureSkipVerify: true, MinTLSVersion: tls.VersionTLS12},
+				refCount:  0,
+				lastUsed:  time.Now(),
+			},
+			"verifyTLS13": {
+				transport: &http.Transport{},
+				config:    TransportConfig{InsecureSkipVerify: false, MinTLSVersion: tls.VersionTLS13},
+				refCount:  0,
+				lastUsed:  time.Now(),
+			},
+		},
+		maxConns:   20,
+		maxClients: 100,
+	}
+
+	// Strict TLS1.2 caller must NOT reuse the insecure or TLS1.3 peers.
+	if tr := p.getExistingTransport(TransportConfig{MinTLSVersion: tls.VersionTLS12}); tr != nil {
+		t.Fatal("strict-verifying caller received a mismatched pooled transport")
+	}
+
+	// Insecure caller matches the insecure peer and reuses it.
+	if tr := p.getExistingTransport(TransportConfig{InsecureSkipVerify: true, MinTLSVersion: tls.VersionTLS12}); tr == nil {
+		t.Fatal("insecure caller should reuse the insecure pooled transport")
+	}
+
+	// TLS1.3 verifying caller matches the TLS1.3 peer.
+	if tr := p.getExistingTransport(TransportConfig{MinTLSVersion: tls.VersionTLS13}); tr == nil {
+		t.Fatal("TLS1.3 caller should reuse the TLS1.3 verifying transport")
+	}
+}

internal/pool/transport.go

@@ -5,6 +5,7 @@ import (
 	"crypto/tls"
 	"net"
 	"net/http"
+	"strconv"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -58,7 +59,13 @@ var (
 	transportPoolOnce sync.Once
 )
 
-// GetTransportPool returns the global transport pool instance
+// GetTransportPool returns the global transport pool instance.
+//
+// The whole body runs inside transportPoolOnce.Do so every caller, including
+// the very first concurrent callers, only ever reads globalTransportPool
+// after Once establishes happens-before (FIX-39). A pre-check outside Do
+// would read the pointer while another goroutine's Do closure writes it,
+// which is a data race that also defeats Once's synchronization guarantee.
 func GetTransportPool() *TransportPool {
 	transportPoolOnce.Do(func() {
 		ctx, cancel := context.WithCancel(context.Background())
@@ -101,7 +108,7 @@ func DefaultTransportConfig() TransportConfig {
 func (p *TransportPool) GetTransport(config TransportConfig) *http.Transport {
 	// Check client limit
 	if atomic.LoadInt32(&p.clientCount) >= p.maxClients {
-		return p.getExistingTransport()
+		return p.getExistingTransport(config)
 	}
 
 	key := p.configKey(config)
@@ -163,20 +170,41 @@ func (p *TransportPool) ReleaseTransport(transport *http.Transport) {
 }
 
 // getExistingTransport returns any available transport when limit is reached
-func (p *TransportPool) getExistingTransport() *http.Transport {
+func (p *TransportPool) getExistingTransport(config TransportConfig) *http.Transport {
 	p.mu.RLock()
 	defer p.mu.RUnlock()
 
+	// Prefer a transport whose TLS settings (verification, min version)
+	// match the request. Reusing a mismatched transport at cap could hand a
+	// strict-verifying caller an InsecureSkipVerify transport (silent cert
+	// verification bypass) or an insecure caller a verifying one (R146).
 	for _, shared := range p.transports {
-		if shared != nil && shared.transport != nil {
+		if shared != nil && shared.transport != nil && p.tlsMatches(config, shared.config) {
 			atomic.AddInt32(&shared.refCount, 1)
 			shared.lastUsed = time.Now()
 			return shared.transport
 		}
 	}
+	// No TLS-matching pooled transport: return nil so the caller falls back
+	// to a safe basic client (http.DefaultTransport verifies certs) rather
+	// than receiving a mismatched peer. Bounded by the cap (R146).
 	return nil
 }
 
+// tlsMatches reports whether two transports share the same TLS posture
+// (certificate verification and minimum protocol version), normalized for
+// createTransport's 0-means-TLS1.2 default.
+func (p *TransportPool) tlsMatches(a, b TransportConfig) bool {
+	amin, bmin := a.MinTLSVersion, b.MinTLSVersion
+	if amin == 0 {
+		amin = tls.VersionTLS12
+	}
+	if bmin == 0 {
+		bmin = tls.VersionTLS12
+	}
+	return a.InsecureSkipVerify == b.InsecureSkipVerify && amin == bmin
+}
+
 // createTransport creates a new HTTP transport with the given config
 func (p *TransportPool) createTransport(config TransportConfig) *http.Transport {
 	// Set secure defaults
@@ -193,8 +221,6 @@ func (p *TransportPool) createTransport(config TransportConfig) *http.Transport
 			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
 			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
 		},
-		// #nosec G402 -- PreferServerCipherSuites is deprecated in Go 1.17+ but setting it is harmless
-		PreferServerCipherSuites: true,
 		// #nosec G402 -- InsecureSkipVerify is configurable for testing/dev environments
 		InsecureSkipVerify: config.InsecureSkipVerify,
 	}
@@ -230,9 +256,15 @@ func (p *TransportPool) configKey(config TransportConfig) string {
 	sb := Get().GetStringBuilder()
 	defer Get().PutStringBuilder(sb)
 
-	sb.WriteByte(byte(config.MaxConnsPerHost))
-	sb.WriteByte(byte(config.MaxIdleConnsPerHost))
-	sb.WriteByte(byte(config.MaxIdleConns))
+	// Write the int fields verbatim, not byte()s: a config value >=256 would
+	// otherwise truncate and make two distinct configs collide on one key,
+	// silently sharing a single transport with the wrong settings.
+	sb.WriteString(strconv.Itoa(config.MaxConnsPerHost))
+	sb.WriteByte('|')
+	sb.WriteString(strconv.Itoa(config.MaxIdleConnsPerHost))
+	sb.WriteByte('|')
+	sb.WriteString(strconv.Itoa(config.MaxIdleConns))
+	sb.WriteByte('|')
 	if config.ForceHTTP2 {
 		sb.WriteByte(1)
 	} else {
@@ -253,6 +285,28 @@ func (p *TransportPool) configKey(config TransportConfig) string {
 	} else {
 		sb.WriteByte(0)
 	}
+	// Include MinTLSVersion and every timeout so two configs differing only
+	// in TLS minimum version or timeouts do NOT collide on one key and
+	// silently share a transport with whoever-arrived-first's settings
+	// (a possible TLS-version downgrade). Mirror http_client_pool.go's
+	// all-field key (R146).
+	sb.WriteByte('|')
+	if config.MinTLSVersion == 0 {
+		sb.WriteString("tls12")
+	} else {
+		sb.WriteString(strconv.Itoa(int(config.MinTLSVersion)))
+	}
+	for _, d := range []time.Duration{
+		config.DialTimeout,
+		config.TLSHandshakeTimeout,
+		config.ResponseHeaderTimeout,
+		config.ExpectContinueTimeout,
+		config.IdleConnTimeout,
+		config.KeepAlive,
+	} {
+		sb.WriteByte('|')
+		sb.WriteString(strconv.FormatInt(int64(d), 10))
+	}
 
 	return sb.String()
 }

internal/pool/transport_test.go

@@ -5,6 +5,7 @@ import (
 	"crypto/tls"
 	"net/http"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 )
@@ -476,23 +477,17 @@ func TestCreateHTTPClient(t *testing.T) {
 
 // TestCreateHTTPClient_Fallback tests fallback when pool is exhausted
 func TestCreateHTTPClient_Fallback(t *testing.T) {
-	// Override global pool with limited one
-	originalPool := globalTransportPool
-	defer func() {
-		globalTransportPool = originalPool
-	}()
+	// GetTransportPool now runs unconditionally inside transportPoolOnce.Do
+	// (FIX-39: no unsynchronized nil pre-check), so a freshly reset Once
+	// always builds its own pool on the next call. Exhaust the real singleton
+	// in place (mutate its fields) instead of swapping in a hand-built
+	// *TransportPool, which Once.Do would otherwise immediately overwrite.
+	resetGlobalTransportPoolForTest()
+	defer resetGlobalTransportPoolForTest()
 
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	globalTransportPool = &TransportPool{
-		transports:  make(map[string]*sharedTransport),
-		maxConns:    20,
-		ctx:         ctx,
-		cancel:      cancel,
-		clientCount: 10,
-		maxClients:  1, // Very low limit
-	}
+	pool := GetTransportPool()
+	pool.maxClients = 1 // Very low limit
+	atomic.StoreInt32(&pool.clientCount, 10)
 
 	config := DefaultTransportConfig()
 	timeout := 30 * time.Second
@@ -504,9 +499,17 @@ func TestCreateHTTPClient_Fallback(t *testing.T) {
 		return
 	}
 
+	// When the pool is exhausted, GetTransport returns nil and CreateHTTPClient
+	// falls back to a basic client: timeout set, no transport, no redirect policy.
 	if client.Timeout != timeout {
 		t.Errorf("Client timeout should be %v, got %v", timeout, client.Timeout)
 	}
+	if client.Transport != nil {
+		t.Error("Fallback client should have no transport")
+	}
+	if client.CheckRedirect != nil {
+		t.Error("Fallback client should have no redirect policy")
+	}
 }
 
 // TestTransportPool_ConcurrentAccess tests concurrent access to transport pool

internal/pool/utils.go

@@ -13,8 +13,8 @@ func BuildSessionName(baseName string, index int) string {
 	sb.WriteString(baseName)
 	sb.WriteRune('_')
 	// Efficient int to string conversion
-	if index < 10 {
-		sb.WriteRune('0' + rune(index))
+	if index >= 0 && index < 10 {
+		sb.WriteByte("0123456789"[index])
 	} else {
 		sb.WriteString(intToString(index))
 	}

internal/pool/utils_session_name_test.go

@@ -0,0 +1,16 @@
+package pool
+
+import "testing"
+
+// TestBuildSessionNameIndexes pins the gosec G115 fix: the single-digit fast
+// path used rune('0'+index) for any index below 10, so a negative index
+// produced a non-digit (index -1 gave "base_/"). The fast path now covers only
+// 0..9, and other values use intToString.
+func TestBuildSessionNameIndexes(t *testing.T) {
+	cases := map[int]string{0: "base_0", 3: "base_3", 9: "base_9", 10: "base_10", 42: "base_42", -1: "base_-1", -7: "base_-7"}
+	for index, want := range cases {
+		if got := BuildSessionName("base", index); got != want {
+			t.Errorf("BuildSessionName(%q, %d) = %q, want %q", "base", index, got, want)
+		}
+	}
+}

internal/providers/adapter.go

@@ -1,115 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"strings"
-	"time"
-)
-
-// Adapter facilitates communication between the legacy TraefikOIDC struct and the new provider system.
-type Adapter struct {
-	provider       OIDCProvider
-	legacySettings LegacySettings
-	tokenVerifier  TokenVerifier
-	tokenCache     TokenCache
-}
-
-// LegacySettings provides the adapter with access to the original configuration values.
-type LegacySettings interface {
-	GetIssuerURL() string
-	GetAuthURL() string
-	GetScopes() []string
-	IsPKCEEnabled() bool
-	GetClientID() string
-	GetRefreshGracePeriod() time.Duration
-	IsOverrideScopes() bool
-}
-
-// NewAdapter creates a new adapter for a given provider and legacy settings.
-func NewAdapter(provider OIDCProvider, settings LegacySettings, tokenVerifier TokenVerifier, tokenCache TokenCache) *Adapter {
-	return &Adapter{
-		provider:       provider,
-		legacySettings: settings,
-		tokenVerifier:  tokenVerifier,
-		tokenCache:     tokenCache,
-	}
-}
-
-// BuildAuthURL constructs the authentication URL using the adapted provider.
-func (a *Adapter) BuildAuthURL(redirectURL, state, nonce, codeChallenge string) string {
-	params := url.Values{}
-	params.Set("client_id", a.legacySettings.GetClientID())
-	params.Set("response_type", "code")
-	params.Set("redirect_uri", redirectURL)
-	params.Set("state", state)
-	params.Set("nonce", nonce)
-
-	if a.legacySettings.IsPKCEEnabled() && codeChallenge != "" {
-		params.Set("code_challenge", codeChallenge)
-		params.Set("code_challenge_method", "S256")
-	}
-
-	scopes := a.legacySettings.GetScopes()
-
-	if a.legacySettings.IsOverrideScopes() {
-		finalParams := params
-		finalParams.Set("scope", strings.Join(scopes, " "))
-
-		switch a.provider.GetType() {
-		case ProviderTypeGoogle:
-			finalParams.Set("access_type", "offline")
-			finalParams.Set("prompt", "consent")
-		case ProviderTypeAzure:
-			finalParams.Set("response_mode", "query")
-		}
-
-		return a.buildURLWithParams(a.legacySettings.GetAuthURL(), finalParams)
-	}
-
-	authParams, err := a.provider.BuildAuthParams(params, scopes)
-	if err != nil {
-		return ""
-	}
-
-	finalParams := authParams.URLValues
-	finalParams.Set("scope", strings.Join(authParams.Scopes, " "))
-
-	return a.buildURLWithParams(a.legacySettings.GetAuthURL(), finalParams)
-}
-
-// from the configured issuerURL.
-func (a *Adapter) buildURLWithParams(baseURL string, params url.Values) string {
-	if !strings.HasPrefix(baseURL, "http://") && !strings.HasPrefix(baseURL, "https://") {
-		issuerURLParsed, err := url.Parse(a.legacySettings.GetIssuerURL())
-		if err != nil {
-			return ""
-		}
-
-		baseURLParsed, err := url.Parse(baseURL)
-		if err != nil {
-			return ""
-		}
-
-		resolvedURL := issuerURLParsed.ResolveReference(baseURLParsed)
-		resolvedURL.RawQuery = params.Encode()
-		return resolvedURL.String()
-	}
-
-	u, err := url.Parse(baseURL)
-	if err != nil {
-		return ""
-	}
-
-	u.RawQuery = params.Encode()
-	return u.String()
-}
-
-// ValidateTokens validates tokens using the adapted provider.
-func (a *Adapter) ValidateTokens(session Session) (*ValidationResult, error) {
-	return a.provider.ValidateTokens(session, a.tokenVerifier, a.tokenCache, a.legacySettings.GetRefreshGracePeriod())
-}
-
-// GetType returns the underlying provider's type.
-func (a *Adapter) GetType() ProviderType {
-	return a.provider.GetType()
-}

internal/providers/auth0.go

@@ -1,72 +0,0 @@
-package providers
-
-import (
-	"net/url"
-)
-
-// Auth0Provider encapsulates Auth0-specific OIDC logic.
-type Auth0Provider struct {
-	*BaseProvider
-}
-
-// NewAuth0Provider creates a new instance of the Auth0Provider.
-func NewAuth0Provider() *Auth0Provider {
-	return &Auth0Provider{
-		BaseProvider: NewBaseProvider(),
-	}
-}
-
-// GetType returns the provider's type.
-func (p *Auth0Provider) GetType() ProviderType {
-	return ProviderTypeAuth0
-}
-
-// GetCapabilities returns the specific capabilities of the Auth0 provider.
-func (p *Auth0Provider) GetCapabilities() ProviderCapabilities {
-	return ProviderCapabilities{
-		SupportsRefreshTokens:      true,
-		RequiresOfflineAccessScope: true,
-		RequiresPromptConsent:      false,
-		PreferredTokenValidation:   "id", // Auth0 typically uses ID tokens
-	}
-}
-
-// BuildAuthParams configures Auth0-specific authentication parameters.
-func (p *Auth0Provider) BuildAuthParams(baseParams url.Values, scopes []string) (*AuthParams, error) {
-	// Auth0 supports various response types and connection parameters
-	baseParams.Set("response_type", "code")
-
-	// Ensure offline_access scope is present for refresh tokens
-	hasOfflineAccess := false
-	for _, scope := range scopes {
-		if scope == ScopeOfflineAccess {
-			hasOfflineAccess = true
-			break
-		}
-	}
-	if !hasOfflineAccess {
-		scopes = append(scopes, ScopeOfflineAccess)
-	}
-
-	// Ensure openid scope is present
-	hasOpenID := false
-	for _, scope := range scopes {
-		if scope == ScopeOpenID {
-			hasOpenID = true
-			break
-		}
-	}
-	if !hasOpenID {
-		scopes = append(scopes, ScopeOpenID)
-	}
-
-	return &AuthParams{
-		URLValues: baseParams,
-		Scopes:    deduplicateScopes(scopes),
-	}, nil
-}
-
-// Auth0 requires specific tenant configuration and connection handling.
-func (p *Auth0Provider) ValidateConfig() error {
-	return p.BaseProvider.ValidateConfig()
-}

internal/providers/auth0_test.go

@@ -1,124 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"testing"
-)
-
-// TestAuth0Provider_NewAuth0Provider tests the constructor
-func TestAuth0Provider_NewAuth0Provider(t *testing.T) {
-	provider := NewAuth0Provider()
-
-	if provider == nil {
-		t.Fatal("Expected provider to be created, got nil")
-	}
-
-	if provider.BaseProvider == nil {
-		t.Error("BaseProvider should be initialized")
-	}
-}
-
-// TestAuth0Provider_GetType tests provider type
-func TestAuth0Provider_GetType(t *testing.T) {
-	provider := NewAuth0Provider()
-
-	if provider.GetType() != ProviderTypeAuth0 {
-		t.Errorf("Expected ProviderTypeAuth0, got %v", provider.GetType())
-	}
-}
-
-// TestAuth0Provider_GetCapabilities tests Auth0-specific capabilities
-func TestAuth0Provider_GetCapabilities(t *testing.T) {
-	provider := NewAuth0Provider()
-	capabilities := provider.GetCapabilities()
-
-	if !capabilities.SupportsRefreshTokens {
-		t.Error("Expected SupportsRefreshTokens to be true for Auth0")
-	}
-
-	if !capabilities.RequiresOfflineAccessScope {
-		t.Error("Expected RequiresOfflineAccessScope to be true for Auth0")
-	}
-
-	if capabilities.RequiresPromptConsent {
-		t.Error("Expected RequiresPromptConsent to be false for Auth0")
-	}
-
-	if capabilities.PreferredTokenValidation != "id" {
-		t.Errorf("Expected PreferredTokenValidation 'id', got '%s'", capabilities.PreferredTokenValidation)
-	}
-}
-
-// TestAuth0Provider_BuildAuthParams tests Auth0-specific auth params
-func TestAuth0Provider_BuildAuthParams(t *testing.T) {
-	provider := NewAuth0Provider()
-	baseParams := url.Values{}
-	baseParams.Set("client_id", "test_client")
-
-	tests := []struct {
-		name           string
-		scopes         []string
-		expectedScopes []string
-	}{
-		{
-			name:           "Add offline_access and openid scopes",
-			scopes:         []string{"profile", "email"},
-			expectedScopes: []string{"profile", "email", "offline_access", "openid"},
-		},
-		{
-			name:           "Keep existing offline_access and openid",
-			scopes:         []string{"openid", "profile", "offline_access", "email"},
-			expectedScopes: []string{"openid", "profile", "offline_access", "email"},
-		},
-		{
-			name:           "Add both scopes when none provided",
-			scopes:         []string{},
-			expectedScopes: []string{"offline_access", "openid"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			// Check that response_type is set
-			if authParams.URLValues.Get("response_type") != "code" {
-				t.Errorf("Expected response_type 'code', got '%s'", authParams.URLValues.Get("response_type"))
-			}
-
-			if len(authParams.Scopes) != len(tt.expectedScopes) {
-				t.Errorf("Expected %d scopes, got %d. Expected: %v, Got: %v",
-					len(tt.expectedScopes), len(authParams.Scopes), tt.expectedScopes, authParams.Scopes)
-				return
-			}
-
-			// Check that all expected scopes are present
-			for _, expectedScope := range tt.expectedScopes {
-				found := false
-				for _, actualScope := range authParams.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in %v", expectedScope, authParams.Scopes)
-				}
-			}
-		})
-	}
-}
-
-// TestAuth0Provider_ValidateConfig tests config validation
-func TestAuth0Provider_ValidateConfig(t *testing.T) {
-	provider := NewAuth0Provider()
-
-	err := provider.ValidateConfig()
-	if err != nil {
-		t.Errorf("ValidateConfig failed: %v", err)
-	}
-}

internal/providers/aws_cognito.go

@@ -1,74 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"strings"
-)
-
-// AWSCognitoProvider encapsulates AWS Cognito-specific OIDC logic.
-type AWSCognitoProvider struct {
-	*BaseProvider
-}
-
-// NewAWSCognitoProvider creates a new instance of the AWSCognitoProvider.
-func NewAWSCognitoProvider() *AWSCognitoProvider {
-	return &AWSCognitoProvider{
-		BaseProvider: NewBaseProvider(),
-	}
-}
-
-// GetType returns the provider's type.
-func (p *AWSCognitoProvider) GetType() ProviderType {
-	return ProviderTypeAWSCognito
-}
-
-// GetCapabilities returns the specific capabilities of the AWS Cognito provider.
-func (p *AWSCognitoProvider) GetCapabilities() ProviderCapabilities {
-	return ProviderCapabilities{
-		SupportsRefreshTokens:      true,
-		RequiresOfflineAccessScope: false, // Cognito doesn't use offline_access scope
-		RequiresPromptConsent:      false,
-		PreferredTokenValidation:   "id", // Cognito typically uses ID tokens
-	}
-}
-
-// BuildAuthParams configures AWS Cognito-specific authentication parameters.
-func (p *AWSCognitoProvider) BuildAuthParams(baseParams url.Values, scopes []string) (*AuthParams, error) {
-	// AWS Cognito supports standard OIDC parameters
-	baseParams.Set("response_type", "code")
-
-	// Remove offline_access scope as Cognito doesn't use it (case-insensitive)
-	var filteredScopes []string
-	for _, scope := range scopes {
-		if !strings.EqualFold(scope, ScopeOfflineAccess) {
-			filteredScopes = append(filteredScopes, scope)
-		}
-	}
-
-	// Ensure openid scope is present
-	hasOpenID := false
-	for _, scope := range filteredScopes {
-		if scope == ScopeOpenID {
-			hasOpenID = true
-			break
-		}
-	}
-	if !hasOpenID {
-		filteredScopes = append(filteredScopes, ScopeOpenID)
-	}
-
-	// Default Cognito scopes if none specified
-	if len(filteredScopes) == 1 && filteredScopes[0] == ScopeOpenID {
-		filteredScopes = append(filteredScopes, ScopeEmail, ScopeProfile)
-	}
-
-	return &AuthParams{
-		URLValues: baseParams,
-		Scopes:    deduplicateScopes(filteredScopes),
-	}, nil
-}
-
-// AWS Cognito requires user pool and domain configuration.
-func (p *AWSCognitoProvider) ValidateConfig() error {
-	return p.BaseProvider.ValidateConfig()
-}

internal/providers/aws_cognito_test.go

@@ -1,295 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"testing"
-)
-
-// TestAWSCognitoProvider_NewAWSCognitoProvider tests the constructor
-func TestAWSCognitoProvider_NewAWSCognitoProvider(t *testing.T) {
-	provider := NewAWSCognitoProvider()
-
-	if provider == nil {
-		t.Fatal("Expected provider to be created, got nil")
-	}
-
-	if provider.BaseProvider == nil {
-		t.Error("BaseProvider should be initialized")
-	}
-}
-
-// TestAWSCognitoProvider_GetType tests provider type
-func TestAWSCognitoProvider_GetType(t *testing.T) {
-	provider := NewAWSCognitoProvider()
-
-	if provider.GetType() != ProviderTypeAWSCognito {
-		t.Errorf("Expected ProviderTypeAWSCognito, got %v", provider.GetType())
-	}
-}
-
-// TestAWSCognitoProvider_GetCapabilities tests AWS Cognito-specific capabilities
-func TestAWSCognitoProvider_GetCapabilities(t *testing.T) {
-	provider := NewAWSCognitoProvider()
-	capabilities := provider.GetCapabilities()
-
-	if !capabilities.SupportsRefreshTokens {
-		t.Error("Expected SupportsRefreshTokens to be true for AWS Cognito")
-	}
-
-	if capabilities.RequiresOfflineAccessScope {
-		t.Error("Expected RequiresOfflineAccessScope to be false for AWS Cognito")
-	}
-
-	if capabilities.RequiresPromptConsent {
-		t.Error("Expected RequiresPromptConsent to be false for AWS Cognito")
-	}
-
-	if capabilities.PreferredTokenValidation != "id" {
-		t.Errorf("Expected PreferredTokenValidation 'id', got '%s'", capabilities.PreferredTokenValidation)
-	}
-}
-
-// TestAWSCognitoProvider_BuildAuthParams tests AWS Cognito-specific auth params
-func TestAWSCognitoProvider_BuildAuthParams(t *testing.T) {
-	provider := NewAWSCognitoProvider()
-	baseParams := url.Values{}
-	baseParams.Set("client_id", "test_client")
-
-	tests := []struct {
-		name           string
-		scopes         []string
-		expectedScopes []string
-	}{
-		{
-			name:           "Remove offline_access scope and ensure openid",
-			scopes:         []string{"email", "profile", "offline_access"},
-			expectedScopes: []string{"email", "profile", "openid"},
-		},
-		{
-			name:           "Keep existing openid, remove offline_access",
-			scopes:         []string{"openid", "email", "offline_access", "profile"},
-			expectedScopes: []string{"openid", "email", "profile"},
-		},
-		{
-			name:           "Add default scopes when only openid",
-			scopes:         []string{"openid"},
-			expectedScopes: []string{"openid", "email", "profile"},
-		},
-		{
-			name:           "Add openid and defaults when empty",
-			scopes:         []string{},
-			expectedScopes: []string{"openid", "email", "profile"},
-		},
-		{
-			name:           "Cognito-specific scopes",
-			scopes:         []string{"aws.cognito.signin.user.admin", "phone"},
-			expectedScopes: []string{"aws.cognito.signin.user.admin", "phone", "openid"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			// Check that response_type is set
-			if authParams.URLValues.Get("response_type") != "code" {
-				t.Errorf("Expected response_type 'code', got '%s'", authParams.URLValues.Get("response_type"))
-			}
-
-			if len(authParams.Scopes) != len(tt.expectedScopes) {
-				t.Errorf("Expected %d scopes, got %d. Expected: %v, Got: %v",
-					len(tt.expectedScopes), len(authParams.Scopes), tt.expectedScopes, authParams.Scopes)
-				return
-			}
-
-			// Check that all expected scopes are present
-			for _, expectedScope := range tt.expectedScopes {
-				found := false
-				for _, actualScope := range authParams.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in %v", expectedScope, authParams.Scopes)
-				}
-			}
-
-			// Ensure offline_access is NOT present
-			for _, actualScope := range authParams.Scopes {
-				if actualScope == "offline_access" {
-					t.Error("offline_access scope should be filtered out for AWS Cognito")
-				}
-			}
-		})
-	}
-}
-
-// TestAWSCognitoProvider_ValidateConfig tests config validation
-func TestAWSCognitoProvider_ValidateConfig(t *testing.T) {
-	provider := NewAWSCognitoProvider()
-
-	err := provider.ValidateConfig()
-	if err != nil {
-		t.Errorf("ValidateConfig failed: %v", err)
-	}
-}
-
-// TestAWSCognitoProvider_InterfaceCompliance tests that AWS Cognito provider implements the OIDCProvider interface
-func TestAWSCognitoProvider_InterfaceCompliance(t *testing.T) {
-	var _ OIDCProvider = NewAWSCognitoProvider()
-}
-
-// TestAWSCognitoProvider_BaseProviderInheritance tests that AWS Cognito provider inherits from BaseProvider correctly
-func TestAWSCognitoProvider_BaseProviderInheritance(t *testing.T) {
-	provider := NewAWSCognitoProvider()
-
-	// Test that it has access to BaseProvider methods
-	if provider.BaseProvider == nil {
-		t.Error("Expected BaseProvider to be initialized")
-	}
-
-	// Test HandleTokenRefresh (inherited from BaseProvider)
-	err := provider.HandleTokenRefresh(&TokenResult{
-		IDToken:      "test-id-token",
-		AccessToken:  "test-access-token",
-		RefreshToken: "test-refresh-token",
-	})
-	if err != nil {
-		t.Errorf("HandleTokenRefresh failed: %v", err)
-	}
-}
-
-// TestAWSCognitoProvider_OfflineAccessFiltering tests that offline_access scope is always filtered out
-func TestAWSCognitoProvider_OfflineAccessFiltering(t *testing.T) {
-	provider := NewAWSCognitoProvider()
-	baseParams := url.Values{}
-
-	tests := []struct {
-		name   string
-		scopes []string
-	}{
-		{
-			name:   "Single offline_access",
-			scopes: []string{"offline_access"},
-		},
-		{
-			name:   "Multiple offline_access occurrences",
-			scopes: []string{"offline_access", "email", "offline_access", "profile"},
-		},
-		{
-			name:   "Mixed case",
-			scopes: []string{"OFFLINE_ACCESS", "email"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			// Ensure offline_access is NOT present in any form
-			for _, actualScope := range authParams.Scopes {
-				if actualScope == "offline_access" || actualScope == "OFFLINE_ACCESS" {
-					t.Errorf("offline_access scope should be filtered out, but found: %s", actualScope)
-				}
-			}
-		})
-	}
-}
-
-// TestAWSCognitoProvider_CognitoSpecificScopes tests AWS Cognito-specific scopes
-func TestAWSCognitoProvider_CognitoSpecificScopes(t *testing.T) {
-	provider := NewAWSCognitoProvider()
-	baseParams := url.Values{}
-
-	tests := []struct {
-		name     string
-		scopes   []string
-		checkFor []string
-	}{
-		{
-			name:     "Cognito admin scope",
-			scopes:   []string{"aws.cognito.signin.user.admin"},
-			checkFor: []string{"aws.cognito.signin.user.admin", "openid"},
-		},
-		{
-			name:     "Phone scope",
-			scopes:   []string{"phone"},
-			checkFor: []string{"phone", "openid"},
-		},
-		{
-			name:     "Address scope",
-			scopes:   []string{"address"},
-			checkFor: []string{"address", "openid"},
-		},
-		{
-			name:     "Multiple Cognito scopes",
-			scopes:   []string{"aws.cognito.signin.user.admin", "phone", "address"},
-			checkFor: []string{"aws.cognito.signin.user.admin", "phone", "address", "openid"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			for _, expectedScope := range tt.checkFor {
-				found := false
-				for _, actualScope := range authParams.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in %v", expectedScope, authParams.Scopes)
-				}
-			}
-		})
-	}
-}
-
-// TestAWSCognitoProvider_DefaultScopeHandling tests default scope behavior
-func TestAWSCognitoProvider_DefaultScopeHandling(t *testing.T) {
-	provider := NewAWSCognitoProvider()
-	baseParams := url.Values{}
-
-	// Test with only openid scope - should add defaults
-	authParams, err := provider.BuildAuthParams(baseParams, []string{"openid"})
-	if err != nil {
-		t.Errorf("BuildAuthParams failed: %v", err)
-		return
-	}
-
-	expectedScopes := []string{"openid", "email", "profile"}
-	if len(authParams.Scopes) != len(expectedScopes) {
-		t.Errorf("Expected %d scopes, got %d", len(expectedScopes), len(authParams.Scopes))
-		return
-	}
-
-	for _, expectedScope := range expectedScopes {
-		found := false
-		for _, actualScope := range authParams.Scopes {
-			if actualScope == expectedScope {
-				found = true
-				break
-			}
-		}
-		if !found {
-			t.Errorf("Expected default scope '%s' not found in %v", expectedScope, authParams.Scopes)
-		}
-	}
-}

internal/providers/azure.go

@@ -1,106 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"strings"
-	"time"
-)
-
-// AzureProvider encapsulates Azure AD-specific OIDC logic.
-type AzureProvider struct {
-	*BaseProvider
-}
-
-// NewAzureProvider creates a new instance of the AzureProvider.
-func NewAzureProvider() *AzureProvider {
-	return &AzureProvider{
-		BaseProvider: NewBaseProvider(),
-	}
-}
-
-// GetType returns the provider's type.
-func (p *AzureProvider) GetType() ProviderType {
-	return ProviderTypeAzure
-}
-
-// GetCapabilities returns the specific capabilities of the Azure provider.
-func (p *AzureProvider) GetCapabilities() ProviderCapabilities {
-	return ProviderCapabilities{
-		SupportsRefreshTokens:      true,
-		RequiresOfflineAccessScope: true,
-		PreferredTokenValidation:   "access",
-	}
-}
-
-// BuildAuthParams configures Azure-specific authentication parameters.
-func (p *AzureProvider) BuildAuthParams(baseParams url.Values, scopes []string) (*AuthParams, error) {
-	baseParams.Set("response_mode", "query")
-
-	hasOfflineAccess := false
-	for _, scope := range scopes {
-		if scope == ScopeOfflineAccess {
-			hasOfflineAccess = true
-			break
-		}
-	}
-	if !hasOfflineAccess {
-		scopes = append(scopes, ScopeOfflineAccess)
-	}
-
-	return &AuthParams{
-		URLValues: baseParams,
-		Scopes:    deduplicateScopes(scopes),
-	}, nil
-}
-
-// Azure may use access tokens for validation, and this method ensures that behavior is preserved.
-func (p *AzureProvider) ValidateTokens(session Session, verifier TokenVerifier, tokenCache TokenCache, refreshGracePeriod time.Duration) (*ValidationResult, error) {
-	if !session.GetAuthenticated() {
-		if session.GetRefreshToken() != "" {
-			return &ValidationResult{NeedsRefresh: true}, nil
-		}
-		return &ValidationResult{IsExpired: true}, nil
-	}
-
-	accessToken := session.GetAccessToken()
-	idToken := session.GetIDToken()
-
-	if accessToken != "" {
-		if strings.Count(accessToken, ".") == 2 {
-			if err := verifier.VerifyToken(accessToken); err != nil {
-				if idToken != "" {
-					return p.ValidateTokenExpiry(session, idToken, tokenCache, refreshGracePeriod)
-				}
-				if session.GetRefreshToken() != "" {
-					return &ValidationResult{NeedsRefresh: true}, nil
-				}
-				return &ValidationResult{IsExpired: true}, nil
-			}
-			return p.ValidateTokenExpiry(session, accessToken, tokenCache, refreshGracePeriod)
-		}
-		if idToken != "" {
-			return p.ValidateTokenExpiry(session, idToken, tokenCache, refreshGracePeriod)
-		}
-		return &ValidationResult{Authenticated: true}, nil
-	}
-
-	if idToken != "" {
-		if err := verifier.VerifyToken(idToken); err != nil {
-			if session.GetRefreshToken() != "" {
-				return &ValidationResult{NeedsRefresh: true}, nil
-			}
-			return &ValidationResult{IsExpired: true}, nil
-		}
-		return p.ValidateTokenExpiry(session, idToken, tokenCache, refreshGracePeriod)
-	}
-
-	if session.GetRefreshToken() != "" {
-		return &ValidationResult{NeedsRefresh: true}, nil
-	}
-	return &ValidationResult{IsExpired: true}, nil
-}
-
-// Azure requires specific tenant configuration and scope handling.
-func (p *AzureProvider) ValidateConfig() error {
-	return p.BaseProvider.ValidateConfig()
-}

internal/providers/azure_test.go

@@ -1,584 +0,0 @@
-package providers
-
-import (
-	"errors"
-	"net/url"
-	"strings"
-	"testing"
-	"time"
-)
-
-// TestAzureProvider_NewAzureProvider tests the constructor
-func TestAzureProvider_NewAzureProvider(t *testing.T) {
-	provider := NewAzureProvider()
-
-	if provider == nil {
-		t.Fatal("Expected provider to be created, got nil")
-	}
-
-	if provider.BaseProvider == nil {
-		t.Error("BaseProvider should be initialized")
-	}
-}
-
-// TestAzureProvider_GetType tests provider type
-func TestAzureProvider_GetType(t *testing.T) {
-	provider := NewAzureProvider()
-
-	if provider.GetType() != ProviderTypeAzure {
-		t.Errorf("Expected ProviderTypeAzure, got %v", provider.GetType())
-	}
-}
-
-// TestAzureProvider_GetCapabilities tests Azure-specific capabilities
-func TestAzureProvider_GetCapabilities(t *testing.T) {
-	provider := NewAzureProvider()
-	capabilities := provider.GetCapabilities()
-
-	if !capabilities.SupportsRefreshTokens {
-		t.Error("Expected SupportsRefreshTokens to be true")
-	}
-
-	if !capabilities.RequiresOfflineAccessScope {
-		t.Error("Expected RequiresOfflineAccessScope to be true for Azure")
-	}
-
-	if capabilities.RequiresPromptConsent {
-		t.Error("Expected RequiresPromptConsent to be false for Azure")
-	}
-
-	if capabilities.PreferredTokenValidation != "access" {
-		t.Errorf("Expected PreferredTokenValidation 'access', got '%s'", capabilities.PreferredTokenValidation)
-	}
-}
-
-// TestAzureProvider_BuildAuthParams tests Azure-specific auth parameters
-func TestAzureProvider_BuildAuthParams(t *testing.T) {
-	provider := NewAzureProvider()
-
-	tests := []struct {
-		name                   string
-		inputScopes            []string
-		expectedScopes         []string
-		shouldHaveResponseMode bool
-		shouldAddOfflineAccess bool
-	}{
-		{
-			name:                   "Basic scopes without offline_access",
-			inputScopes:            []string{"openid", "profile", "email"},
-			expectedScopes:         []string{"openid", "profile", "email", "offline_access"},
-			shouldHaveResponseMode: true,
-			shouldAddOfflineAccess: true,
-		},
-		{
-			name:                   "Scopes with offline_access already present",
-			inputScopes:            []string{"openid", "profile", "offline_access", "email"},
-			expectedScopes:         []string{"openid", "profile", "offline_access", "email"},
-			shouldHaveResponseMode: true,
-			shouldAddOfflineAccess: false,
-		},
-		{
-			name:                   "Only offline_access scope",
-			inputScopes:            []string{"offline_access"},
-			expectedScopes:         []string{"offline_access"},
-			shouldHaveResponseMode: true,
-			shouldAddOfflineAccess: false,
-		},
-		{
-			name:                   "Empty scopes (should add offline_access)",
-			inputScopes:            []string{},
-			expectedScopes:         []string{"offline_access"},
-			shouldHaveResponseMode: true,
-			shouldAddOfflineAccess: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			baseParams := make(url.Values)
-			baseParams.Set("client_id", "test-client")
-
-			result, err := provider.BuildAuthParams(baseParams, tt.inputScopes)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			// Check Azure-specific parameters
-			if tt.shouldHaveResponseMode {
-				if result.URLValues.Get("response_mode") != "query" {
-					t.Errorf("Expected response_mode 'query', got '%s'", result.URLValues.Get("response_mode"))
-				}
-			}
-
-			// Check scopes
-			if len(result.Scopes) != len(tt.expectedScopes) {
-				t.Errorf("Expected %d scopes, got %d", len(tt.expectedScopes), len(result.Scopes))
-			}
-
-			for _, expectedScope := range tt.expectedScopes {
-				found := false
-				for _, actualScope := range result.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in result", expectedScope)
-				}
-			}
-
-			// Verify offline_access is present
-			hasOfflineAccess := false
-			for _, scope := range result.Scopes {
-				if scope == "offline_access" {
-					hasOfflineAccess = true
-					break
-				}
-			}
-			if !hasOfflineAccess {
-				t.Error("Azure provider should always include offline_access scope")
-			}
-
-			// Verify original base parameters are preserved
-			if result.URLValues.Get("client_id") != "test-client" {
-				t.Errorf("Expected client_id 'test-client', got '%s'", result.URLValues.Get("client_id"))
-			}
-		})
-	}
-}
-
-// TestAzureProvider_ValidateTokens tests Azure-specific token validation logic
-func TestAzureProvider_ValidateTokens(t *testing.T) {
-	provider := NewAzureProvider()
-
-	tests := []struct {
-		verifierError  error
-		session        *mockSession
-		cacheData      map[string]interface{}
-		name           string
-		expectedResult ValidationResult
-	}{
-		{
-			name: "Unauthenticated with refresh token",
-			session: &mockSession{
-				authenticated: false,
-				refreshToken:  "refresh-token",
-			},
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "Unauthenticated without refresh token",
-			session: &mockSession{
-				authenticated: false,
-			},
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  false,
-				IsExpired:     true,
-			},
-		},
-		{
-			name: "JWT access token valid",
-			session: &mockSession{
-				authenticated: true,
-				accessToken:   "valid.jwt.token",
-				refreshToken:  "refresh-token",
-			},
-			verifierError: nil,
-			cacheData: map[string]interface{}{
-				"exp": float64(time.Now().Add(10 * time.Minute).Unix()),
-				"sub": "user123",
-			},
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  false,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "JWT access token invalid, valid ID token",
-			session: &mockSession{
-				authenticated: true,
-				accessToken:   "invalid.jwt.token",
-				idToken:       "valid.id.token",
-				refreshToken:  "refresh-token",
-			},
-			verifierError: errors.New("invalid token"),
-			cacheData: map[string]interface{}{
-				"exp": float64(time.Now().Add(10 * time.Minute).Unix()),
-				"sub": "user123",
-			},
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  false,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "Opaque access token with valid ID token",
-			session: &mockSession{
-				authenticated: true,
-				accessToken:   "opaque-token-no-dots",
-				idToken:       "valid.id.token",
-				refreshToken:  "refresh-token",
-			},
-			cacheData: map[string]interface{}{
-				"exp": float64(time.Now().Add(10 * time.Minute).Unix()),
-				"sub": "user123",
-			},
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  false,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "Opaque access token without ID token",
-			session: &mockSession{
-				authenticated: true,
-				accessToken:   "opaque-token-no-dots",
-				refreshToken:  "refresh-token",
-			},
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  false,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "No access token, valid ID token",
-			session: &mockSession{
-				authenticated: true,
-				idToken:       "valid.id.token",
-				refreshToken:  "refresh-token",
-			},
-			verifierError: nil,
-			cacheData: map[string]interface{}{
-				"exp": float64(time.Now().Add(10 * time.Minute).Unix()),
-				"sub": "user123",
-			},
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  false,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "No access token, invalid ID token, with refresh token",
-			session: &mockSession{
-				authenticated: true,
-				idToken:       "invalid.id.token",
-				refreshToken:  "refresh-token",
-			},
-			verifierError: errors.New("invalid token"),
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "No tokens, with refresh token",
-			session: &mockSession{
-				authenticated: true,
-				refreshToken:  "refresh-token",
-			},
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "No tokens, no refresh token",
-			session: &mockSession{
-				authenticated: true,
-			},
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  false,
-				IsExpired:     true,
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			verifier := &mockTokenVerifier{error: tt.verifierError}
-			cache := &mockTokenCache{claims: make(map[string]map[string]interface{})}
-
-			// Set up cache data
-			if tt.cacheData != nil {
-				if tt.session.accessToken != "" && strings.Count(tt.session.accessToken, ".") == 2 {
-					cache.claims[tt.session.accessToken] = tt.cacheData
-				}
-				if tt.session.idToken != "" {
-					cache.claims[tt.session.idToken] = tt.cacheData
-				}
-			}
-
-			result, err := provider.ValidateTokens(tt.session, verifier, cache, time.Minute)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			if result.Authenticated != tt.expectedResult.Authenticated {
-				t.Errorf("Expected Authenticated %v, got %v", tt.expectedResult.Authenticated, result.Authenticated)
-			}
-
-			if result.NeedsRefresh != tt.expectedResult.NeedsRefresh {
-				t.Errorf("Expected NeedsRefresh %v, got %v", tt.expectedResult.NeedsRefresh, result.NeedsRefresh)
-			}
-
-			if result.IsExpired != tt.expectedResult.IsExpired {
-				t.Errorf("Expected IsExpired %v, got %v", tt.expectedResult.IsExpired, result.IsExpired)
-			}
-		})
-	}
-}
-
-// TestAzureProvider_ValidateConfig tests configuration validation
-func TestAzureProvider_ValidateConfig(t *testing.T) {
-	provider := NewAzureProvider()
-
-	err := provider.ValidateConfig()
-
-	if err != nil {
-		t.Errorf("Expected no error, got %v", err)
-	}
-}
-
-// TestAzureProvider_InterfaceCompliance tests that Azure provider implements OIDCProvider
-func TestAzureProvider_InterfaceCompliance(t *testing.T) {
-	provider := NewAzureProvider()
-
-	// Verify it implements the OIDCProvider interface
-	var _ OIDCProvider = provider
-}
-
-// TestAzureProvider_OfflineAccessHandling tests comprehensive offline_access handling
-func TestAzureProvider_OfflineAccessHandling(t *testing.T) {
-	provider := NewAzureProvider()
-
-	tests := []struct {
-		name          string
-		description   string
-		inputScopes   []string
-		expectedCount int
-	}{
-		{
-			name:          "No offline_access - should add one",
-			inputScopes:   []string{"openid", "profile", "email"},
-			expectedCount: 1,
-			description:   "Should add offline_access when not present",
-		},
-		{
-			name:          "One offline_access - should preserve",
-			inputScopes:   []string{"openid", "offline_access", "profile"},
-			expectedCount: 1,
-			description:   "Should preserve existing offline_access",
-		},
-		{
-			name:          "Multiple offline_access - should deduplicate",
-			inputScopes:   []string{"openid", "offline_access", "profile", "offline_access"},
-			expectedCount: 1,
-			description:   "Should deduplicate multiple offline_access scopes",
-		},
-		{
-			name:          "Only offline_access",
-			inputScopes:   []string{"offline_access"},
-			expectedCount: 1,
-			description:   "Should preserve when only offline_access is present",
-		},
-		{
-			name:          "Empty scopes - should add offline_access",
-			inputScopes:   []string{},
-			expectedCount: 1,
-			description:   "Should add offline_access when no scopes provided",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			baseParams := make(url.Values)
-			result, err := provider.BuildAuthParams(baseParams, tt.inputScopes)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			// Count offline_access occurrences in result
-			offlineAccessCount := 0
-			for _, scope := range result.Scopes {
-				if scope == "offline_access" {
-					offlineAccessCount++
-				}
-			}
-
-			if offlineAccessCount != tt.expectedCount {
-				t.Errorf("Expected %d offline_access scopes in result, got %d", tt.expectedCount, offlineAccessCount)
-			}
-
-			// Ensure at least one offline_access is always present
-			if offlineAccessCount == 0 {
-				t.Error("Azure provider should always have at least one offline_access scope")
-			}
-
-			// Verify other scopes are preserved (except for the empty case)
-			if len(tt.inputScopes) > 0 {
-				for _, originalScope := range tt.inputScopes {
-					found := false
-					for _, resultScope := range result.Scopes {
-						if resultScope == originalScope {
-							found = true
-							break
-						}
-					}
-					if !found {
-						t.Errorf("Expected scope '%s' to be preserved", originalScope)
-					}
-				}
-			}
-		})
-	}
-}
-
-// TestAzureProvider_TokenValidationPriority tests access token vs ID token priority
-func TestAzureProvider_TokenValidationPriority(t *testing.T) {
-	provider := NewAzureProvider()
-
-	// Test that Azure prefers access tokens over ID tokens when both are JWT
-	session := &mockSession{
-		authenticated: true,
-		accessToken:   "valid.access.token",
-		idToken:       "valid.id.token",
-		refreshToken:  "refresh-token",
-	}
-
-	verifier := &mockTokenVerifier{} // Valid tokens
-	cache := &mockTokenCache{
-		claims: map[string]map[string]interface{}{
-			"valid.access.token": {
-				"exp": float64(time.Now().Add(10 * time.Minute).Unix()),
-				"sub": "user123",
-			},
-			"valid.id.token": {
-				"exp": float64(time.Now().Add(10 * time.Minute).Unix()),
-				"sub": "user123",
-			},
-		},
-	}
-
-	result, err := provider.ValidateTokens(session, verifier, cache, time.Minute)
-
-	if err != nil {
-		t.Errorf("Unexpected error: %v", err)
-	}
-
-	if !result.Authenticated {
-		t.Error("Should be authenticated with valid access token")
-	}
-
-	if result.NeedsRefresh {
-		t.Error("Should not need refresh with valid access token")
-	}
-}
-
-// TestAzureProvider_AuthParamsPreservation tests that base parameters are not overwritten
-func TestAzureProvider_AuthParamsPreservation(t *testing.T) {
-	provider := NewAzureProvider()
-
-	baseParams := make(url.Values)
-	baseParams.Set("client_id", "test-client")
-	baseParams.Set("redirect_uri", "https://example.com/callback")
-	baseParams.Set("response_type", "code")
-	baseParams.Set("state", "test-state")
-	baseParams.Set("nonce", "test-nonce")
-
-	scopes := []string{"openid", "profile"}
-
-	result, err := provider.BuildAuthParams(baseParams, scopes)
-	if err != nil {
-		t.Errorf("Unexpected error: %v", err)
-	}
-
-	// Verify all original parameters are preserved
-	expectedParams := map[string]string{
-		"client_id":     "test-client",
-		"redirect_uri":  "https://example.com/callback",
-		"response_type": "code",
-		"state":         "test-state",
-		"nonce":         "test-nonce",
-		"response_mode": "query", // Added by Azure provider
-	}
-
-	for key, expectedValue := range expectedParams {
-		actualValue := result.URLValues.Get(key)
-		if actualValue != expectedValue {
-			t.Errorf("Expected %s '%s', got '%s'", key, expectedValue, actualValue)
-		}
-	}
-
-	// Verify scopes (should include offline_access)
-	if len(result.Scopes) != 3 {
-		t.Errorf("Expected 3 scopes (including offline_access), got %d", len(result.Scopes))
-	}
-
-	expectedScopes := []string{"openid", "profile", "offline_access"}
-	for _, expectedScope := range expectedScopes {
-		found := false
-		for _, actualScope := range result.Scopes {
-			if actualScope == expectedScope {
-				found = true
-				break
-			}
-		}
-		if !found {
-			t.Errorf("Expected scope '%s' not found", expectedScope)
-		}
-	}
-}
-
-// Benchmark tests
-func BenchmarkAzureProvider_BuildAuthParams(b *testing.B) {
-	provider := NewAzureProvider()
-	baseParams := make(url.Values)
-	baseParams.Set("client_id", "test-client")
-	scopes := []string{"openid", "profile", "email"}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		provider.BuildAuthParams(baseParams, scopes)
-	}
-}
-
-func BenchmarkAzureProvider_ValidateTokens(b *testing.B) {
-	provider := NewAzureProvider()
-	session := &mockSession{
-		authenticated: true,
-		accessToken:   "valid.access.token",
-		idToken:       "valid.id.token",
-		refreshToken:  "refresh-token",
-	}
-	verifier := &mockTokenVerifier{}
-	cache := &mockTokenCache{
-		claims: map[string]map[string]interface{}{
-			"valid.access.token": {
-				"exp": float64(time.Now().Add(10 * time.Minute).Unix()),
-				"sub": "user123",
-			},
-		},
-	}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		provider.ValidateTokens(session, verifier, cache, time.Minute)
-	}
-}

internal/providers/base.go

@@ -1,155 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"strings"
-	"time"
-)
-
-// BaseProvider provides common functionality for all OIDC provider implementations.
-// It defines default behaviors that can be overridden by specific providers.
-// It can be embedded in specific provider structs to share common logic.
-type BaseProvider struct {
-}
-
-// GetType returns the default provider type (generic).
-// This should be overridden by specific provider implementations.
-func (p *BaseProvider) GetType() ProviderType {
-	return ProviderTypeGeneric
-}
-
-// GetCapabilities returns default provider capabilities.
-// This can be overridden by specific providers to declare their unique features.
-func (p *BaseProvider) GetCapabilities() ProviderCapabilities {
-	return ProviderCapabilities{
-		SupportsRefreshTokens:      true,
-		RequiresOfflineAccessScope: true,
-		PreferredTokenValidation:   "id",
-	}
-}
-
-// ValidateTokens performs basic token validation logic common to all providers.
-// It checks authentication state, token presence, and determines if refresh is needed.
-// This method can be extended or replaced by specific providers.
-func (p *BaseProvider) ValidateTokens(session Session, verifier TokenVerifier, tokenCache TokenCache, refreshGracePeriod time.Duration) (*ValidationResult, error) {
-	if !session.GetAuthenticated() {
-		if session.GetRefreshToken() != "" {
-			return &ValidationResult{NeedsRefresh: true}, nil
-		}
-		return &ValidationResult{}, nil
-	}
-
-	accessToken := session.GetAccessToken()
-	if accessToken == "" {
-		if session.GetRefreshToken() != "" {
-			return &ValidationResult{NeedsRefresh: true}, nil
-		}
-		return &ValidationResult{IsExpired: true}, nil
-	}
-
-	idToken := session.GetIDToken()
-	if idToken == "" {
-		if session.GetRefreshToken() != "" {
-			return &ValidationResult{Authenticated: true, NeedsRefresh: true}, nil
-		}
-		return &ValidationResult{Authenticated: true}, nil
-	}
-
-	if err := verifier.VerifyToken(idToken); err != nil {
-		if strings.Contains(err.Error(), "token has expired") {
-			if session.GetRefreshToken() != "" {
-				return &ValidationResult{NeedsRefresh: true}, nil
-			}
-			return &ValidationResult{IsExpired: true}, nil
-		}
-		if session.GetRefreshToken() != "" {
-			return &ValidationResult{NeedsRefresh: true}, nil
-		}
-		return &ValidationResult{IsExpired: true}, nil
-	}
-
-	return p.ValidateTokenExpiry(session, idToken, tokenCache, refreshGracePeriod)
-}
-
-// ValidateTokenExpiry checks if a token is expired or needs refresh based on cached claims.
-// This method is now exported so provider implementations can reuse this logic without duplication.
-func (p *BaseProvider) ValidateTokenExpiry(session Session, token string, tokenCache TokenCache, refreshGracePeriod time.Duration) (*ValidationResult, error) {
-	cachedClaims, found := tokenCache.Get(token)
-	if !found {
-		if session.GetRefreshToken() != "" {
-			return &ValidationResult{NeedsRefresh: true}, nil
-		}
-		return &ValidationResult{IsExpired: true}, nil
-	}
-
-	expClaim, ok := cachedClaims["exp"].(float64)
-	if !ok {
-		if session.GetRefreshToken() != "" {
-			return &ValidationResult{NeedsRefresh: true}, nil
-		}
-		return &ValidationResult{IsExpired: true}, nil
-	}
-
-	expTime := time.Unix(int64(expClaim), 0)
-	if expTime.Before(time.Now().Add(refreshGracePeriod)) {
-		if session.GetRefreshToken() != "" {
-			return &ValidationResult{Authenticated: true, NeedsRefresh: true}, nil
-		}
-		return &ValidationResult{Authenticated: true}, nil
-	}
-
-	return &ValidationResult{Authenticated: true}, nil
-}
-
-// BuildAuthParams constructs authorization parameters for the provider.
-// It includes the offline_access scope by default for refresh token support.
-func (p *BaseProvider) BuildAuthParams(baseParams url.Values, scopes []string) (*AuthParams, error) {
-	hasOfflineAccess := false
-	for _, scope := range scopes {
-		if scope == ScopeOfflineAccess {
-			hasOfflineAccess = true
-			break
-		}
-	}
-	if !hasOfflineAccess {
-		scopes = append(scopes, ScopeOfflineAccess)
-	}
-
-	return &AuthParams{
-		URLValues: baseParams,
-		Scopes:    deduplicateScopes(scopes),
-	}, nil
-}
-
-// HandleTokenRefresh processes provider-specific token refresh logic.
-// By default, it does nothing and assumes the standard token response is sufficient.
-func (p *BaseProvider) HandleTokenRefresh(tokenData *TokenResult) error {
-	return nil
-}
-
-// deduplicateScopes removes duplicate scopes from a slice while preserving order.
-func deduplicateScopes(scopes []string) []string {
-	seen := make(map[string]bool)
-	result := make([]string, 0, len(scopes))
-
-	for _, scope := range scopes {
-		if !seen[scope] {
-			seen[scope] = true
-			result = append(result, scope)
-		}
-	}
-
-	return result
-}
-
-// ValidateConfig checks provider-specific configuration requirements.
-// By default, it assumes the configuration is valid.
-func (p *BaseProvider) ValidateConfig() error {
-	return nil
-}
-
-// NewBaseProvider creates a new BaseProvider instance.
-// This can be used when a generic OIDC provider is sufficient.
-func NewBaseProvider() *BaseProvider {
-	return &BaseProvider{}
-}

internal/providers/base_test.go

@@ -1,652 +0,0 @@
-package providers
-
-import (
-	"errors"
-	"testing"
-	"time"
-)
-
-// Mock implementations for testing
-type mockSession struct {
-	idToken       string
-	accessToken   string
-	refreshToken  string
-	authenticated bool
-}
-
-func (s *mockSession) GetIDToken() string      { return s.idToken }
-func (s *mockSession) GetAccessToken() string  { return s.accessToken }
-func (s *mockSession) GetRefreshToken() string { return s.refreshToken }
-func (s *mockSession) GetAuthenticated() bool  { return s.authenticated }
-
-type mockTokenVerifier struct {
-	error error
-}
-
-func (v *mockTokenVerifier) VerifyToken(token string) error {
-	return v.error
-}
-
-type mockTokenCache struct {
-	claims map[string]map[string]interface{}
-}
-
-func (c *mockTokenCache) Get(key string) (map[string]interface{}, bool) {
-	claims, exists := c.claims[key]
-	return claims, exists
-}
-
-// TestBaseProvider_GetType tests the default provider type
-func TestBaseProvider_GetType(t *testing.T) {
-	provider := NewBaseProvider()
-
-	if provider.GetType() != ProviderTypeGeneric {
-		t.Errorf("Expected ProviderTypeGeneric, got %v", provider.GetType())
-	}
-}
-
-// TestBaseProvider_GetCapabilities tests the default capabilities
-func TestBaseProvider_GetCapabilities(t *testing.T) {
-	provider := NewBaseProvider()
-	capabilities := provider.GetCapabilities()
-
-	if !capabilities.SupportsRefreshTokens {
-		t.Error("Expected SupportsRefreshTokens to be true")
-	}
-
-	if !capabilities.RequiresOfflineAccessScope {
-		t.Error("Expected RequiresOfflineAccessScope to be true")
-	}
-
-	if capabilities.PreferredTokenValidation != "id" {
-		t.Errorf("Expected PreferredTokenValidation 'id', got '%s'", capabilities.PreferredTokenValidation)
-	}
-
-	if capabilities.RequiresPromptConsent {
-		t.Error("Expected RequiresPromptConsent to be false")
-	}
-}
-
-// TestBaseProvider_ValidateTokens_Unauthenticated tests validation when not authenticated
-func TestBaseProvider_ValidateTokens_Unauthenticated(t *testing.T) {
-	provider := NewBaseProvider()
-	session := &mockSession{authenticated: false}
-	verifier := &mockTokenVerifier{}
-	cache := &mockTokenCache{}
-
-	tests := []struct {
-		name           string
-		refreshToken   string
-		expectedResult ValidationResult
-	}{
-		{
-			name:         "No refresh token",
-			refreshToken: "",
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  false,
-				IsExpired:     false,
-			},
-		},
-		{
-			name:         "Has refresh token",
-			refreshToken: "refresh-token",
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			session.refreshToken = tt.refreshToken
-
-			result, err := provider.ValidateTokens(session, verifier, cache, time.Minute)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			if result.Authenticated != tt.expectedResult.Authenticated {
-				t.Errorf("Expected Authenticated %v, got %v", tt.expectedResult.Authenticated, result.Authenticated)
-			}
-
-			if result.NeedsRefresh != tt.expectedResult.NeedsRefresh {
-				t.Errorf("Expected NeedsRefresh %v, got %v", tt.expectedResult.NeedsRefresh, result.NeedsRefresh)
-			}
-
-			if result.IsExpired != tt.expectedResult.IsExpired {
-				t.Errorf("Expected IsExpired %v, got %v", tt.expectedResult.IsExpired, result.IsExpired)
-			}
-		})
-	}
-}
-
-// TestBaseProvider_ValidateTokens_AuthenticatedNoAccessToken tests authenticated session without access token
-func TestBaseProvider_ValidateTokens_AuthenticatedNoAccessToken(t *testing.T) {
-	provider := NewBaseProvider()
-	session := &mockSession{
-		authenticated: true,
-		accessToken:   "", // No access token
-	}
-	verifier := &mockTokenVerifier{}
-	cache := &mockTokenCache{}
-
-	tests := []struct {
-		name           string
-		refreshToken   string
-		expectedResult ValidationResult
-	}{
-		{
-			name:         "No access token, no refresh token",
-			refreshToken: "",
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  false,
-				IsExpired:     true,
-			},
-		},
-		{
-			name:         "No access token, has refresh token",
-			refreshToken: "refresh-token",
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			session.refreshToken = tt.refreshToken
-
-			result, err := provider.ValidateTokens(session, verifier, cache, time.Minute)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			if result.Authenticated != tt.expectedResult.Authenticated {
-				t.Errorf("Expected Authenticated %v, got %v", tt.expectedResult.Authenticated, result.Authenticated)
-			}
-
-			if result.NeedsRefresh != tt.expectedResult.NeedsRefresh {
-				t.Errorf("Expected NeedsRefresh %v, got %v", tt.expectedResult.NeedsRefresh, result.NeedsRefresh)
-			}
-
-			if result.IsExpired != tt.expectedResult.IsExpired {
-				t.Errorf("Expected IsExpired %v, got %v", tt.expectedResult.IsExpired, result.IsExpired)
-			}
-		})
-	}
-}
-
-// TestBaseProvider_ValidateTokens_AuthenticatedNoIDToken tests authenticated session without ID token
-func TestBaseProvider_ValidateTokens_AuthenticatedNoIDToken(t *testing.T) {
-	provider := NewBaseProvider()
-	session := &mockSession{
-		authenticated: true,
-		accessToken:   "access-token",
-		idToken:       "", // No ID token
-	}
-	verifier := &mockTokenVerifier{}
-	cache := &mockTokenCache{}
-
-	tests := []struct {
-		name           string
-		refreshToken   string
-		expectedResult ValidationResult
-	}{
-		{
-			name:         "No ID token, no refresh token",
-			refreshToken: "",
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  false,
-				IsExpired:     false,
-			},
-		},
-		{
-			name:         "No ID token, has refresh token",
-			refreshToken: "refresh-token",
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			session.refreshToken = tt.refreshToken
-
-			result, err := provider.ValidateTokens(session, verifier, cache, time.Minute)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			if result.Authenticated != tt.expectedResult.Authenticated {
-				t.Errorf("Expected Authenticated %v, got %v", tt.expectedResult.Authenticated, result.Authenticated)
-			}
-
-			if result.NeedsRefresh != tt.expectedResult.NeedsRefresh {
-				t.Errorf("Expected NeedsRefresh %v, got %v", tt.expectedResult.NeedsRefresh, result.NeedsRefresh)
-			}
-
-			if result.IsExpired != tt.expectedResult.IsExpired {
-				t.Errorf("Expected IsExpired %v, got %v", tt.expectedResult.IsExpired, result.IsExpired)
-			}
-		})
-	}
-}
-
-// TestBaseProvider_ValidateTokens_TokenVerificationFailure tests token verification failures
-func TestBaseProvider_ValidateTokens_TokenVerificationFailure(t *testing.T) {
-	provider := NewBaseProvider()
-	session := &mockSession{
-		authenticated: true,
-		accessToken:   "access-token",
-		idToken:       "id-token",
-	}
-	cache := &mockTokenCache{}
-
-	tests := []struct {
-		name           string
-		verifierError  error
-		refreshToken   string
-		expectedResult ValidationResult
-	}{
-		{
-			name:          "Token expired, has refresh token",
-			verifierError: errors.New("token has expired"),
-			refreshToken:  "refresh-token",
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-		{
-			name:          "Token expired, no refresh token",
-			verifierError: errors.New("token has expired"),
-			refreshToken:  "",
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  false,
-				IsExpired:     true,
-			},
-		},
-		{
-			name:          "Other verification error, has refresh token",
-			verifierError: errors.New("invalid signature"),
-			refreshToken:  "refresh-token",
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-		{
-			name:          "Other verification error, no refresh token",
-			verifierError: errors.New("invalid signature"),
-			refreshToken:  "",
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  false,
-				IsExpired:     true,
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			verifier := &mockTokenVerifier{error: tt.verifierError}
-			session.refreshToken = tt.refreshToken
-
-			result, err := provider.ValidateTokens(session, verifier, cache, time.Minute)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			if result.Authenticated != tt.expectedResult.Authenticated {
-				t.Errorf("Expected Authenticated %v, got %v", tt.expectedResult.Authenticated, result.Authenticated)
-			}
-
-			if result.NeedsRefresh != tt.expectedResult.NeedsRefresh {
-				t.Errorf("Expected NeedsRefresh %v, got %v", tt.expectedResult.NeedsRefresh, result.NeedsRefresh)
-			}
-
-			if result.IsExpired != tt.expectedResult.IsExpired {
-				t.Errorf("Expected IsExpired %v, got %v", tt.expectedResult.IsExpired, result.IsExpired)
-			}
-		})
-	}
-}
-
-// TestBaseProvider_ValidateTokenExpiry tests token expiry validation logic
-func TestBaseProvider_ValidateTokenExpiry(t *testing.T) {
-	provider := NewBaseProvider()
-	session := &mockSession{refreshToken: "refresh-token"}
-
-	now := time.Now()
-	gracePeriod := 5 * time.Minute
-
-	tests := []struct {
-		claims         map[string]interface{}
-		name           string
-		expectedResult ValidationResult
-		cacheFound     bool
-	}{
-		{
-			name:       "Token not found in cache, has refresh token",
-			claims:     nil,
-			cacheFound: false,
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-		{
-			name:       "Claims without exp, has refresh token",
-			claims:     map[string]interface{}{"sub": "user123"},
-			cacheFound: true,
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "Token expired (beyond grace period), has refresh token",
-			claims: map[string]interface{}{
-				"exp": float64(now.Add(-10 * time.Minute).Unix()),
-			},
-			cacheFound: true,
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "Token expires within grace period, has refresh token",
-			claims: map[string]interface{}{
-				"exp": float64(now.Add(2 * time.Minute).Unix()),
-			},
-			cacheFound: true,
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "Token valid (beyond grace period)",
-			claims: map[string]interface{}{
-				"exp": float64(now.Add(10 * time.Minute).Unix()),
-			},
-			cacheFound: true,
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  false,
-				IsExpired:     false,
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cache := &mockTokenCache{claims: make(map[string]map[string]interface{})}
-			if tt.cacheFound {
-				cache.claims["test-token"] = tt.claims
-			}
-
-			result, err := provider.ValidateTokenExpiry(session, "test-token", cache, gracePeriod)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			if result.Authenticated != tt.expectedResult.Authenticated {
-				t.Errorf("Expected Authenticated %v, got %v", tt.expectedResult.Authenticated, result.Authenticated)
-			}
-
-			if result.NeedsRefresh != tt.expectedResult.NeedsRefresh {
-				t.Errorf("Expected NeedsRefresh %v, got %v", tt.expectedResult.NeedsRefresh, result.NeedsRefresh)
-			}
-
-			if result.IsExpired != tt.expectedResult.IsExpired {
-				t.Errorf("Expected IsExpired %v, got %v", tt.expectedResult.IsExpired, result.IsExpired)
-			}
-		})
-	}
-}
-
-// TestBaseProvider_ValidateTokenExpiry_NoRefreshToken tests expiry validation without refresh token
-func TestBaseProvider_ValidateTokenExpiry_NoRefreshToken(t *testing.T) {
-	provider := NewBaseProvider()
-	session := &mockSession{refreshToken: ""} // No refresh token
-
-	now := time.Now()
-	gracePeriod := 5 * time.Minute
-
-	tests := []struct {
-		claims         map[string]interface{}
-		name           string
-		expectedResult ValidationResult
-		cacheFound     bool
-	}{
-		{
-			name:       "Token not found in cache, no refresh token",
-			claims:     nil,
-			cacheFound: false,
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  false,
-				IsExpired:     true,
-			},
-		},
-		{
-			name:       "Claims without exp, no refresh token",
-			claims:     map[string]interface{}{"sub": "user123"},
-			cacheFound: true,
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  false,
-				IsExpired:     true,
-			},
-		},
-		{
-			name: "Token expires within grace period, no refresh token",
-			claims: map[string]interface{}{
-				"exp": float64(now.Add(2 * time.Minute).Unix()),
-			},
-			cacheFound: true,
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  false,
-				IsExpired:     false,
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cache := &mockTokenCache{claims: make(map[string]map[string]interface{})}
-			if tt.cacheFound {
-				cache.claims["test-token"] = tt.claims
-			}
-
-			result, err := provider.ValidateTokenExpiry(session, "test-token", cache, gracePeriod)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			if result.Authenticated != tt.expectedResult.Authenticated {
-				t.Errorf("Expected Authenticated %v, got %v", tt.expectedResult.Authenticated, result.Authenticated)
-			}
-
-			if result.NeedsRefresh != tt.expectedResult.NeedsRefresh {
-				t.Errorf("Expected NeedsRefresh %v, got %v", tt.expectedResult.NeedsRefresh, result.NeedsRefresh)
-			}
-
-			if result.IsExpired != tt.expectedResult.IsExpired {
-				t.Errorf("Expected IsExpired %v, got %v", tt.expectedResult.IsExpired, result.IsExpired)
-			}
-		})
-	}
-}
-
-// TestBaseProvider_BuildAuthParams tests authorization parameter building
-func TestBaseProvider_BuildAuthParams(t *testing.T) {
-	provider := NewBaseProvider()
-
-	tests := []struct {
-		name           string
-		scopes         []string
-		expectedScopes []string
-	}{
-		{
-			name:           "No existing offline_access scope",
-			scopes:         []string{"openid", "profile", "email"},
-			expectedScopes: []string{"openid", "profile", "email", "offline_access"},
-		},
-		{
-			name:           "Existing offline_access scope",
-			scopes:         []string{"openid", "profile", "offline_access", "email"},
-			expectedScopes: []string{"openid", "profile", "offline_access", "email"},
-		},
-		{
-			name:           "Empty scopes",
-			scopes:         []string{},
-			expectedScopes: []string{"offline_access"},
-		},
-		{
-			name:           "Only offline_access",
-			scopes:         []string{"offline_access"},
-			expectedScopes: []string{"offline_access"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			baseParams := make(map[string][]string)
-			baseParams["client_id"] = []string{"test-client"}
-
-			result, err := provider.BuildAuthParams(baseParams, tt.scopes)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			if len(result.Scopes) != len(tt.expectedScopes) {
-				t.Errorf("Expected %d scopes, got %d", len(tt.expectedScopes), len(result.Scopes))
-			}
-
-			// Check that all expected scopes are present
-			for _, expectedScope := range tt.expectedScopes {
-				found := false
-				for _, actualScope := range result.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in result", expectedScope)
-				}
-			}
-
-			// Verify base parameters are preserved
-			if result.URLValues.Get("client_id") != "test-client" {
-				t.Errorf("Expected client_id 'test-client', got '%s'", result.URLValues.Get("client_id"))
-			}
-		})
-	}
-}
-
-// TestBaseProvider_HandleTokenRefresh tests token refresh handling
-func TestBaseProvider_HandleTokenRefresh(t *testing.T) {
-	provider := NewBaseProvider()
-	tokenData := &TokenResult{
-		IDToken:      "new-id-token",
-		AccessToken:  "new-access-token",
-		RefreshToken: "new-refresh-token",
-	}
-
-	// Base provider should do nothing and return no error
-	err := provider.HandleTokenRefresh(tokenData)
-
-	if err != nil {
-		t.Errorf("Expected no error, got %v", err)
-	}
-}
-
-// TestBaseProvider_ValidateConfig tests configuration validation
-func TestBaseProvider_ValidateConfig(t *testing.T) {
-	provider := NewBaseProvider()
-
-	// Base provider should always return valid configuration
-	err := provider.ValidateConfig()
-
-	if err != nil {
-		t.Errorf("Expected no error, got %v", err)
-	}
-}
-
-// TestNewBaseProvider tests the constructor
-func TestNewBaseProvider(t *testing.T) {
-	provider := NewBaseProvider()
-
-	if provider == nil {
-		t.Fatal("Expected provider to be created, got nil")
-	}
-
-	// Verify it implements the OIDCProvider interface
-	var _ OIDCProvider = provider
-}
-
-// Benchmark tests
-func BenchmarkBaseProvider_ValidateTokens(b *testing.B) {
-	provider := NewBaseProvider()
-	session := &mockSession{
-		authenticated: true,
-		idToken:       "test-token",
-		accessToken:   "access-token",
-		refreshToken:  "refresh-token",
-	}
-	verifier := &mockTokenVerifier{}
-	cache := &mockTokenCache{
-		claims: map[string]map[string]interface{}{
-			"test-token": {
-				"exp": float64(time.Now().Add(10 * time.Minute).Unix()),
-				"sub": "user123",
-			},
-		},
-	}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		provider.ValidateTokens(session, verifier, cache, time.Minute)
-	}
-}
-
-func BenchmarkBaseProvider_BuildAuthParams(b *testing.B) {
-	provider := NewBaseProvider()
-	baseParams := make(map[string][]string)
-	baseParams["client_id"] = []string{"test-client"}
-	scopes := []string{"openid", "profile", "email"}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		provider.BuildAuthParams(baseParams, scopes)
-	}
-}

internal/providers/factory.go

@@ -1,150 +0,0 @@
-package providers
-
-import (
-	"fmt"
-	"net/url"
-	"strings"
-)
-
-// ProviderFactory encapsulates the logic for creating and configuring OIDC providers.
-type ProviderFactory struct {
-	registry *ProviderRegistry
-}
-
-// NewProviderFactory creates a new factory with a pre-configured registry.
-func NewProviderFactory() *ProviderFactory {
-	registry := NewProviderRegistry()
-
-	registry.RegisterProvider(NewGenericProvider())
-	registry.RegisterProvider(NewGoogleProvider())
-	registry.RegisterProvider(NewAzureProvider())
-	registry.RegisterProvider(NewGitHubProvider())
-	registry.RegisterProvider(NewAuth0Provider())
-	registry.RegisterProvider(NewOktaProvider())
-	registry.RegisterProvider(NewKeycloakProvider())
-	registry.RegisterProvider(NewAWSCognitoProvider())
-	registry.RegisterProvider(NewGitLabProvider())
-
-	return &ProviderFactory{
-		registry: registry,
-	}
-}
-
-// CreateProvider creates an OIDC provider based on the issuer URL.
-// It automatically detects the provider type and returns a configured instance.
-func (f *ProviderFactory) CreateProvider(issuerURL string) (OIDCProvider, error) {
-	if issuerURL == "" {
-		return nil, fmt.Errorf("issuer URL cannot be empty")
-	}
-
-	parsedURL, err := url.Parse(issuerURL)
-	if err != nil {
-		return nil, fmt.Errorf("invalid issuer URL format: %w", err)
-	}
-
-	// Check if the URL has a valid scheme and host
-	if parsedURL.Scheme == "" || parsedURL.Host == "" {
-		return nil, fmt.Errorf("invalid issuer URL format: URL must have a valid scheme and host")
-	}
-
-	provider := f.registry.DetectProvider(issuerURL)
-	if provider == nil {
-		return nil, fmt.Errorf("unable to detect provider for issuer URL: %s", issuerURL)
-	}
-
-	if err := provider.ValidateConfig(); err != nil {
-		return nil, fmt.Errorf("provider configuration validation failed: %w", err)
-	}
-
-	return provider, nil
-}
-
-// CreateProviderByType creates a provider instance of the specified type.
-// This is useful when you want to force a specific provider type regardless of URL.
-func (f *ProviderFactory) CreateProviderByType(providerType ProviderType) (OIDCProvider, error) {
-	var provider OIDCProvider
-
-	switch providerType {
-	case ProviderTypeGeneric:
-		provider = NewGenericProvider()
-	case ProviderTypeGoogle:
-		provider = NewGoogleProvider()
-	case ProviderTypeAzure:
-		provider = NewAzureProvider()
-	case ProviderTypeGitHub:
-		provider = NewGitHubProvider()
-	case ProviderTypeAuth0:
-		provider = NewAuth0Provider()
-	case ProviderTypeOkta:
-		provider = NewOktaProvider()
-	case ProviderTypeKeycloak:
-		provider = NewKeycloakProvider()
-	case ProviderTypeAWSCognito:
-		provider = NewAWSCognitoProvider()
-	case ProviderTypeGitLab:
-		provider = NewGitLabProvider()
-	default:
-		return nil, fmt.Errorf("unsupported provider type: %d", providerType)
-	}
-
-	if err := provider.ValidateConfig(); err != nil {
-		return nil, fmt.Errorf("provider configuration validation failed: %w", err)
-	}
-
-	return provider, nil
-}
-
-// GetSupportedProviders returns a list of all supported provider types and their detection patterns.
-func (f *ProviderFactory) GetSupportedProviders() map[ProviderType][]string {
-	return map[ProviderType][]string{
-		ProviderTypeGeneric:    {"*"},
-		ProviderTypeGoogle:     {"accounts.google.com"},
-		ProviderTypeAzure:      {"login.microsoftonline.com", "sts.windows.net"},
-		ProviderTypeGitHub:     {"github.com"},
-		ProviderTypeAuth0:      {".auth0.com"},
-		ProviderTypeOkta:       {".okta.com", ".oktapreview.com", ".okta-emea.com"},
-		ProviderTypeKeycloak:   {"keycloak"},
-		ProviderTypeAWSCognito: {"cognito-idp", ".amazonaws.com"},
-		ProviderTypeGitLab:     {"gitlab.com"},
-	}
-}
-
-// DetectProviderType determines the provider type for a given issuer URL.
-// This is useful for diagnostic purposes or UI display.
-func (f *ProviderFactory) DetectProviderType(issuerURL string) (ProviderType, error) {
-	provider, err := f.CreateProvider(issuerURL)
-	if err != nil {
-		return ProviderTypeGeneric, err
-	}
-	return provider.GetType(), nil
-}
-
-// IsProviderSupported checks if a given issuer URL is supported by any registered provider.
-func (f *ProviderFactory) IsProviderSupported(issuerURL string) bool {
-	if issuerURL == "" {
-		return false
-	}
-
-	normalizedURL, err := url.Parse(issuerURL)
-	if err != nil {
-		return false
-	}
-
-	// Check if the URL has a valid scheme and host
-	if normalizedURL.Scheme == "" || normalizedURL.Host == "" {
-		return false
-	}
-
-	host := strings.ToLower(normalizedURL.Host)
-	supportedProviders := f.GetSupportedProviders()
-
-	for _, patterns := range supportedProviders {
-		for _, pattern := range patterns {
-			if pattern == "*" || strings.Contains(host, strings.ToLower(pattern)) {
-				return true
-			}
-		}
-	}
-
-	return false
-}

internal/providers/factory_test.go

@@ -1,624 +0,0 @@
-package providers
-
-import (
-	"strings"
-	"testing"
-)
-
-// TestProviderFactory_NewProviderFactory tests the factory constructor
-func TestProviderFactory_NewProviderFactory(t *testing.T) {
-	factory := NewProviderFactory()
-
-	if factory == nil {
-		t.Fatal("Expected factory to be created, got nil")
-	}
-
-	if factory.registry == nil {
-		t.Error("Expected registry to be initialized")
-	}
-}
-
-// TestProviderFactory_CreateProvider tests provider creation by issuer URL
-func TestProviderFactory_CreateProvider(t *testing.T) {
-	factory := NewProviderFactory()
-
-	tests := []struct {
-		name         string
-		issuerURL    string
-		errMsg       string
-		expectedType ProviderType
-		wantErr      bool
-	}{
-		{
-			name:         "Google provider",
-			issuerURL:    "https://accounts.google.com",
-			expectedType: ProviderTypeGoogle,
-			wantErr:      false,
-		},
-		{
-			name:         "Google provider with path",
-			issuerURL:    "https://accounts.google.com/oauth2",
-			expectedType: ProviderTypeGoogle,
-			wantErr:      false,
-		},
-		{
-			name:         "Azure provider - login.microsoftonline.com",
-			issuerURL:    "https://login.microsoftonline.com/tenant-id/v2.0",
-			expectedType: ProviderTypeAzure,
-			wantErr:      false,
-		},
-		{
-			name:         "Azure provider - sts.windows.net",
-			issuerURL:    "https://sts.windows.net/tenant-id",
-			expectedType: ProviderTypeAzure,
-			wantErr:      false,
-		},
-		{
-			name:         "GitHub provider",
-			issuerURL:    "https://github.com/login/oauth",
-			expectedType: ProviderTypeGitHub,
-			wantErr:      false,
-		},
-		{
-			name:         "Auth0 provider",
-			issuerURL:    "https://tenant.auth0.com",
-			expectedType: ProviderTypeAuth0,
-			wantErr:      false,
-		},
-		{
-			name:         "Okta provider",
-			issuerURL:    "https://tenant.okta.com",
-			expectedType: ProviderTypeOkta,
-			wantErr:      false,
-		},
-		{
-			name:         "Okta preview provider",
-			issuerURL:    "https://tenant.oktapreview.com",
-			expectedType: ProviderTypeOkta,
-			wantErr:      false,
-		},
-		{
-			name:         "Keycloak provider",
-			issuerURL:    "https://auth.example.com/auth/realms/master",
-			expectedType: ProviderTypeKeycloak,
-			wantErr:      false,
-		},
-		{
-			name:         "AWS Cognito provider",
-			issuerURL:    "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_example",
-			expectedType: ProviderTypeAWSCognito,
-			wantErr:      false,
-		},
-		{
-			name:         "GitLab provider",
-			issuerURL:    "https://gitlab.com/oauth",
-			expectedType: ProviderTypeGitLab,
-			wantErr:      false,
-		},
-		{
-			name:         "Generic provider",
-			issuerURL:    "https://auth.example.com",
-			expectedType: ProviderTypeGeneric,
-			wantErr:      false,
-		},
-		{
-			name:      "Empty issuer URL",
-			issuerURL: "",
-			wantErr:   true,
-			errMsg:    "issuer URL cannot be empty",
-		},
-		{
-			name:      "Invalid URL format",
-			issuerURL: "not-a-url",
-			wantErr:   true,
-			errMsg:    "invalid issuer URL format",
-		},
-		{
-			name:      "URL without scheme",
-			issuerURL: "example.com",
-			wantErr:   true,
-			errMsg:    "invalid issuer URL format",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			provider, err := factory.CreateProvider(tt.issuerURL)
-
-			if tt.wantErr {
-				if err == nil {
-					t.Error("Expected error but got none")
-					return
-				}
-				if !strings.Contains(err.Error(), tt.errMsg) {
-					t.Errorf("Expected error containing '%s', got '%s'", tt.errMsg, err.Error())
-				}
-				return
-			}
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-				return
-			}
-
-			if provider == nil {
-				t.Fatal("Expected provider to be created, got nil")
-			}
-
-			if provider.GetType() != tt.expectedType {
-				t.Errorf("Expected provider type %v, got %v", tt.expectedType, provider.GetType())
-			}
-		})
-	}
-}
-
-// TestProviderFactory_CreateProviderByType tests provider creation by type
-func TestProviderFactory_CreateProviderByType(t *testing.T) {
-	factory := NewProviderFactory()
-
-	tests := []struct {
-		name         string
-		errMsg       string
-		providerType ProviderType
-		expectedType ProviderType
-		wantErr      bool
-	}{
-		{
-			name:         "Generic provider",
-			providerType: ProviderTypeGeneric,
-			expectedType: ProviderTypeGeneric,
-			wantErr:      false,
-		},
-		{
-			name:         "Google provider",
-			providerType: ProviderTypeGoogle,
-			expectedType: ProviderTypeGoogle,
-			wantErr:      false,
-		},
-		{
-			name:         "Azure provider",
-			providerType: ProviderTypeAzure,
-			expectedType: ProviderTypeAzure,
-			wantErr:      false,
-		},
-		{
-			name:         "GitHub provider",
-			providerType: ProviderTypeGitHub,
-			expectedType: ProviderTypeGitHub,
-			wantErr:      false,
-		},
-		{
-			name:         "Auth0 provider",
-			providerType: ProviderTypeAuth0,
-			expectedType: ProviderTypeAuth0,
-			wantErr:      false,
-		},
-		{
-			name:         "Okta provider",
-			providerType: ProviderTypeOkta,
-			expectedType: ProviderTypeOkta,
-			wantErr:      false,
-		},
-		{
-			name:         "Keycloak provider",
-			providerType: ProviderTypeKeycloak,
-			expectedType: ProviderTypeKeycloak,
-			wantErr:      false,
-		},
-		{
-			name:         "AWS Cognito provider",
-			providerType: ProviderTypeAWSCognito,
-			expectedType: ProviderTypeAWSCognito,
-			wantErr:      false,
-		},
-		{
-			name:         "GitLab provider",
-			providerType: ProviderTypeGitLab,
-			expectedType: ProviderTypeGitLab,
-			wantErr:      false,
-		},
-		{
-			name:         "Invalid provider type",
-			providerType: ProviderType(999),
-			wantErr:      true,
-			errMsg:       "unsupported provider type",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			provider, err := factory.CreateProviderByType(tt.providerType)
-
-			if tt.wantErr {
-				if err == nil {
-					t.Error("Expected error but got none")
-					return
-				}
-				if !strings.Contains(err.Error(), tt.errMsg) {
-					t.Errorf("Expected error containing '%s', got '%s'", tt.errMsg, err.Error())
-				}
-				return
-			}
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-				return
-			}
-
-			if provider == nil {
-				t.Fatal("Expected provider to be created, got nil")
-			}
-
-			if provider.GetType() != tt.expectedType {
-				t.Errorf("Expected provider type %v, got %v", tt.expectedType, provider.GetType())
-			}
-		})
-	}
-}
-
-// TestProviderFactory_GetSupportedProviders tests listing supported providers
-func TestProviderFactory_GetSupportedProviders(t *testing.T) {
-	factory := NewProviderFactory()
-	supported := factory.GetSupportedProviders()
-
-	// Verify expected provider types are present
-	expectedTypes := []ProviderType{
-		ProviderTypeGeneric,
-		ProviderTypeGoogle,
-		ProviderTypeAzure,
-	}
-
-	for _, expectedType := range expectedTypes {
-		if _, exists := supported[expectedType]; !exists {
-			t.Errorf("Expected provider type %v to be supported", expectedType)
-		}
-	}
-
-	// Verify Google patterns
-	googlePatterns := supported[ProviderTypeGoogle]
-	if len(googlePatterns) != 1 || googlePatterns[0] != "accounts.google.com" {
-		t.Errorf("Expected Google patterns ['accounts.google.com'], got %v", googlePatterns)
-	}
-
-	// Verify Azure patterns
-	azurePatterns := supported[ProviderTypeAzure]
-	expectedAzurePatterns := []string{"login.microsoftonline.com", "sts.windows.net"}
-	if len(azurePatterns) != len(expectedAzurePatterns) {
-		t.Errorf("Expected %d Azure patterns, got %d", len(expectedAzurePatterns), len(azurePatterns))
-	}
-
-	for _, expectedPattern := range expectedAzurePatterns {
-		found := false
-		for _, pattern := range azurePatterns {
-			if pattern == expectedPattern {
-				found = true
-				break
-			}
-		}
-		if !found {
-			t.Errorf("Expected Azure pattern '%s' not found", expectedPattern)
-		}
-	}
-
-	// Verify Generic patterns
-	genericPatterns := supported[ProviderTypeGeneric]
-	if len(genericPatterns) != 1 || genericPatterns[0] != "*" {
-		t.Errorf("Expected Generic patterns ['*'], got %v", genericPatterns)
-	}
-}
-
-// TestProviderFactory_DetectProviderType tests provider type detection
-func TestProviderFactory_DetectProviderType(t *testing.T) {
-	factory := NewProviderFactory()
-
-	tests := []struct {
-		name         string
-		issuerURL    string
-		expectedType ProviderType
-		wantErr      bool
-	}{
-		{
-			name:         "Google provider detection",
-			issuerURL:    "https://accounts.google.com",
-			expectedType: ProviderTypeGoogle,
-			wantErr:      false,
-		},
-		{
-			name:         "Azure provider detection",
-			issuerURL:    "https://login.microsoftonline.com/tenant/v2.0",
-			expectedType: ProviderTypeAzure,
-			wantErr:      false,
-		},
-		{
-			name:         "Generic provider detection",
-			issuerURL:    "https://auth.example.com",
-			expectedType: ProviderTypeGeneric,
-			wantErr:      false,
-		},
-		{
-			name:      "Invalid URL",
-			issuerURL: "not-a-url",
-			wantErr:   true,
-		},
-		{
-			name:      "Empty URL",
-			issuerURL: "",
-			wantErr:   true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			providerType, err := factory.DetectProviderType(tt.issuerURL)
-
-			if tt.wantErr {
-				if err == nil {
-					t.Error("Expected error but got none")
-				}
-				return
-			}
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-				return
-			}
-
-			if providerType != tt.expectedType {
-				t.Errorf("Expected provider type %v, got %v", tt.expectedType, providerType)
-			}
-		})
-	}
-}
-
-// TestProviderFactory_IsProviderSupported tests provider support checking
-func TestProviderFactory_IsProviderSupported(t *testing.T) {
-	factory := NewProviderFactory()
-
-	tests := []struct {
-		name      string
-		issuerURL string
-		expected  bool
-	}{
-		{
-			name:      "Google provider supported",
-			issuerURL: "https://accounts.google.com",
-			expected:  true,
-		},
-		{
-			name:      "Google provider with subdomain supported",
-			issuerURL: "https://accounts.google.com/oauth2",
-			expected:  true,
-		},
-		{
-			name:      "Azure login.microsoftonline.com supported",
-			issuerURL: "https://login.microsoftonline.com/tenant/v2.0",
-			expected:  true,
-		},
-		{
-			name:      "Azure sts.windows.net supported",
-			issuerURL: "https://sts.windows.net/tenant",
-			expected:  true,
-		},
-		{
-			name:      "Generic provider supported (wildcard)",
-			issuerURL: "https://auth.example.com",
-			expected:  true,
-		},
-		{
-			name:      "Any valid URL supported (wildcard)",
-			issuerURL: "https://custom-auth.company.org",
-			expected:  true,
-		},
-		{
-			name:      "Empty URL not supported",
-			issuerURL: "",
-			expected:  false,
-		},
-		{
-			name:      "Invalid URL format not supported",
-			issuerURL: "not-a-url",
-			expected:  false,
-		},
-		{
-			name:      "URL without scheme not supported",
-			issuerURL: "example.com",
-			expected:  false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := factory.IsProviderSupported(tt.issuerURL)
-
-			if result != tt.expected {
-				t.Errorf("Expected %v, got %v", tt.expected, result)
-			}
-		})
-	}
-}
-
-// TestProviderFactory_IntegrationTest tests the full flow
-func TestProviderFactory_IntegrationTest(t *testing.T) {
-	factory := NewProviderFactory()
-
-	// Test Google provider flow
-	t.Run("Google Provider Flow", func(t *testing.T) {
-		// Check if supported
-		if !factory.IsProviderSupported("https://accounts.google.com") {
-			t.Error("Google provider should be supported")
-		}
-
-		// Detect type
-		providerType, err := factory.DetectProviderType("https://accounts.google.com")
-		if err != nil {
-			t.Errorf("Unexpected error detecting Google provider: %v", err)
-		}
-		if providerType != ProviderTypeGoogle {
-			t.Errorf("Expected ProviderTypeGoogle, got %v", providerType)
-		}
-
-		// Create provider by URL
-		provider, err := factory.CreateProvider("https://accounts.google.com")
-		if err != nil {
-			t.Errorf("Unexpected error creating Google provider: %v", err)
-		}
-		if provider.GetType() != ProviderTypeGoogle {
-			t.Errorf("Expected ProviderTypeGoogle, got %v", provider.GetType())
-		}
-
-		// Create provider by type
-		provider2, err := factory.CreateProviderByType(ProviderTypeGoogle)
-		if err != nil {
-			t.Errorf("Unexpected error creating Google provider by type: %v", err)
-		}
-		if provider2.GetType() != ProviderTypeGoogle {
-			t.Errorf("Expected ProviderTypeGoogle, got %v", provider2.GetType())
-		}
-	})
-
-	// Test Azure provider flow
-	t.Run("Azure Provider Flow", func(t *testing.T) {
-		azureURL := "https://login.microsoftonline.com/tenant/v2.0"
-
-		// Check if supported
-		if !factory.IsProviderSupported(azureURL) {
-			t.Error("Azure provider should be supported")
-		}
-
-		// Detect type
-		providerType, err := factory.DetectProviderType(azureURL)
-		if err != nil {
-			t.Errorf("Unexpected error detecting Azure provider: %v", err)
-		}
-		if providerType != ProviderTypeAzure {
-			t.Errorf("Expected ProviderTypeAzure, got %v", providerType)
-		}
-
-		// Create provider
-		provider, err := factory.CreateProvider(azureURL)
-		if err != nil {
-			t.Errorf("Unexpected error creating Azure provider: %v", err)
-		}
-		if provider.GetType() != ProviderTypeAzure {
-			t.Errorf("Expected ProviderTypeAzure, got %v", provider.GetType())
-		}
-	})
-
-	// Test Generic provider flow
-	t.Run("Generic Provider Flow", func(t *testing.T) {
-		genericURL := "https://auth.custom-provider.com"
-
-		// Check if supported
-		if !factory.IsProviderSupported(genericURL) {
-			t.Error("Generic provider should be supported")
-		}
-
-		// Detect type
-		providerType, err := factory.DetectProviderType(genericURL)
-		if err != nil {
-			t.Errorf("Unexpected error detecting generic provider: %v", err)
-		}
-		if providerType != ProviderTypeGeneric {
-			t.Errorf("Expected ProviderTypeGeneric, got %v", providerType)
-		}
-
-		// Create provider
-		provider, err := factory.CreateProvider(genericURL)
-		if err != nil {
-			t.Errorf("Unexpected error creating generic provider: %v", err)
-		}
-		if provider.GetType() != ProviderTypeGeneric {
-			t.Errorf("Expected ProviderTypeGeneric, got %v", provider.GetType())
-		}
-	})
-}
-
-// TestProviderFactory_CaseInsensitiveHostMatching tests case insensitive host matching
-func TestProviderFactory_CaseInsensitiveHostMatching(t *testing.T) {
-	factory := NewProviderFactory()
-
-	tests := []struct {
-		name         string
-		issuerURL    string
-		expectedType ProviderType
-	}{
-		{
-			name:         "Google with uppercase",
-			issuerURL:    "https://ACCOUNTS.GOOGLE.COM",
-			expectedType: ProviderTypeGoogle,
-		},
-		{
-			name:         "Google with mixed case",
-			issuerURL:    "https://Accounts.Google.Com",
-			expectedType: ProviderTypeGoogle,
-		},
-		{
-			name:         "Azure with uppercase",
-			issuerURL:    "https://LOGIN.MICROSOFTONLINE.COM/tenant",
-			expectedType: ProviderTypeAzure,
-		},
-		{
-			name:         "Azure STS with mixed case",
-			issuerURL:    "https://Sts.Windows.Net/tenant",
-			expectedType: ProviderTypeAzure,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Should be supported
-			if !factory.IsProviderSupported(tt.issuerURL) {
-				t.Errorf("URL %s should be supported", tt.issuerURL)
-			}
-
-			// Should detect correct type
-			providerType, err := factory.DetectProviderType(tt.issuerURL)
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-			if providerType != tt.expectedType {
-				t.Errorf("Expected %v, got %v", tt.expectedType, providerType)
-			}
-
-			// Should create correct provider
-			provider, err := factory.CreateProvider(tt.issuerURL)
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-			if provider.GetType() != tt.expectedType {
-				t.Errorf("Expected %v, got %v", tt.expectedType, provider.GetType())
-			}
-		})
-	}
-}
-
-// Benchmark tests
-func BenchmarkProviderFactory_CreateProvider(b *testing.B) {
-	factory := NewProviderFactory()
-	issuerURL := "https://accounts.google.com"
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		factory.CreateProvider(issuerURL)
-	}
-}
-
-func BenchmarkProviderFactory_IsProviderSupported(b *testing.B) {
-	factory := NewProviderFactory()
-	issuerURL := "https://auth.example.com"
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		factory.IsProviderSupported(issuerURL)
-	}
-}
-
-func BenchmarkProviderFactory_DetectProviderType(b *testing.B) {
-	factory := NewProviderFactory()
-	issuerURL := "https://login.microsoftonline.com/tenant"
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		factory.DetectProviderType(issuerURL)
-	}
-}

internal/providers/generic.go

@@ -1,18 +0,0 @@
-package providers
-
-// GenericProvider encapsulates standard OIDC logic for any compliant provider.
-type GenericProvider struct {
-	*BaseProvider
-}
-
-// NewGenericProvider creates a new instance of the GenericProvider.
-func NewGenericProvider() *GenericProvider {
-	return &GenericProvider{
-		BaseProvider: NewBaseProvider(),
-	}
-}
-
-// GetType returns the provider's type.
-func (p *GenericProvider) GetType() ProviderType {
-	return ProviderTypeGeneric
-}

internal/providers/generic_test.go

@@ -1,246 +0,0 @@
-package providers
-
-import (
-	"testing"
-)
-
-// TestGenericProvider_NewGenericProvider tests the constructor
-func TestGenericProvider_NewGenericProvider(t *testing.T) {
-	provider := NewGenericProvider()
-
-	if provider == nil {
-		t.Fatal("Expected provider to be created, got nil")
-	}
-
-	if provider.BaseProvider == nil {
-		t.Error("BaseProvider should be initialized")
-	}
-}
-
-// TestGenericProvider_GetType tests provider type
-func TestGenericProvider_GetType(t *testing.T) {
-	provider := NewGenericProvider()
-
-	if provider.GetType() != ProviderTypeGeneric {
-		t.Errorf("Expected ProviderTypeGeneric, got %v", provider.GetType())
-	}
-}
-
-// TestGenericProvider_GetCapabilities tests that it inherits BaseProvider capabilities
-func TestGenericProvider_GetCapabilities(t *testing.T) {
-	provider := NewGenericProvider()
-	capabilities := provider.GetCapabilities()
-
-	// Should have the same capabilities as BaseProvider
-	baseProvider := NewBaseProvider()
-	baseCapabilities := baseProvider.GetCapabilities()
-
-	if capabilities.SupportsRefreshTokens != baseCapabilities.SupportsRefreshTokens {
-		t.Errorf("Expected SupportsRefreshTokens %v, got %v",
-			baseCapabilities.SupportsRefreshTokens, capabilities.SupportsRefreshTokens)
-	}
-
-	if capabilities.RequiresOfflineAccessScope != baseCapabilities.RequiresOfflineAccessScope {
-		t.Errorf("Expected RequiresOfflineAccessScope %v, got %v",
-			baseCapabilities.RequiresOfflineAccessScope, capabilities.RequiresOfflineAccessScope)
-	}
-
-	if capabilities.PreferredTokenValidation != baseCapabilities.PreferredTokenValidation {
-		t.Errorf("Expected PreferredTokenValidation %v, got %v",
-			baseCapabilities.PreferredTokenValidation, capabilities.PreferredTokenValidation)
-	}
-
-	if capabilities.RequiresPromptConsent != baseCapabilities.RequiresPromptConsent {
-		t.Errorf("Expected RequiresPromptConsent %v, got %v",
-			baseCapabilities.RequiresPromptConsent, capabilities.RequiresPromptConsent)
-	}
-}
-
-// TestGenericProvider_InterfaceCompliance tests that Generic provider implements OIDCProvider
-func TestGenericProvider_InterfaceCompliance(t *testing.T) {
-	provider := NewGenericProvider()
-
-	// Verify it implements the OIDCProvider interface
-	var _ OIDCProvider = provider
-}
-
-// TestGenericProvider_InheritsBaseProviderBehavior tests inherited functionality
-func TestGenericProvider_InheritsBaseProviderBehavior(t *testing.T) {
-	provider := NewGenericProvider()
-	baseProvider := NewBaseProvider()
-
-	// Test BuildAuthParams behavior is the same
-	scopes := []string{"openid", "profile", "email"}
-	baseParams := make(map[string][]string)
-	baseParams["client_id"] = []string{"test-client"}
-
-	genericResult, genericErr := provider.BuildAuthParams(baseParams, scopes)
-	baseResult, baseErr := baseProvider.BuildAuthParams(baseParams, scopes)
-
-	if (genericErr == nil) != (baseErr == nil) {
-		t.Errorf("BuildAuthParams error mismatch: generic=%v, base=%v", genericErr, baseErr)
-	}
-
-	if genericErr == nil && baseErr == nil {
-		// Compare scopes length (offline_access should be added)
-		if len(genericResult.Scopes) != len(baseResult.Scopes) {
-			t.Errorf("BuildAuthParams scope count mismatch: generic=%d, base=%d",
-				len(genericResult.Scopes), len(baseResult.Scopes))
-		}
-
-		// Verify offline_access is added in both cases
-		genericHasOffline := false
-		baseHasOffline := false
-
-		for _, scope := range genericResult.Scopes {
-			if scope == "offline_access" {
-				genericHasOffline = true
-				break
-			}
-		}
-
-		for _, scope := range baseResult.Scopes {
-			if scope == "offline_access" {
-				baseHasOffline = true
-				break
-			}
-		}
-
-		if genericHasOffline != baseHasOffline {
-			t.Errorf("offline_access scope handling mismatch: generic=%v, base=%v",
-				genericHasOffline, baseHasOffline)
-		}
-	}
-
-	// Test ValidateConfig behavior is the same
-	genericConfigErr := provider.ValidateConfig()
-	baseConfigErr := baseProvider.ValidateConfig()
-
-	if (genericConfigErr == nil) != (baseConfigErr == nil) {
-		t.Errorf("ValidateConfig error mismatch: generic=%v, base=%v", genericConfigErr, baseConfigErr)
-	}
-
-	// Test HandleTokenRefresh behavior is the same
-	tokenData := &TokenResult{IDToken: "test-token"}
-	genericRefreshErr := provider.HandleTokenRefresh(tokenData)
-	baseRefreshErr := baseProvider.HandleTokenRefresh(tokenData)
-
-	if (genericRefreshErr == nil) != (baseRefreshErr == nil) {
-		t.Errorf("HandleTokenRefresh error mismatch: generic=%v, base=%v",
-			genericRefreshErr, baseRefreshErr)
-	}
-}
-
-// TestGenericProvider_ValidateTokens tests token validation inheritance
-func TestGenericProvider_ValidateTokens(t *testing.T) {
-	provider := NewGenericProvider()
-
-	tests := []struct {
-		verifierError  error
-		session        *mockSession
-		name           string
-		expectedResult ValidationResult
-	}{
-		{
-			name: "Unauthenticated with refresh token",
-			session: &mockSession{
-				authenticated: false,
-				refreshToken:  "refresh-token",
-			},
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "Authenticated with valid tokens",
-			session: &mockSession{
-				authenticated: true,
-				idToken:       "valid-token",
-				accessToken:   "access-token",
-				refreshToken:  "refresh-token",
-			},
-			verifierError: nil,
-			expectedResult: ValidationResult{
-				Authenticated: true,
-				NeedsRefresh:  false,
-				IsExpired:     false,
-			},
-		},
-		{
-			name: "Authenticated with invalid token, has refresh",
-			session: &mockSession{
-				authenticated: true,
-				idToken:       "invalid-token",
-				refreshToken:  "refresh-token",
-			},
-			verifierError: &testError{"token expired"},
-			expectedResult: ValidationResult{
-				Authenticated: false,
-				NeedsRefresh:  true,
-				IsExpired:     false,
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			verifier := &mockTokenVerifier{error: tt.verifierError}
-			cache := &mockTokenCache{
-				claims: map[string]map[string]interface{}{
-					"valid-token": {
-						"exp": float64(9999999999), // Far future
-						"sub": "user123",
-					},
-				},
-			}
-
-			result, err := provider.ValidateTokens(tt.session, verifier, cache, 0)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			if result.Authenticated != tt.expectedResult.Authenticated {
-				t.Errorf("Expected Authenticated %v, got %v", tt.expectedResult.Authenticated, result.Authenticated)
-			}
-
-			if result.NeedsRefresh != tt.expectedResult.NeedsRefresh {
-				t.Errorf("Expected NeedsRefresh %v, got %v", tt.expectedResult.NeedsRefresh, result.NeedsRefresh)
-			}
-
-			if result.IsExpired != tt.expectedResult.IsExpired {
-				t.Errorf("Expected IsExpired %v, got %v", tt.expectedResult.IsExpired, result.IsExpired)
-			}
-		})
-	}
-}
-
-// Benchmark tests
-func BenchmarkGenericProvider_GetType(b *testing.B) {
-	provider := NewGenericProvider()
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		provider.GetType()
-	}
-}
-
-func BenchmarkGenericProvider_GetCapabilities(b *testing.B) {
-	provider := NewGenericProvider()
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		provider.GetCapabilities()
-	}
-}
-
-// Test error type for testing
-type testError struct {
-	message string
-}
-
-func (e *testError) Error() string {
-	return e.message
-}

internal/providers/github.go

@@ -1,61 +0,0 @@
-package providers
-
-import (
-	"net/url"
-)
-
-// GitHubProvider encapsulates GitHub-specific OIDC logic.
-type GitHubProvider struct {
-	*BaseProvider
-}
-
-// NewGitHubProvider creates a new instance of the GitHubProvider.
-func NewGitHubProvider() *GitHubProvider {
-	return &GitHubProvider{
-		BaseProvider: NewBaseProvider(),
-	}
-}
-
-// GetType returns the provider's type.
-func (p *GitHubProvider) GetType() ProviderType {
-	return ProviderTypeGitHub
-}
-
-// GetCapabilities returns the specific capabilities of the GitHub provider.
-// WARNING: GitHub does NOT support OpenID Connect - it's OAuth 2.0 only.
-// This provider should only be used for OAuth flows, not OIDC authentication.
-func (p *GitHubProvider) GetCapabilities() ProviderCapabilities {
-	return ProviderCapabilities{
-		SupportsRefreshTokens:      false, // GitHub OAuth apps don't support refresh tokens
-		RequiresOfflineAccessScope: false, // GitHub doesn't use offline_access
-		RequiresPromptConsent:      false,
-		PreferredTokenValidation:   "access", // GitHub only provides access tokens, no ID tokens
-	}
-}
-
-// BuildAuthParams configures GitHub-specific authentication parameters.
-func (p *GitHubProvider) BuildAuthParams(baseParams url.Values, scopes []string) (*AuthParams, error) {
-	// GitHub doesn't use offline_access scope, so remove it if present
-	var filteredScopes []string
-	for _, scope := range scopes {
-		if scope != ScopeOfflineAccess {
-			filteredScopes = append(filteredScopes, scope)
-		}
-	}
-
-	// If no scopes specified, use default GitHub scopes for OAuth
-	// Note: GitHub doesn't support 'openid' scope as it's not an OIDC provider
-	if len(filteredScopes) == 0 {
-		filteredScopes = []string{"user:email", "read:user"}
-	}
-
-	return &AuthParams{
-		URLValues: baseParams,
-		Scopes:    deduplicateScopes(filteredScopes),
-	}, nil
-}
-
-// GitHub requires specific configuration for proper operation.
-func (p *GitHubProvider) ValidateConfig() error {
-	return p.BaseProvider.ValidateConfig()
-}

internal/providers/github_test.go

@@ -1,110 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"testing"
-)
-
-// TestGitHubProvider_NewGitHubProvider tests the constructor
-func TestGitHubProvider_NewGitHubProvider(t *testing.T) {
-	provider := NewGitHubProvider()
-
-	if provider == nil {
-		t.Fatal("Expected provider to be created, got nil")
-	}
-
-	if provider.BaseProvider == nil {
-		t.Error("BaseProvider should be initialized")
-	}
-}
-
-// TestGitHubProvider_GetType tests provider type
-func TestGitHubProvider_GetType(t *testing.T) {
-	provider := NewGitHubProvider()
-
-	if provider.GetType() != ProviderTypeGitHub {
-		t.Errorf("Expected ProviderTypeGitHub, got %v", provider.GetType())
-	}
-}
-
-// TestGitHubProvider_GetCapabilities tests GitHub-specific capabilities
-func TestGitHubProvider_GetCapabilities(t *testing.T) {
-	provider := NewGitHubProvider()
-	capabilities := provider.GetCapabilities()
-
-	if capabilities.SupportsRefreshTokens {
-		t.Error("Expected SupportsRefreshTokens to be false for GitHub")
-	}
-
-	if capabilities.RequiresOfflineAccessScope {
-		t.Error("Expected RequiresOfflineAccessScope to be false for GitHub")
-	}
-
-	if capabilities.RequiresPromptConsent {
-		t.Error("Expected RequiresPromptConsent to be false for GitHub")
-	}
-
-	if capabilities.PreferredTokenValidation != "access" {
-		t.Errorf("Expected PreferredTokenValidation 'access', got '%s'", capabilities.PreferredTokenValidation)
-	}
-}
-
-// TestGitHubProvider_BuildAuthParams tests GitHub-specific auth params
-func TestGitHubProvider_BuildAuthParams(t *testing.T) {
-	provider := NewGitHubProvider()
-	baseParams := url.Values{}
-	baseParams.Set("client_id", "test_client")
-
-	tests := []struct {
-		name           string
-		scopes         []string
-		expectedScopes []string
-	}{
-		{
-			name:           "Remove offline_access scope",
-			scopes:         []string{"user:email", "offline_access", "read:user"},
-			expectedScopes: []string{"user:email", "read:user"},
-		},
-		{
-			name:           "Default scopes when none provided",
-			scopes:         []string{},
-			expectedScopes: []string{"user:email", "read:user"},
-		},
-		{
-			name:           "Keep other scopes",
-			scopes:         []string{"user", "repo"},
-			expectedScopes: []string{"user", "repo"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			if len(authParams.Scopes) != len(tt.expectedScopes) {
-				t.Errorf("Expected %d scopes, got %d", len(tt.expectedScopes), len(authParams.Scopes))
-				return
-			}
-
-			for i, scope := range tt.expectedScopes {
-				if authParams.Scopes[i] != scope {
-					t.Errorf("Expected scope '%s', got '%s'", scope, authParams.Scopes[i])
-				}
-			}
-		})
-	}
-}
-
-// TestGitHubProvider_ValidateConfig tests config validation
-func TestGitHubProvider_ValidateConfig(t *testing.T) {
-	provider := NewGitHubProvider()
-
-	err := provider.ValidateConfig()
-	if err != nil {
-		t.Errorf("ValidateConfig failed: %v", err)
-	}
-}

internal/providers/gitlab.go

@@ -1,73 +0,0 @@
-package providers
-
-import (
-	"net/url"
-)
-
-// GitLabProvider encapsulates GitLab-specific OIDC logic.
-type GitLabProvider struct {
-	*BaseProvider
-}
-
-// NewGitLabProvider creates a new instance of the GitLabProvider.
-func NewGitLabProvider() *GitLabProvider {
-	return &GitLabProvider{
-		BaseProvider: NewBaseProvider(),
-	}
-}
-
-// GetType returns the provider's type.
-func (p *GitLabProvider) GetType() ProviderType {
-	return ProviderTypeGitLab
-}
-
-// GetCapabilities returns the specific capabilities of the GitLab provider.
-func (p *GitLabProvider) GetCapabilities() ProviderCapabilities {
-	return ProviderCapabilities{
-		SupportsRefreshTokens:      true,
-		RequiresOfflineAccessScope: false, // GitLab doesn't use offline_access scope
-		RequiresPromptConsent:      false,
-		PreferredTokenValidation:   "id", // GitLab typically uses ID tokens
-	}
-}
-
-// BuildAuthParams configures GitLab-specific authentication parameters.
-func (p *GitLabProvider) BuildAuthParams(baseParams url.Values, scopes []string) (*AuthParams, error) {
-	// GitLab supports standard OAuth 2.0 parameters
-	baseParams.Set("response_type", "code")
-
-	// Remove offline_access scope as GitLab doesn't use it
-	var filteredScopes []string
-	for _, scope := range scopes {
-		if scope != ScopeOfflineAccess {
-			filteredScopes = append(filteredScopes, scope)
-		}
-	}
-
-	// Ensure openid scope is present for OIDC
-	hasOpenID := false
-	for _, scope := range filteredScopes {
-		if scope == ScopeOpenID {
-			hasOpenID = true
-			break
-		}
-	}
-	if !hasOpenID {
-		filteredScopes = append(filteredScopes, ScopeOpenID)
-	}
-
-	// Default GitLab scopes if none specified
-	if len(filteredScopes) == 1 && filteredScopes[0] == ScopeOpenID {
-		filteredScopes = append(filteredScopes, ScopeProfile, ScopeEmail)
-	}
-
-	return &AuthParams{
-		URLValues: baseParams,
-		Scopes:    deduplicateScopes(filteredScopes),
-	}, nil
-}
-
-// GitLab requires application configuration and proper redirect URIs.
-func (p *GitLabProvider) ValidateConfig() error {
-	return p.BaseProvider.ValidateConfig()
-}

internal/providers/gitlab_test.go

@@ -1,322 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"testing"
-)
-
-// TestGitLabProvider_NewGitLabProvider tests the constructor
-func TestGitLabProvider_NewGitLabProvider(t *testing.T) {
-	provider := NewGitLabProvider()
-
-	if provider == nil {
-		t.Fatal("Expected provider to be created, got nil")
-	}
-
-	if provider.BaseProvider == nil {
-		t.Error("BaseProvider should be initialized")
-	}
-}
-
-// TestGitLabProvider_GetType tests provider type
-func TestGitLabProvider_GetType(t *testing.T) {
-	provider := NewGitLabProvider()
-
-	if provider.GetType() != ProviderTypeGitLab {
-		t.Errorf("Expected ProviderTypeGitLab, got %v", provider.GetType())
-	}
-}
-
-// TestGitLabProvider_GetCapabilities tests GitLab-specific capabilities
-func TestGitLabProvider_GetCapabilities(t *testing.T) {
-	provider := NewGitLabProvider()
-	capabilities := provider.GetCapabilities()
-
-	if !capabilities.SupportsRefreshTokens {
-		t.Error("Expected SupportsRefreshTokens to be true for GitLab")
-	}
-
-	if capabilities.RequiresOfflineAccessScope {
-		t.Error("Expected RequiresOfflineAccessScope to be false for GitLab")
-	}
-
-	if capabilities.RequiresPromptConsent {
-		t.Error("Expected RequiresPromptConsent to be false for GitLab")
-	}
-
-	if capabilities.PreferredTokenValidation != "id" {
-		t.Errorf("Expected PreferredTokenValidation 'id', got '%s'", capabilities.PreferredTokenValidation)
-	}
-}
-
-// TestGitLabProvider_BuildAuthParams tests GitLab-specific auth params
-func TestGitLabProvider_BuildAuthParams(t *testing.T) {
-	provider := NewGitLabProvider()
-	baseParams := url.Values{}
-	baseParams.Set("client_id", "test_client")
-
-	tests := []struct {
-		name           string
-		scopes         []string
-		expectedScopes []string
-	}{
-		{
-			name:           "Remove offline_access scope and ensure openid",
-			scopes:         []string{"read_user", "read_api", "offline_access"},
-			expectedScopes: []string{"read_user", "read_api", "openid"},
-		},
-		{
-			name:           "Keep existing openid, remove offline_access",
-			scopes:         []string{"openid", "read_user", "offline_access", "profile"},
-			expectedScopes: []string{"openid", "read_user", "profile"},
-		},
-		{
-			name:           "Add default scopes when only openid",
-			scopes:         []string{"openid"},
-			expectedScopes: []string{"openid", "profile", "email"},
-		},
-		{
-			name:           "Add openid and defaults when empty",
-			scopes:         []string{},
-			expectedScopes: []string{"openid", "profile", "email"},
-		},
-		{
-			name:           "GitLab-specific scopes",
-			scopes:         []string{"read_user", "read_api", "read_repository"},
-			expectedScopes: []string{"read_user", "read_api", "read_repository", "openid"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			// Check that response_type is set
-			if authParams.URLValues.Get("response_type") != "code" {
-				t.Errorf("Expected response_type 'code', got '%s'", authParams.URLValues.Get("response_type"))
-			}
-
-			if len(authParams.Scopes) != len(tt.expectedScopes) {
-				t.Errorf("Expected %d scopes, got %d. Expected: %v, Got: %v",
-					len(tt.expectedScopes), len(authParams.Scopes), tt.expectedScopes, authParams.Scopes)
-				return
-			}
-
-			// Check that all expected scopes are present
-			for _, expectedScope := range tt.expectedScopes {
-				found := false
-				for _, actualScope := range authParams.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in %v", expectedScope, authParams.Scopes)
-				}
-			}
-
-			// Ensure offline_access is NOT present
-			for _, actualScope := range authParams.Scopes {
-				if actualScope == "offline_access" {
-					t.Error("offline_access scope should be filtered out for GitLab")
-				}
-			}
-		})
-	}
-}
-
-// TestGitLabProvider_ValidateConfig tests config validation
-func TestGitLabProvider_ValidateConfig(t *testing.T) {
-	provider := NewGitLabProvider()
-
-	err := provider.ValidateConfig()
-	if err != nil {
-		t.Errorf("ValidateConfig failed: %v", err)
-	}
-}
-
-// TestGitLabProvider_InterfaceCompliance tests that GitLab provider implements the OIDCProvider interface
-func TestGitLabProvider_InterfaceCompliance(t *testing.T) {
-	var _ OIDCProvider = NewGitLabProvider()
-}
-
-// TestGitLabProvider_BaseProviderInheritance tests that GitLab provider inherits from BaseProvider correctly
-func TestGitLabProvider_BaseProviderInheritance(t *testing.T) {
-	provider := NewGitLabProvider()
-
-	// Test that it has access to BaseProvider methods
-	if provider.BaseProvider == nil {
-		t.Error("Expected BaseProvider to be initialized")
-	}
-
-	// Test HandleTokenRefresh (inherited from BaseProvider)
-	err := provider.HandleTokenRefresh(&TokenResult{
-		IDToken:      "test-id-token",
-		AccessToken:  "test-access-token",
-		RefreshToken: "test-refresh-token",
-	})
-	if err != nil {
-		t.Errorf("HandleTokenRefresh failed: %v", err)
-	}
-}
-
-// TestGitLabProvider_OfflineAccessFiltering tests that offline_access scope is always filtered out
-func TestGitLabProvider_OfflineAccessFiltering(t *testing.T) {
-	provider := NewGitLabProvider()
-	baseParams := url.Values{}
-
-	tests := []struct {
-		name   string
-		scopes []string
-	}{
-		{
-			name:   "Single offline_access",
-			scopes: []string{"offline_access"},
-		},
-		{
-			name:   "Multiple offline_access occurrences",
-			scopes: []string{"offline_access", "read_user", "offline_access", "profile"},
-		},
-		{
-			name:   "Mixed with other scopes",
-			scopes: []string{"read_api", "offline_access", "read_user"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			// Ensure offline_access is NOT present
-			for _, actualScope := range authParams.Scopes {
-				if actualScope == "offline_access" {
-					t.Error("offline_access scope should be filtered out for GitLab")
-				}
-			}
-		})
-	}
-}
-
-// TestGitLabProvider_GitLabSpecificScopes tests GitLab-specific scopes
-func TestGitLabProvider_GitLabSpecificScopes(t *testing.T) {
-	provider := NewGitLabProvider()
-	baseParams := url.Values{}
-
-	tests := []struct {
-		name     string
-		scopes   []string
-		checkFor []string
-	}{
-		{
-			name:     "GitLab API scopes",
-			scopes:   []string{"read_api", "read_user"},
-			checkFor: []string{"read_api", "read_user", "openid"},
-		},
-		{
-			name:     "GitLab repository scopes",
-			scopes:   []string{"read_repository", "write_repository"},
-			checkFor: []string{"read_repository", "write_repository", "openid"},
-		},
-		{
-			name:     "GitLab admin scopes",
-			scopes:   []string{"api", "sudo"},
-			checkFor: []string{"api", "sudo", "openid"},
-		},
-		{
-			name:     "GitLab registry scopes",
-			scopes:   []string{"read_registry", "write_registry"},
-			checkFor: []string{"read_registry", "write_registry", "openid"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			for _, expectedScope := range tt.checkFor {
-				found := false
-				for _, actualScope := range authParams.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in %v", expectedScope, authParams.Scopes)
-				}
-			}
-		})
-	}
-}
-
-// TestGitLabProvider_DefaultScopeHandling tests default scope behavior
-func TestGitLabProvider_DefaultScopeHandling(t *testing.T) {
-	provider := NewGitLabProvider()
-	baseParams := url.Values{}
-
-	// Test with only openid scope - should add defaults
-	authParams, err := provider.BuildAuthParams(baseParams, []string{"openid"})
-	if err != nil {
-		t.Errorf("BuildAuthParams failed: %v", err)
-		return
-	}
-
-	expectedScopes := []string{"openid", "profile", "email"}
-	if len(authParams.Scopes) != len(expectedScopes) {
-		t.Errorf("Expected %d scopes, got %d", len(expectedScopes), len(authParams.Scopes))
-		return
-	}
-
-	for _, expectedScope := range expectedScopes {
-		found := false
-		for _, actualScope := range authParams.Scopes {
-			if actualScope == expectedScope {
-				found = true
-				break
-			}
-		}
-		if !found {
-			t.Errorf("Expected default scope '%s' not found in %v", expectedScope, authParams.Scopes)
-		}
-	}
-}
-
-// TestGitLabProvider_ScopeDeduplication tests that duplicate scopes are handled correctly
-func TestGitLabProvider_ScopeDeduplication(t *testing.T) {
-	provider := NewGitLabProvider()
-	baseParams := url.Values{}
-
-	// Test with duplicate scopes
-	scopes := []string{"openid", "read_user", "openid", "profile", "read_user"}
-	authParams, err := provider.BuildAuthParams(baseParams, scopes)
-	if err != nil {
-		t.Errorf("BuildAuthParams failed: %v", err)
-		return
-	}
-
-	// Count occurrences of each scope
-	scopeCounts := make(map[string]int)
-	for _, scope := range authParams.Scopes {
-		scopeCounts[scope]++
-	}
-
-	// Check that no scope appears more than once
-	for scope, count := range scopeCounts {
-		if count > 1 {
-			t.Errorf("Scope '%s' appears %d times, expected 1", scope, count)
-		}
-	}
-}

internal/providers/google.go

@@ -1,56 +0,0 @@
-package providers
-
-import (
-	"net/url"
-)
-
-// GoogleProvider encapsulates Google-specific OIDC logic.
-type GoogleProvider struct {
-	*BaseProvider
-}
-
-// NewGoogleProvider creates a new instance of the GoogleProvider.
-func NewGoogleProvider() *GoogleProvider {
-	return &GoogleProvider{
-		BaseProvider: NewBaseProvider(),
-	}
-}
-
-// GetType returns the provider's type.
-func (p *GoogleProvider) GetType() ProviderType {
-	return ProviderTypeGoogle
-}
-
-// GetCapabilities returns the specific capabilities of the Google provider.
-func (p *GoogleProvider) GetCapabilities() ProviderCapabilities {
-	return ProviderCapabilities{
-		SupportsRefreshTokens:      true,  // Google DOES support refresh tokens
-		RequiresOfflineAccessScope: false, // Google uses access_type=offline instead
-		RequiresPromptConsent:      true,
-		PreferredTokenValidation:   "id",
-	}
-}
-
-// BuildAuthParams configures Google-specific authentication parameters.
-func (p *GoogleProvider) BuildAuthParams(baseParams url.Values, scopes []string) (*AuthParams, error) {
-	baseParams.Set("access_type", "offline")
-	baseParams.Set("prompt", "consent")
-
-	// Google does not use the ScopeOfflineAccess scope, so we remove it if present.
-	var filteredScopes []string
-	for _, scope := range scopes {
-		if scope != ScopeOfflineAccess {
-			filteredScopes = append(filteredScopes, scope)
-		}
-	}
-
-	return &AuthParams{
-		URLValues: baseParams,
-		Scopes:    deduplicateScopes(filteredScopes),
-	}, nil
-}
-
-// Google requires specific scopes and client configuration for proper operation.
-func (p *GoogleProvider) ValidateConfig() error {
-	return p.BaseProvider.ValidateConfig()
-}

internal/providers/google_test.go

@@ -1,350 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"testing"
-)
-
-// TestGoogleProvider_NewGoogleProvider tests the constructor
-func TestGoogleProvider_NewGoogleProvider(t *testing.T) {
-	provider := NewGoogleProvider()
-
-	if provider == nil {
-		t.Fatal("Expected provider to be created, got nil")
-	}
-
-	if provider.BaseProvider == nil {
-		t.Error("BaseProvider should be initialized")
-	}
-}
-
-// TestGoogleProvider_GetType tests provider type
-func TestGoogleProvider_GetType(t *testing.T) {
-	provider := NewGoogleProvider()
-
-	if provider.GetType() != ProviderTypeGoogle {
-		t.Errorf("Expected ProviderTypeGoogle, got %v", provider.GetType())
-	}
-}
-
-// TestGoogleProvider_GetCapabilities tests Google-specific capabilities
-func TestGoogleProvider_GetCapabilities(t *testing.T) {
-	provider := NewGoogleProvider()
-	capabilities := provider.GetCapabilities()
-
-	if !capabilities.SupportsRefreshTokens {
-		t.Error("Expected SupportsRefreshTokens to be true")
-	}
-
-	if capabilities.RequiresOfflineAccessScope {
-		t.Error("Expected RequiresOfflineAccessScope to be false for Google")
-	}
-
-	if !capabilities.RequiresPromptConsent {
-		t.Error("Expected RequiresPromptConsent to be true for Google")
-	}
-
-	if capabilities.PreferredTokenValidation != "id" {
-		t.Errorf("Expected PreferredTokenValidation 'id', got '%s'", capabilities.PreferredTokenValidation)
-	}
-}
-
-// TestGoogleProvider_BuildAuthParams tests Google-specific auth parameters
-func TestGoogleProvider_BuildAuthParams(t *testing.T) {
-	provider := NewGoogleProvider()
-
-	tests := []struct {
-		name                 string
-		inputScopes          []string
-		expectedScopes       []string
-		shouldHaveAccessType bool
-		shouldHavePrompt     bool
-	}{
-		{
-			name:                 "Basic scopes without offline_access",
-			inputScopes:          []string{"openid", "profile", "email"},
-			expectedScopes:       []string{"openid", "profile", "email"},
-			shouldHaveAccessType: true,
-			shouldHavePrompt:     true,
-		},
-		{
-			name:                 "Scopes with offline_access (should be filtered out)",
-			inputScopes:          []string{"openid", "profile", "offline_access", "email"},
-			expectedScopes:       []string{"openid", "profile", "email"},
-			shouldHaveAccessType: true,
-			shouldHavePrompt:     true,
-		},
-		{
-			name:                 "Only offline_access scope (should be filtered out)",
-			inputScopes:          []string{"offline_access"},
-			expectedScopes:       []string{},
-			shouldHaveAccessType: true,
-			shouldHavePrompt:     true,
-		},
-		{
-			name:                 "Empty scopes",
-			inputScopes:          []string{},
-			expectedScopes:       []string{},
-			shouldHaveAccessType: true,
-			shouldHavePrompt:     true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			baseParams := make(url.Values)
-			baseParams.Set("client_id", "test-client")
-
-			result, err := provider.BuildAuthParams(baseParams, tt.inputScopes)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			// Check Google-specific parameters
-			if tt.shouldHaveAccessType {
-				if result.URLValues.Get("access_type") != "offline" {
-					t.Errorf("Expected access_type 'offline', got '%s'", result.URLValues.Get("access_type"))
-				}
-			}
-
-			if tt.shouldHavePrompt {
-				if result.URLValues.Get("prompt") != "consent" {
-					t.Errorf("Expected prompt 'consent', got '%s'", result.URLValues.Get("prompt"))
-				}
-			}
-
-			// Check filtered scopes
-			if len(result.Scopes) != len(tt.expectedScopes) {
-				t.Errorf("Expected %d scopes, got %d", len(tt.expectedScopes), len(result.Scopes))
-			}
-
-			for _, expectedScope := range tt.expectedScopes {
-				found := false
-				for _, actualScope := range result.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in result", expectedScope)
-				}
-			}
-
-			// Ensure offline_access is not in the result scopes
-			for _, scope := range result.Scopes {
-				if scope == "offline_access" {
-					t.Error("offline_access scope should be filtered out for Google")
-				}
-			}
-
-			// Verify original base parameters are preserved
-			if result.URLValues.Get("client_id") != "test-client" {
-				t.Errorf("Expected client_id 'test-client', got '%s'", result.URLValues.Get("client_id"))
-			}
-		})
-	}
-}
-
-// TestGoogleProvider_ValidateConfig tests configuration validation
-func TestGoogleProvider_ValidateConfig(t *testing.T) {
-	provider := NewGoogleProvider()
-
-	err := provider.ValidateConfig()
-
-	if err != nil {
-		t.Errorf("Expected no error, got %v", err)
-	}
-}
-
-// TestGoogleProvider_InterfaceCompliance tests that Google provider implements OIDCProvider
-func TestGoogleProvider_InterfaceCompliance(t *testing.T) {
-	provider := NewGoogleProvider()
-
-	// Verify it implements the OIDCProvider interface
-	var _ OIDCProvider = provider
-}
-
-// TestGoogleProvider_OfflineAccessFiltering tests comprehensive offline_access filtering
-func TestGoogleProvider_OfflineAccessFiltering(t *testing.T) {
-	provider := NewGoogleProvider()
-
-	tests := []struct {
-		name        string
-		description string
-		inputScopes []string
-	}{
-		{
-			name:        "Multiple offline_access occurrences",
-			inputScopes: []string{"openid", "offline_access", "profile", "offline_access", "email"},
-			description: "Should remove all instances of offline_access",
-		},
-		{
-			name:        "Case sensitive filtering",
-			inputScopes: []string{"openid", "OFFLINE_ACCESS", "profile", "offline_access"},
-			description: "Should only remove exact case matches",
-		},
-		{
-			name:        "Similar but different scopes",
-			inputScopes: []string{"openid", "offline_access_extended", "profile", "offline_access"},
-			description: "Should only remove exact offline_access matches",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			baseParams := make(url.Values)
-			result, err := provider.BuildAuthParams(baseParams, tt.inputScopes)
-
-			if err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-
-			// Count offline_access occurrences in result
-			offlineAccessCount := 0
-			for _, scope := range result.Scopes {
-				if scope == "offline_access" {
-					offlineAccessCount++
-				}
-			}
-
-			if offlineAccessCount != 0 {
-				t.Errorf("Expected 0 offline_access scopes in result, got %d", offlineAccessCount)
-			}
-
-			// Verify other scopes are preserved
-			for _, originalScope := range tt.inputScopes {
-				if originalScope == "offline_access" {
-					continue // Skip the filtered scope
-				}
-
-				found := false
-				for _, resultScope := range result.Scopes {
-					if resultScope == originalScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' to be preserved", originalScope)
-				}
-			}
-		})
-	}
-}
-
-// TestGoogleProvider_BaseProviderInheritance tests inherited functionality from BaseProvider
-func TestGoogleProvider_BaseProviderInheritance(t *testing.T) {
-	provider := NewGoogleProvider()
-
-	// Test ValidateTokens (inherited from BaseProvider)
-	session := &mockSession{
-		authenticated: true,
-		idToken:       "test-token",
-		accessToken:   "access-token", // Add access token for proper validation
-	}
-	verifier := &mockTokenVerifier{}
-	cache := &mockTokenCache{
-		claims: map[string]map[string]interface{}{
-			"test-token": {
-				"exp": float64(9999999999), // Far future
-				"sub": "user123",
-			},
-		},
-	}
-
-	result, err := provider.ValidateTokens(session, verifier, cache, 0)
-	if err != nil {
-		t.Errorf("Unexpected error: %v", err)
-	}
-
-	if !result.Authenticated {
-		t.Error("Expected result to be authenticated")
-	}
-
-	// Test HandleTokenRefresh (inherited from BaseProvider)
-	tokenData := &TokenResult{IDToken: "new-token"}
-	err = provider.HandleTokenRefresh(tokenData)
-	if err != nil {
-		t.Errorf("Unexpected error: %v", err)
-	}
-}
-
-// TestGoogleProvider_AuthParamsPreservation tests that base parameters are not overwritten
-func TestGoogleProvider_AuthParamsPreservation(t *testing.T) {
-	provider := NewGoogleProvider()
-
-	baseParams := make(url.Values)
-	baseParams.Set("client_id", "test-client")
-	baseParams.Set("redirect_uri", "https://example.com/callback")
-	baseParams.Set("response_type", "code")
-	baseParams.Set("state", "test-state")
-	baseParams.Set("nonce", "test-nonce")
-
-	scopes := []string{"openid", "profile"}
-
-	result, err := provider.BuildAuthParams(baseParams, scopes)
-	if err != nil {
-		t.Errorf("Unexpected error: %v", err)
-	}
-
-	// Verify all original parameters are preserved
-	expectedParams := map[string]string{
-		"client_id":     "test-client",
-		"redirect_uri":  "https://example.com/callback",
-		"response_type": "code",
-		"state":         "test-state",
-		"nonce":         "test-nonce",
-		"access_type":   "offline", // Added by Google provider
-		"prompt":        "consent", // Added by Google provider
-	}
-
-	for key, expectedValue := range expectedParams {
-		actualValue := result.URLValues.Get(key)
-		if actualValue != expectedValue {
-			t.Errorf("Expected %s '%s', got '%s'", key, expectedValue, actualValue)
-		}
-	}
-
-	// Verify scopes
-	if len(result.Scopes) != 2 {
-		t.Errorf("Expected 2 scopes, got %d", len(result.Scopes))
-	}
-
-	expectedScopes := []string{"openid", "profile"}
-	for _, expectedScope := range expectedScopes {
-		found := false
-		for _, actualScope := range result.Scopes {
-			if actualScope == expectedScope {
-				found = true
-				break
-			}
-		}
-		if !found {
-			t.Errorf("Expected scope '%s' not found", expectedScope)
-		}
-	}
-}
-
-// Benchmark tests
-func BenchmarkGoogleProvider_BuildAuthParams(b *testing.B) {
-	provider := NewGoogleProvider()
-	baseParams := make(url.Values)
-	baseParams.Set("client_id", "test-client")
-	scopes := []string{"openid", "profile", "email", "offline_access"}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		provider.BuildAuthParams(baseParams, scopes)
-	}
-}
-
-func BenchmarkGoogleProvider_GetCapabilities(b *testing.B) {
-	provider := NewGoogleProvider()
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		provider.GetCapabilities()
-	}
-}

internal/providers/interfaces.go

@@ -1,93 +0,0 @@
-// Package providers implements a universal OIDC provider abstraction system.
-// It provides a clean interface for different OIDC providers (Google, Azure, Generic)
-// with provider-specific logic encapsulated in separate implementations.
-package providers
-
-import (
-	"net/url"
-	"time"
-)
-
-// TokenVerifier defines the interface for token verification.
-type TokenVerifier interface {
-	VerifyToken(token string) error
-}
-
-// TokenCache defines the interface for a token cache.
-type TokenCache interface {
-	Get(key string) (map[string]interface{}, bool)
-}
-
-// ProviderType is an enumeration for identifying different OIDC providers.
-type ProviderType int
-
-const (
-	ProviderTypeGeneric ProviderType = iota
-	ProviderTypeGoogle
-	ProviderTypeAzure
-	ProviderTypeGitHub
-	ProviderTypeAuth0
-	ProviderTypeOkta
-	ProviderTypeKeycloak
-	ProviderTypeAWSCognito
-	ProviderTypeGitLab
-)
-
-// Standard OAuth2/OIDC scope constants
-const (
-	ScopeOfflineAccess = "offline_access"
-	ScopeOpenID        = "openid"
-	ScopeProfile       = "profile"
-	ScopeEmail         = "email"
-)
-
-// ProviderCapabilities defines the specific features and behaviors of an OIDC provider.
-type ProviderCapabilities struct {
-	PreferredTokenValidation   string
-	SupportsRefreshTokens      bool
-	RequiresOfflineAccessScope bool
-	RequiresPromptConsent      bool
-}
-
-// ValidationResult holds the outcome of a token validation check.
-type ValidationResult struct {
-	Authenticated bool
-	NeedsRefresh  bool
-	IsExpired     bool
-}
-
-// AuthParams contains the provider-specific parameters for building the authorization URL.
-type AuthParams struct {
-	URLValues url.Values
-	Scopes    []string
-}
-
-// TokenResult holds the tokens returned by the provider.
-type TokenResult struct {
-	IDToken      string
-	AccessToken  string
-	RefreshToken string
-}
-
-// This abstraction allows for provider-specific logic to be encapsulated.
-type OIDCProvider interface {
-	GetType() ProviderType
-
-	GetCapabilities() ProviderCapabilities
-
-	ValidateTokens(session Session, verifier TokenVerifier, tokenCache TokenCache, refreshGracePeriod time.Duration) (*ValidationResult, error)
-
-	BuildAuthParams(baseParams url.Values, scopes []string) (*AuthParams, error)
-
-	HandleTokenRefresh(tokenData *TokenResult) error
-
-	ValidateConfig() error
-}
-
-// This interface decouples the providers from the main session management implementation.
-type Session interface {
-	GetIDToken() string
-	GetAccessToken() string
-	GetRefreshToken() string
-	GetAuthenticated() bool
-}

internal/providers/keycloak.go

@@ -1,72 +0,0 @@
-package providers
-
-import (
-	"net/url"
-)
-
-// KeycloakProvider encapsulates Keycloak-specific OIDC logic.
-type KeycloakProvider struct {
-	*BaseProvider
-}
-
-// NewKeycloakProvider creates a new instance of the KeycloakProvider.
-func NewKeycloakProvider() *KeycloakProvider {
-	return &KeycloakProvider{
-		BaseProvider: NewBaseProvider(),
-	}
-}
-
-// GetType returns the provider's type.
-func (p *KeycloakProvider) GetType() ProviderType {
-	return ProviderTypeKeycloak
-}
-
-// GetCapabilities returns the specific capabilities of the Keycloak provider.
-func (p *KeycloakProvider) GetCapabilities() ProviderCapabilities {
-	return ProviderCapabilities{
-		SupportsRefreshTokens:      true,
-		RequiresOfflineAccessScope: true,
-		RequiresPromptConsent:      false,
-		PreferredTokenValidation:   "id", // Keycloak typically uses ID tokens
-	}
-}
-
-// BuildAuthParams configures Keycloak-specific authentication parameters.
-func (p *KeycloakProvider) BuildAuthParams(baseParams url.Values, scopes []string) (*AuthParams, error) {
-	// Keycloak supports standard OIDC parameters
-	baseParams.Set("response_type", "code")
-
-	// Ensure offline_access scope is present for refresh tokens
-	hasOfflineAccess := false
-	for _, scope := range scopes {
-		if scope == ScopeOfflineAccess {
-			hasOfflineAccess = true
-			break
-		}
-	}
-	if !hasOfflineAccess {
-		scopes = append(scopes, ScopeOfflineAccess)
-	}
-
-	// Ensure openid scope is present
-	hasOpenID := false
-	for _, scope := range scopes {
-		if scope == ScopeOpenID {
-			hasOpenID = true
-			break
-		}
-	}
-	if !hasOpenID {
-		scopes = append(scopes, ScopeOpenID)
-	}
-
-	return &AuthParams{
-		URLValues: baseParams,
-		Scopes:    deduplicateScopes(scopes),
-	}, nil
-}
-
-// Keycloak requires realm and server configuration.
-func (p *KeycloakProvider) ValidateConfig() error {
-	return p.BaseProvider.ValidateConfig()
-}

internal/providers/keycloak_test.go

@@ -1,232 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"testing"
-)
-
-// TestKeycloakProvider_NewKeycloakProvider tests the constructor
-func TestKeycloakProvider_NewKeycloakProvider(t *testing.T) {
-	provider := NewKeycloakProvider()
-
-	if provider == nil {
-		t.Fatal("Expected provider to be created, got nil")
-	}
-
-	if provider.BaseProvider == nil {
-		t.Error("BaseProvider should be initialized")
-	}
-}
-
-// TestKeycloakProvider_GetType tests provider type
-func TestKeycloakProvider_GetType(t *testing.T) {
-	provider := NewKeycloakProvider()
-
-	if provider.GetType() != ProviderTypeKeycloak {
-		t.Errorf("Expected ProviderTypeKeycloak, got %v", provider.GetType())
-	}
-}
-
-// TestKeycloakProvider_GetCapabilities tests Keycloak-specific capabilities
-func TestKeycloakProvider_GetCapabilities(t *testing.T) {
-	provider := NewKeycloakProvider()
-	capabilities := provider.GetCapabilities()
-
-	if !capabilities.SupportsRefreshTokens {
-		t.Error("Expected SupportsRefreshTokens to be true for Keycloak")
-	}
-
-	if !capabilities.RequiresOfflineAccessScope {
-		t.Error("Expected RequiresOfflineAccessScope to be true for Keycloak")
-	}
-
-	if capabilities.RequiresPromptConsent {
-		t.Error("Expected RequiresPromptConsent to be false for Keycloak")
-	}
-
-	if capabilities.PreferredTokenValidation != "id" {
-		t.Errorf("Expected PreferredTokenValidation 'id', got '%s'", capabilities.PreferredTokenValidation)
-	}
-}
-
-// TestKeycloakProvider_BuildAuthParams tests Keycloak-specific auth params
-func TestKeycloakProvider_BuildAuthParams(t *testing.T) {
-	provider := NewKeycloakProvider()
-	baseParams := url.Values{}
-	baseParams.Set("client_id", "test_client")
-
-	tests := []struct {
-		name           string
-		scopes         []string
-		expectedScopes []string
-	}{
-		{
-			name:           "Add offline_access and openid scopes",
-			scopes:         []string{"roles", "groups"},
-			expectedScopes: []string{"roles", "groups", "offline_access", "openid"},
-		},
-		{
-			name:           "Keep existing offline_access and openid",
-			scopes:         []string{"openid", "roles", "offline_access", "groups"},
-			expectedScopes: []string{"openid", "roles", "offline_access", "groups"},
-		},
-		{
-			name:           "Add both scopes when none provided",
-			scopes:         []string{},
-			expectedScopes: []string{"offline_access", "openid"},
-		},
-		{
-			name:           "Keycloak custom scopes",
-			scopes:         []string{"realm-roles", "account"},
-			expectedScopes: []string{"realm-roles", "account", "offline_access", "openid"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			// Check that response_type is set
-			if authParams.URLValues.Get("response_type") != "code" {
-				t.Errorf("Expected response_type 'code', got '%s'", authParams.URLValues.Get("response_type"))
-			}
-
-			if len(authParams.Scopes) != len(tt.expectedScopes) {
-				t.Errorf("Expected %d scopes, got %d. Expected: %v, Got: %v",
-					len(tt.expectedScopes), len(authParams.Scopes), tt.expectedScopes, authParams.Scopes)
-				return
-			}
-
-			// Check that all expected scopes are present
-			for _, expectedScope := range tt.expectedScopes {
-				found := false
-				for _, actualScope := range authParams.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in %v", expectedScope, authParams.Scopes)
-				}
-			}
-		})
-	}
-}
-
-// TestKeycloakProvider_ValidateConfig tests config validation
-func TestKeycloakProvider_ValidateConfig(t *testing.T) {
-	provider := NewKeycloakProvider()
-
-	err := provider.ValidateConfig()
-	if err != nil {
-		t.Errorf("ValidateConfig failed: %v", err)
-	}
-}
-
-// TestKeycloakProvider_InterfaceCompliance tests that Keycloak provider implements the OIDCProvider interface
-func TestKeycloakProvider_InterfaceCompliance(t *testing.T) {
-	var _ OIDCProvider = NewKeycloakProvider()
-}
-
-// TestKeycloakProvider_BaseProviderInheritance tests that Keycloak provider inherits from BaseProvider correctly
-func TestKeycloakProvider_BaseProviderInheritance(t *testing.T) {
-	provider := NewKeycloakProvider()
-
-	// Test that it has access to BaseProvider methods
-	if provider.BaseProvider == nil {
-		t.Error("Expected BaseProvider to be initialized")
-	}
-
-	// Test HandleTokenRefresh (inherited from BaseProvider)
-	err := provider.HandleTokenRefresh(&TokenResult{
-		IDToken:      "test-id-token",
-		AccessToken:  "test-access-token",
-		RefreshToken: "test-refresh-token",
-	})
-	if err != nil {
-		t.Errorf("HandleTokenRefresh failed: %v", err)
-	}
-}
-
-// TestKeycloakProvider_RealmSpecificScopes tests Keycloak realm-specific scopes
-func TestKeycloakProvider_RealmSpecificScopes(t *testing.T) {
-	provider := NewKeycloakProvider()
-	baseParams := url.Values{}
-
-	tests := []struct {
-		name     string
-		scopes   []string
-		checkFor []string
-	}{
-		{
-			name:     "Keycloak standard scopes",
-			scopes:   []string{"roles", "groups", "profile", "email"},
-			checkFor: []string{"roles", "groups", "profile", "email", "offline_access", "openid"},
-		},
-		{
-			name:     "Keycloak realm roles",
-			scopes:   []string{"realm-roles", "client-roles"},
-			checkFor: []string{"realm-roles", "client-roles", "offline_access", "openid"},
-		},
-		{
-			name:     "Keycloak account service",
-			scopes:   []string{"account"},
-			checkFor: []string{"account", "offline_access", "openid"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			for _, expectedScope := range tt.checkFor {
-				found := false
-				for _, actualScope := range authParams.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in %v", expectedScope, authParams.Scopes)
-				}
-			}
-		})
-	}
-}
-
-// TestKeycloakProvider_ScopeDeduplication tests that duplicate scopes are handled correctly
-func TestKeycloakProvider_ScopeDeduplication(t *testing.T) {
-	provider := NewKeycloakProvider()
-	baseParams := url.Values{}
-
-	// Test with duplicate scopes
-	scopes := []string{"openid", "profile", "offline_access", "roles", "openid", "profile"}
-	authParams, err := provider.BuildAuthParams(baseParams, scopes)
-	if err != nil {
-		t.Errorf("BuildAuthParams failed: %v", err)
-		return
-	}
-
-	// Count occurrences of each scope
-	scopeCounts := make(map[string]int)
-	for _, scope := range authParams.Scopes {
-		scopeCounts[scope]++
-	}
-
-	// Check that no scope appears more than once
-	for scope, count := range scopeCounts {
-		if count > 1 {
-			t.Errorf("Scope '%s' appears %d times, expected 1", scope, count)
-		}
-	}
-}

internal/providers/okta.go

@@ -1,72 +0,0 @@
-package providers
-
-import (
-	"net/url"
-)
-
-// OktaProvider encapsulates Okta-specific OIDC logic.
-type OktaProvider struct {
-	*BaseProvider
-}
-
-// NewOktaProvider creates a new instance of the OktaProvider.
-func NewOktaProvider() *OktaProvider {
-	return &OktaProvider{
-		BaseProvider: NewBaseProvider(),
-	}
-}
-
-// GetType returns the provider's type.
-func (p *OktaProvider) GetType() ProviderType {
-	return ProviderTypeOkta
-}
-
-// GetCapabilities returns the specific capabilities of the Okta provider.
-func (p *OktaProvider) GetCapabilities() ProviderCapabilities {
-	return ProviderCapabilities{
-		SupportsRefreshTokens:      true,
-		RequiresOfflineAccessScope: true,
-		RequiresPromptConsent:      false,
-		PreferredTokenValidation:   "id", // Okta primarily uses ID tokens
-	}
-}
-
-// BuildAuthParams configures Okta-specific authentication parameters.
-func (p *OktaProvider) BuildAuthParams(baseParams url.Values, scopes []string) (*AuthParams, error) {
-	// Okta supports various response types
-	baseParams.Set("response_type", "code")
-
-	// Ensure offline_access scope is present for refresh tokens
-	hasOfflineAccess := false
-	for _, scope := range scopes {
-		if scope == ScopeOfflineAccess {
-			hasOfflineAccess = true
-			break
-		}
-	}
-	if !hasOfflineAccess {
-		scopes = append(scopes, ScopeOfflineAccess)
-	}
-
-	// Ensure openid scope is present
-	hasOpenID := false
-	for _, scope := range scopes {
-		if scope == ScopeOpenID {
-			hasOpenID = true
-			break
-		}
-	}
-	if !hasOpenID {
-		scopes = append(scopes, ScopeOpenID)
-	}
-
-	return &AuthParams{
-		URLValues: baseParams,
-		Scopes:    deduplicateScopes(scopes),
-	}, nil
-}
-
-// Okta requires specific domain configuration and application setup.
-func (p *OktaProvider) ValidateConfig() error {
-	return p.BaseProvider.ValidateConfig()
-}

internal/providers/okta_test.go

@@ -1,200 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"testing"
-)
-
-// TestOktaProvider_NewOktaProvider tests the constructor
-func TestOktaProvider_NewOktaProvider(t *testing.T) {
-	provider := NewOktaProvider()
-
-	if provider == nil {
-		t.Fatal("Expected provider to be created, got nil")
-	}
-
-	if provider.BaseProvider == nil {
-		t.Error("BaseProvider should be initialized")
-	}
-}
-
-// TestOktaProvider_GetType tests provider type
-func TestOktaProvider_GetType(t *testing.T) {
-	provider := NewOktaProvider()
-
-	if provider.GetType() != ProviderTypeOkta {
-		t.Errorf("Expected ProviderTypeOkta, got %v", provider.GetType())
-	}
-}
-
-// TestOktaProvider_GetCapabilities tests Okta-specific capabilities
-func TestOktaProvider_GetCapabilities(t *testing.T) {
-	provider := NewOktaProvider()
-	capabilities := provider.GetCapabilities()
-
-	if !capabilities.SupportsRefreshTokens {
-		t.Error("Expected SupportsRefreshTokens to be true for Okta")
-	}
-
-	if !capabilities.RequiresOfflineAccessScope {
-		t.Error("Expected RequiresOfflineAccessScope to be true for Okta")
-	}
-
-	if capabilities.RequiresPromptConsent {
-		t.Error("Expected RequiresPromptConsent to be false for Okta")
-	}
-
-	if capabilities.PreferredTokenValidation != "id" {
-		t.Errorf("Expected PreferredTokenValidation 'id', got '%s'", capabilities.PreferredTokenValidation)
-	}
-}
-
-// TestOktaProvider_BuildAuthParams tests Okta-specific auth params
-func TestOktaProvider_BuildAuthParams(t *testing.T) {
-	provider := NewOktaProvider()
-	baseParams := url.Values{}
-	baseParams.Set("client_id", "test_client")
-
-	tests := []struct {
-		name           string
-		scopes         []string
-		expectedScopes []string
-	}{
-		{
-			name:           "Add offline_access and openid scopes",
-			scopes:         []string{"groups", "profile"},
-			expectedScopes: []string{"groups", "profile", "offline_access", "openid"},
-		},
-		{
-			name:           "Keep existing offline_access and openid",
-			scopes:         []string{"openid", "groups", "offline_access", "profile"},
-			expectedScopes: []string{"openid", "groups", "offline_access", "profile"},
-		},
-		{
-			name:           "Add both scopes when none provided",
-			scopes:         []string{},
-			expectedScopes: []string{"offline_access", "openid"},
-		},
-		{
-			name:           "Add openid when only offline_access present",
-			scopes:         []string{"offline_access"},
-			expectedScopes: []string{"offline_access", "openid"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			// Check that response_type is set
-			if authParams.URLValues.Get("response_type") != "code" {
-				t.Errorf("Expected response_type 'code', got '%s'", authParams.URLValues.Get("response_type"))
-			}
-
-			if len(authParams.Scopes) != len(tt.expectedScopes) {
-				t.Errorf("Expected %d scopes, got %d. Expected: %v, Got: %v",
-					len(tt.expectedScopes), len(authParams.Scopes), tt.expectedScopes, authParams.Scopes)
-				return
-			}
-
-			// Check that all expected scopes are present
-			for _, expectedScope := range tt.expectedScopes {
-				found := false
-				for _, actualScope := range authParams.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in %v", expectedScope, authParams.Scopes)
-				}
-			}
-		})
-	}
-}
-
-// TestOktaProvider_ValidateConfig tests config validation
-func TestOktaProvider_ValidateConfig(t *testing.T) {
-	provider := NewOktaProvider()
-
-	err := provider.ValidateConfig()
-	if err != nil {
-		t.Errorf("ValidateConfig failed: %v", err)
-	}
-}
-
-// TestOktaProvider_InterfaceCompliance tests that Okta provider implements the OIDCProvider interface
-func TestOktaProvider_InterfaceCompliance(t *testing.T) {
-	var _ OIDCProvider = NewOktaProvider()
-}
-
-// TestOktaProvider_BaseProviderInheritance tests that Okta provider inherits from BaseProvider correctly
-func TestOktaProvider_BaseProviderInheritance(t *testing.T) {
-	provider := NewOktaProvider()
-
-	// Test that it has access to BaseProvider methods
-	if provider.BaseProvider == nil {
-		t.Error("Expected BaseProvider to be initialized")
-	}
-
-	// Test HandleTokenRefresh (inherited from BaseProvider)
-	err := provider.HandleTokenRefresh(&TokenResult{
-		IDToken:      "test-id-token",
-		AccessToken:  "test-access-token",
-		RefreshToken: "test-refresh-token",
-	})
-	if err != nil {
-		t.Errorf("HandleTokenRefresh failed: %v", err)
-	}
-}
-
-// TestOktaProvider_ScopeHandling tests Okta-specific scope handling
-func TestOktaProvider_ScopeHandling(t *testing.T) {
-	provider := NewOktaProvider()
-	baseParams := url.Values{}
-
-	tests := []struct {
-		name     string
-		scopes   []string
-		checkFor []string
-	}{
-		{
-			name:     "Groups scope handling",
-			scopes:   []string{"groups", "profile"},
-			checkFor: []string{"groups", "profile", "offline_access", "openid"},
-		},
-		{
-			name:     "Custom Okta scopes",
-			scopes:   []string{"okta.users.read", "okta.groups.read"},
-			checkFor: []string{"okta.users.read", "okta.groups.read", "offline_access", "openid"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			authParams, err := provider.BuildAuthParams(baseParams, tt.scopes)
-			if err != nil {
-				t.Errorf("BuildAuthParams failed: %v", err)
-				return
-			}
-
-			for _, expectedScope := range tt.checkFor {
-				found := false
-				for _, actualScope := range authParams.Scopes {
-					if actualScope == expectedScope {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected scope '%s' not found in %v", expectedScope, authParams.Scopes)
-				}
-			}
-		})
-	}
-}

internal/providers/registry.go

@@ -1,174 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"strings"
-	"sync"
-)
-
-// ProviderRegistry manages a collection of OIDC provider implementations.
-// It provides thread-safe access to provider instances and caches detection results.
-type ProviderRegistry struct {
-	cache     map[string]OIDCProvider
-	typeMap   map[ProviderType]OIDCProvider
-	providers []OIDCProvider
-	mu        sync.RWMutex
-	// Bounded cache configuration to prevent memory leaks
-	maxCacheSize int
-	cacheCount   int
-}
-
-// NewProviderRegistry creates and initializes a new ProviderRegistry.
-func NewProviderRegistry() *ProviderRegistry {
-	return &ProviderRegistry{
-		providers:    make([]OIDCProvider, 0),
-		cache:        make(map[string]OIDCProvider),
-		typeMap:      make(map[ProviderType]OIDCProvider),
-		maxCacheSize: 1000, // Prevent unbounded cache growth
-		cacheCount:   0,
-	}
-}
-
-// RegisterProvider adds a new provider to the registry.
-// It maintains both a list of providers and a type-to-provider mapping for efficient lookups.
-func (r *ProviderRegistry) RegisterProvider(provider OIDCProvider) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.providers = append(r.providers, provider)
-	r.typeMap[provider.GetType()] = provider
-}
-
-// GetProviderByType retrieves a provider instance by its type.
-// Returns nil if the provider type is not registered.
-func (r *ProviderRegistry) GetProviderByType(providerType ProviderType) OIDCProvider {
-	r.mu.RLock()
-	defer r.mu.RUnlock()
-	return r.typeMap[providerType]
-}
-
-// GetRegisteredProviders returns a slice of all registered provider types.
-func (r *ProviderRegistry) GetRegisteredProviders() []ProviderType {
-	r.mu.RLock()
-	defer r.mu.RUnlock()
-
-	types := make([]ProviderType, 0, len(r.typeMap))
-	for providerType := range r.typeMap {
-		types = append(types, providerType)
-	}
-	return types
-}
-
-// ClearCache removes all cached provider detection results.
-// This can be useful for testing or when provider configuration changes.
-func (r *ProviderRegistry) ClearCache() {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.cache = make(map[string]OIDCProvider)
-	r.cacheCount = 0
-}
-
-// evictOldestCacheEntry removes the first cache entry when cache is full
-// This is a simple eviction strategy - in production, LRU might be preferred
-func (r *ProviderRegistry) evictOldestCacheEntry() {
-	// Simple eviction: remove first entry found
-	for key := range r.cache {
-		delete(r.cache, key)
-		r.cacheCount--
-		break
-	}
-}
-
-// DetectProvider identifies the appropriate OIDC provider for an issuer URL.
-// Uses double-checked locking pattern to avoid race conditions while caching results.
-func (r *ProviderRegistry) DetectProvider(issuerURL string) OIDCProvider {
-	r.mu.RLock()
-	if provider, found := r.cache[issuerURL]; found {
-		r.mu.RUnlock()
-		return provider
-	}
-	r.mu.RUnlock()
-
-	r.mu.Lock()
-	defer r.mu.Unlock()
-
-	if provider, found := r.cache[issuerURL]; found {
-		return provider
-	}
-
-	detectedProvider := r.detectProviderUnsafe(issuerURL)
-
-	// Check if cache is full and evict if necessary
-	if r.cacheCount >= r.maxCacheSize {
-		r.evictOldestCacheEntry()
-	}
-
-	r.cache[issuerURL] = detectedProvider
-	r.cacheCount++
-
-	return detectedProvider
-}
-
-// detectProviderUnsafe performs the actual provider detection logic.
-// This method assumes the caller holds the appropriate lock and should not be called directly.
-func (r *ProviderRegistry) detectProviderUnsafe(issuerURL string) OIDCProvider {
-	normalizedURL, err := url.Parse(issuerURL)
-	if err != nil {
-		return nil
-	}
-
-	// Check if the URL has a valid scheme and host
-	if normalizedURL.Scheme == "" || normalizedURL.Host == "" {
-		return nil
-	}
-
-	// Convert host to lowercase for case-insensitive matching
-	host := strings.ToLower(normalizedURL.Host)
-
-	for _, p := range r.providers {
-		switch p.GetType() {
-		case ProviderTypeGoogle:
-			if strings.Contains(host, "accounts.google.com") {
-				return p
-			}
-		case ProviderTypeAzure:
-			if strings.Contains(host, "login.microsoftonline.com") || strings.Contains(host, "sts.windows.net") {
-				return p
-			}
-		case ProviderTypeGitHub:
-			if strings.Contains(host, "github.com") {
-				return p
-			}
-		case ProviderTypeAuth0:
-			if strings.Contains(host, ".auth0.com") {
-				return p
-			}
-		case ProviderTypeOkta:
-			if strings.Contains(host, ".okta.com") || strings.Contains(host, ".oktapreview.com") || strings.Contains(host, ".okta-emea.com") {
-				return p
-			}
-		case ProviderTypeKeycloak:
-			// Match both Keycloak <17 (`/auth/realms/`) and 17+ (`/realms/`).
-			if strings.Contains(host, "keycloak") || strings.Contains(normalizedURL.Path, "/realms/") {
-				return p
-			}
-		case ProviderTypeAWSCognito:
-			if strings.Contains(host, "cognito-idp") && strings.Contains(host, ".amazonaws.com") {
-				return p
-			}
-		case ProviderTypeGitLab:
-			// Match gitlab.com, self-hosted (gitlab.*), and instances with gitlab in subdomain
-			if strings.Contains(host, "gitlab.com") ||
-				strings.Contains(host, "gitlab") {
-				return p
-			}
-		}
-	}
-
-	for _, p := range r.providers {
-		if p.GetType() == ProviderTypeGeneric {
-			return p
-		}
-	}
-
-	return nil
-}

internal/providers/registry_test.go

@@ -1,747 +0,0 @@
-package providers
-
-import (
-	"fmt"
-	"sync"
-	"testing"
-)
-
-// TestProviderRegistry_NewProviderRegistry tests registry constructor
-func TestProviderRegistry_NewProviderRegistry(t *testing.T) {
-	registry := NewProviderRegistry()
-
-	if registry == nil {
-		t.Fatal("Expected registry to be created, got nil")
-	}
-
-	if registry.providers == nil {
-		t.Error("Providers slice should be initialized")
-	}
-
-	if registry.cache == nil {
-		t.Error("Cache map should be initialized")
-	}
-
-	if registry.typeMap == nil {
-		t.Error("TypeMap should be initialized")
-	}
-
-	if registry.maxCacheSize != 1000 {
-		t.Errorf("Expected maxCacheSize 1000, got %d", registry.maxCacheSize)
-	}
-
-	if registry.cacheCount != 0 {
-		t.Errorf("Expected initial cacheCount 0, got %d", registry.cacheCount)
-	}
-}
-
-// TestProviderRegistry_RegisterProvider tests provider registration
-func TestProviderRegistry_RegisterProvider(t *testing.T) {
-	registry := NewProviderRegistry()
-
-	genericProvider := NewGenericProvider()
-	googleProvider := NewGoogleProvider()
-	azureProvider := NewAzureProvider()
-
-	// Register providers
-	registry.RegisterProvider(genericProvider)
-	registry.RegisterProvider(googleProvider)
-	registry.RegisterProvider(azureProvider)
-
-	// Verify providers are registered
-	if len(registry.providers) != 3 {
-		t.Errorf("Expected 3 providers, got %d", len(registry.providers))
-	}
-
-	if len(registry.typeMap) != 3 {
-		t.Errorf("Expected 3 type mappings, got %d", len(registry.typeMap))
-	}
-
-	// Verify type mappings
-	if registry.typeMap[ProviderTypeGeneric] != genericProvider {
-		t.Error("Generic provider not mapped correctly")
-	}
-
-	if registry.typeMap[ProviderTypeGoogle] != googleProvider {
-		t.Error("Google provider not mapped correctly")
-	}
-
-	if registry.typeMap[ProviderTypeAzure] != azureProvider {
-		t.Error("Azure provider not mapped correctly")
-	}
-}
-
-// TestProviderRegistry_GetProviderByType tests provider retrieval by type
-func TestProviderRegistry_GetProviderByType(t *testing.T) {
-	registry := NewProviderRegistry()
-
-	genericProvider := NewGenericProvider()
-	googleProvider := NewGoogleProvider()
-
-	registry.RegisterProvider(genericProvider)
-	registry.RegisterProvider(googleProvider)
-
-	tests := []struct {
-		expected     OIDCProvider
-		name         string
-		providerType ProviderType
-	}{
-		{
-			name:         "Get Generic provider",
-			providerType: ProviderTypeGeneric,
-			expected:     genericProvider,
-		},
-		{
-			name:         "Get Google provider",
-			providerType: ProviderTypeGoogle,
-			expected:     googleProvider,
-		},
-		{
-			name:         "Get unregistered provider",
-			providerType: ProviderTypeAzure,
-			expected:     nil,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := registry.GetProviderByType(tt.providerType)
-
-			if result != tt.expected {
-				t.Errorf("Expected %v, got %v", tt.expected, result)
-			}
-		})
-	}
-}
-
-// TestProviderRegistry_GetRegisteredProviders tests listing registered provider types
-func TestProviderRegistry_GetRegisteredProviders(t *testing.T) {
-	registry := NewProviderRegistry()
-
-	// Initially empty
-	types := registry.GetRegisteredProviders()
-	if len(types) != 0 {
-		t.Errorf("Expected 0 registered providers, got %d", len(types))
-	}
-
-	// Register some providers
-	registry.RegisterProvider(NewGenericProvider())
-	registry.RegisterProvider(NewGoogleProvider())
-
-	types = registry.GetRegisteredProviders()
-	if len(types) != 2 {
-		t.Errorf("Expected 2 registered providers, got %d", len(types))
-	}
-
-	// Verify types are correct
-	expectedTypes := map[ProviderType]bool{
-		ProviderTypeGeneric: false,
-		ProviderTypeGoogle:  false,
-	}
-
-	for _, providerType := range types {
-		if _, exists := expectedTypes[providerType]; exists {
-			expectedTypes[providerType] = true
-		} else {
-			t.Errorf("Unexpected provider type: %v", providerType)
-		}
-	}
-
-	for providerType, found := range expectedTypes {
-		if !found {
-			t.Errorf("Provider type %v not found in results", providerType)
-		}
-	}
-}
-
-// TestProviderRegistry_DetectProvider tests provider detection
-func TestProviderRegistry_DetectProvider(t *testing.T) {
-	registry := NewProviderRegistry()
-
-	// Register providers
-	genericProvider := NewGenericProvider()
-	googleProvider := NewGoogleProvider()
-	azureProvider := NewAzureProvider()
-	githubProvider := NewGitHubProvider()
-	auth0Provider := NewAuth0Provider()
-	oktaProvider := NewOktaProvider()
-	keycloakProvider := NewKeycloakProvider()
-	cognitoProvider := NewAWSCognitoProvider()
-	gitlabProvider := NewGitLabProvider()
-
-	registry.RegisterProvider(genericProvider)
-	registry.RegisterProvider(googleProvider)
-	registry.RegisterProvider(azureProvider)
-	registry.RegisterProvider(githubProvider)
-	registry.RegisterProvider(auth0Provider)
-	registry.RegisterProvider(oktaProvider)
-	registry.RegisterProvider(keycloakProvider)
-	registry.RegisterProvider(cognitoProvider)
-	registry.RegisterProvider(gitlabProvider)
-
-	tests := []struct {
-		expected  OIDCProvider
-		name      string
-		issuerURL string
-	}{
-		{
-			name:      "Google provider detection",
-			issuerURL: "https://accounts.google.com",
-			expected:  googleProvider,
-		},
-		{
-			name:      "Google provider with path",
-			issuerURL: "https://accounts.google.com/oauth2",
-			expected:  googleProvider,
-		},
-		{
-			name:      "Azure provider detection - login.microsoftonline.com",
-			issuerURL: "https://login.microsoftonline.com/tenant/v2.0",
-			expected:  azureProvider,
-		},
-		{
-			name:      "Azure provider detection - sts.windows.net",
-			issuerURL: "https://sts.windows.net/tenant",
-			expected:  azureProvider,
-		},
-		{
-			name:      "GitHub provider detection",
-			issuerURL: "https://github.com/login/oauth",
-			expected:  githubProvider,
-		},
-		{
-			name:      "Auth0 provider detection",
-			issuerURL: "https://tenant.auth0.com",
-			expected:  auth0Provider,
-		},
-		{
-			name:      "Okta provider detection",
-			issuerURL: "https://tenant.okta.com",
-			expected:  oktaProvider,
-		},
-		{
-			name:      "Okta preview provider detection",
-			issuerURL: "https://tenant.oktapreview.com",
-			expected:  oktaProvider,
-		},
-		{
-			name:      "Keycloak provider detection (legacy /auth/realms/)",
-			issuerURL: "https://auth.example.com/auth/realms/master",
-			expected:  keycloakProvider,
-		},
-		{
-			name:      "Keycloak provider detection (modern /realms/, KC 17+)",
-			issuerURL: "https://auth.example.com/realms/master",
-			expected:  keycloakProvider,
-		},
-		{
-			name:      "AWS Cognito provider detection",
-			issuerURL: "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_example",
-			expected:  cognitoProvider,
-		},
-		{
-			name:      "GitLab provider detection",
-			issuerURL: "https://gitlab.com/oauth",
-			expected:  gitlabProvider,
-		},
-		{
-			name:      "GitLab self-hosted detection - gitlab subdomain",
-			issuerURL: "https://gitlab.example.com",
-			expected:  gitlabProvider,
-		},
-		{
-			name:      "GitLab self-hosted detection - gitlab in domain",
-			issuerURL: "https://my-gitlab.company.io",
-			expected:  gitlabProvider,
-		},
-		{
-			name:      "GitLab self-hosted detection - gitlab prefix",
-			issuerURL: "https://gitlab-prod.internal.net",
-			expected:  gitlabProvider,
-		},
-		{
-			name:      "GitLab self-hosted detection - gitlab suffix",
-			issuerURL: "https://company-gitlab.net",
-			expected:  gitlabProvider,
-		},
-		{
-			name:      "Generic provider fallback",
-			issuerURL: "https://auth.example.com",
-			expected:  genericProvider,
-		},
-		{
-			name:      "Invalid URL",
-			issuerURL: "not-a-url",
-			expected:  nil,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := registry.DetectProvider(tt.issuerURL)
-
-			if result != tt.expected {
-				t.Errorf("Expected %v, got %v", tt.expected, result)
-			}
-		})
-	}
-}
-
-// TestProviderRegistry_DetectProvider_Caching tests cache behavior
-func TestProviderRegistry_DetectProvider_Caching(t *testing.T) {
-	registry := NewProviderRegistry()
-
-	genericProvider := NewGenericProvider()
-	registry.RegisterProvider(genericProvider)
-
-	issuerURL := "https://auth.example.com"
-
-	// First call should detect and cache
-	result1 := registry.DetectProvider(issuerURL)
-	if result1 != genericProvider {
-		t.Errorf("Expected generic provider, got %v", result1)
-	}
-
-	// Verify it's cached
-	registry.mu.RLock()
-	cachedResult, found := registry.cache[issuerURL]
-	registry.mu.RUnlock()
-
-	if !found {
-		t.Error("Expected result to be cached")
-	}
-
-	if cachedResult != genericProvider {
-		t.Errorf("Expected cached generic provider, got %v", cachedResult)
-	}
-
-	// Second call should return cached result
-	result2 := registry.DetectProvider(issuerURL)
-	if result2 != genericProvider {
-		t.Errorf("Expected cached generic provider, got %v", result2)
-	}
-
-	// Should be same instance (from cache)
-	if result1 != result2 {
-		t.Error("Expected same instance from cache")
-	}
-}
-
-// TestProviderRegistry_ClearCache tests cache clearing
-func TestProviderRegistry_ClearCache(t *testing.T) {
-	registry := NewProviderRegistry()
-
-	genericProvider := NewGenericProvider()
-	registry.RegisterProvider(genericProvider)
-
-	// Populate cache
-	registry.DetectProvider("https://auth1.example.com")
-	registry.DetectProvider("https://auth2.example.com")
-
-	// Verify cache has entries
-	registry.mu.RLock()
-	cacheSize := len(registry.cache)
-	registry.mu.RUnlock()
-
-	if cacheSize != 2 {
-		t.Errorf("Expected 2 cache entries, got %d", cacheSize)
-	}
-
-	// Clear cache
-	registry.ClearCache()
-
-	// Verify cache is empty
-	registry.mu.RLock()
-	cacheSize = len(registry.cache)
-	cacheCount := registry.cacheCount
-	registry.mu.RUnlock()
-
-	if cacheSize != 0 {
-		t.Errorf("Expected 0 cache entries after clear, got %d", cacheSize)
-	}
-
-	if cacheCount != 0 {
-		t.Errorf("Expected 0 cache count after clear, got %d", cacheCount)
-	}
-}
-
-// TestProviderRegistry_CacheEviction tests cache size limits and eviction
-func TestProviderRegistry_CacheEviction(t *testing.T) {
-	registry := NewProviderRegistry()
-	registry.maxCacheSize = 2 // Set small cache size for testing
-
-	genericProvider := NewGenericProvider()
-	registry.RegisterProvider(genericProvider)
-
-	// Fill cache to capacity
-	registry.DetectProvider("https://auth1.example.com")
-	registry.DetectProvider("https://auth2.example.com")
-
-	// Verify cache is at capacity
-	registry.mu.RLock()
-	cacheSize := len(registry.cache)
-	registry.mu.RUnlock()
-
-	if cacheSize != 2 {
-		t.Errorf("Expected 2 cache entries, got %d", cacheSize)
-	}
-
-	// Add one more entry (should trigger eviction)
-	registry.DetectProvider("https://auth3.example.com")
-
-	// Cache size should still be at max
-	registry.mu.RLock()
-	cacheSize = len(registry.cache)
-	registry.mu.RUnlock()
-
-	if cacheSize != 2 {
-		t.Errorf("Expected 2 cache entries after eviction, got %d", cacheSize)
-	}
-
-	// Verify the new entry is cached
-	registry.mu.RLock()
-	_, found := registry.cache["https://auth3.example.com"]
-	registry.mu.RUnlock()
-
-	if !found {
-		t.Error("Expected new entry to be cached")
-	}
-}
-
-// TestProviderRegistry_ConcurrentAccess tests thread safety
-func TestProviderRegistry_ConcurrentAccess(t *testing.T) {
-	registry := NewProviderRegistry()
-
-	genericProvider := NewGenericProvider()
-	googleProvider := NewGoogleProvider()
-	azureProvider := NewAzureProvider()
-
-	registry.RegisterProvider(genericProvider)
-	registry.RegisterProvider(googleProvider)
-	registry.RegisterProvider(azureProvider)
-
-	var wg sync.WaitGroup
-	goroutines := 10
-	iterations := 100
-
-	// Test concurrent detection
-	for i := 0; i < goroutines; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			for j := 0; j < iterations; j++ {
-				issuerURL := "https://accounts.google.com"
-				if id%2 == 0 {
-					issuerURL = "https://login.microsoftonline.com/tenant"
-				} else if id%3 == 0 {
-					issuerURL = "https://auth.example.com"
-				}
-
-				result := registry.DetectProvider(issuerURL)
-				if result == nil {
-					t.Errorf("Expected provider for URL %s", issuerURL)
-				}
-			}
-		}(i)
-	}
-
-	// Test concurrent registration
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		for i := 0; i < 10; i++ {
-			newProvider := NewGenericProvider()
-			registry.RegisterProvider(newProvider)
-		}
-	}()
-
-	// Test concurrent cache clearing
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		for i := 0; i < 10; i++ {
-			registry.ClearCache()
-		}
-	}()
-
-	wg.Wait()
-
-	// Verify final state is consistent
-	types := registry.GetRegisteredProviders()
-	if len(types) < 3 { // Should have at least the original 3
-		t.Errorf("Expected at least 3 provider types, got %d", len(types))
-	}
-}
-
-// TestProviderRegistry_DoubleCheckedLocking tests the double-checked locking pattern
-func TestProviderRegistry_DoubleCheckedLocking(t *testing.T) {
-	registry := NewProviderRegistry()
-
-	genericProvider := NewGenericProvider()
-	registry.RegisterProvider(genericProvider)
-
-	var wg sync.WaitGroup
-	goroutines := 100
-	issuerURL := "https://auth.example.com"
-
-	// Multiple goroutines trying to detect the same provider simultaneously
-	for i := 0; i < goroutines; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			result := registry.DetectProvider(issuerURL)
-			if result != genericProvider {
-				t.Errorf("Expected generic provider, got %v", result)
-			}
-		}()
-	}
-
-	wg.Wait()
-
-	// Verify only one cache entry was created
-	registry.mu.RLock()
-	cacheSize := len(registry.cache)
-	registry.mu.RUnlock()
-
-	if cacheSize != 1 {
-		t.Errorf("Expected 1 cache entry, got %d", cacheSize)
-	}
-}
-
-// TestProviderRegistry_DetectGitLabSelfHosted tests improved GitLab detection for issue #61
-func TestProviderRegistry_DetectGitLabSelfHosted(t *testing.T) {
-	registry := NewProviderRegistry()
-
-	genericProvider := NewGenericProvider()
-	gitlabProvider := NewGitLabProvider()
-	githubProvider := NewGitHubProvider()
-
-	registry.RegisterProvider(genericProvider)
-	registry.RegisterProvider(gitlabProvider)
-	registry.RegisterProvider(githubProvider)
-
-	tests := []struct {
-		name        string
-		issuerURL   string
-		expected    OIDCProvider
-		description string
-	}{
-		{
-			name:        "GitLab.com official",
-			issuerURL:   "https://gitlab.com",
-			expected:    gitlabProvider,
-			description: "Should detect official GitLab.com",
-		},
-		{
-			name:        "GitLab.com with path",
-			issuerURL:   "https://gitlab.com/oauth/authorize",
-			expected:    gitlabProvider,
-			description: "Should detect GitLab.com with path",
-		},
-		{
-			name:        "Self-hosted gitlab.example.com",
-			issuerURL:   "https://gitlab.example.com",
-			expected:    gitlabProvider,
-			description: "Should detect gitlab as subdomain",
-		},
-		{
-			name:        "Self-hosted my.gitlab.io",
-			issuerURL:   "https://my.gitlab.io",
-			expected:    gitlabProvider,
-			description: "Should detect gitlab in domain",
-		},
-		{
-			name:        "Self-hosted example-gitlab.com",
-			issuerURL:   "https://example-gitlab.com",
-			expected:    gitlabProvider,
-			description: "Should detect gitlab as suffix",
-		},
-		{
-			name:        "Self-hosted gitlab-prod.company.net",
-			issuerURL:   "https://gitlab-prod.company.net",
-			expected:    gitlabProvider,
-			description: "Should detect gitlab as prefix",
-		},
-		{
-			name:        "Self-hosted my-gitlab.internal",
-			issuerURL:   "https://my-gitlab.internal",
-			expected:    gitlabProvider,
-			description: "Should detect gitlab in middle of host",
-		},
-		{
-			name:        "Self-hosted company.gitlab.services",
-			issuerURL:   "https://company.gitlab.services",
-			expected:    gitlabProvider,
-			description: "Should detect gitlab in middle of domain",
-		},
-		{
-			name:        "Self-hosted with port",
-			issuerURL:   "https://gitlab.example.com:8443",
-			expected:    gitlabProvider,
-			description: "Should detect GitLab with custom port",
-		},
-		{
-			name:        "Self-hosted with path and query",
-			issuerURL:   "https://gitlab.example.com/oauth?param=value",
-			expected:    gitlabProvider,
-			description: "Should detect GitLab with complex URL",
-		},
-		{
-			name:        "Case insensitive - GITLAB",
-			issuerURL:   "https://GITLAB.example.com",
-			expected:    gitlabProvider,
-			description: "Should detect GitLab case-insensitively",
-		},
-		{
-			name:        "Case insensitive - GitLab",
-			issuerURL:   "https://GitLab.example.com",
-			expected:    gitlabProvider,
-			description: "Should detect GitLab with mixed case",
-		},
-		{
-			name:        "Not GitLab - git prefix only",
-			issuerURL:   "https://github.com",
-			expected:    githubProvider, // Should match GitHub provider, not GitLab
-			description: "Should not match github.com as GitLab",
-		},
-		{
-			name:        "Not GitLab - lab suffix only",
-			issuerURL:   "https://mylab.example.com",
-			expected:    genericProvider,
-			description: "Should not match partial gitlab string",
-		},
-		{
-			name:        "Not GitLab - git and lab separate",
-			issuerURL:   "https://git.mylab.example.com",
-			expected:    genericProvider,
-			description: "Should not match git and lab when not together",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Clear cache to ensure fresh detection
-			registry.ClearCache()
-
-			result := registry.DetectProvider(tt.issuerURL)
-
-			if result != tt.expected {
-				t.Errorf("%s: Expected %v, got %v", tt.description, tt.expected, result)
-			}
-		})
-	}
-}
-
-// TestProviderRegistry_GitLabDetection_RealWorldURLs tests real-world GitLab URLs
-func TestProviderRegistry_GitLabDetection_RealWorldURLs(t *testing.T) {
-	registry := NewProviderRegistry()
-
-	genericProvider := NewGenericProvider()
-	gitlabProvider := NewGitLabProvider()
-	githubProvider := NewGitHubProvider()
-
-	registry.RegisterProvider(genericProvider)
-	registry.RegisterProvider(gitlabProvider)
-	registry.RegisterProvider(githubProvider)
-
-	realWorldTests := []struct {
-		expected  OIDCProvider
-		name      string
-		issuerURL string
-	}{
-		// Actual self-hosted GitLab examples from issue #61
-		{
-			name:      "Company self-hosted GitLab",
-			issuerURL: "https://gitlab.company.com",
-			expected:  gitlabProvider,
-		},
-		{
-			name:      "Organization GitLab instance with gitlab in subdomain",
-			issuerURL: "https://gitlab.organization.org",
-			expected:  gitlabProvider,
-		},
-		{
-			name:      "Internal GitLab server",
-			issuerURL: "https://gitlab.internal.corp",
-			expected:  gitlabProvider,
-		},
-		{
-			name:      "GitLab with custom subdomain",
-			issuerURL: "https://code.gitlab.mycompany.com",
-			expected:  gitlabProvider,
-		},
-		// Negative cases to ensure we don't over-match
-		{
-			name:      "GitHub should not match GitLab",
-			issuerURL: "https://github.com",
-			expected:  githubProvider,
-		},
-		{
-			name:      "Generic git server",
-			issuerURL: "https://git.example.com",
-			expected:  genericProvider,
-		},
-	}
-
-	for _, tt := range realWorldTests {
-		t.Run(tt.name, func(t *testing.T) {
-			registry.ClearCache()
-			result := registry.DetectProvider(tt.issuerURL)
-
-			if result != tt.expected {
-				var expectedType, resultType string
-				if tt.expected != nil {
-					expectedType = fmt.Sprintf("%v", tt.expected.GetType())
-				} else {
-					expectedType = "nil"
-				}
-				if result != nil {
-					resultType = fmt.Sprintf("%v", result.GetType())
-				} else {
-					resultType = "nil"
-				}
-
-				t.Errorf("Expected provider type %s, got %s for URL %s",
-					expectedType, resultType, tt.issuerURL)
-			}
-		})
-	}
-}
-
-// Benchmark tests
-func BenchmarkProviderRegistry_DetectProvider_Cached(b *testing.B) {
-	registry := NewProviderRegistry()
-	genericProvider := NewGenericProvider()
-	registry.RegisterProvider(genericProvider)
-
-	issuerURL := "https://auth.example.com"
-	// Warm up cache
-	registry.DetectProvider(issuerURL)
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		registry.DetectProvider(issuerURL)
-	}
-}
-
-func BenchmarkProviderRegistry_DetectProvider_Uncached(b *testing.B) {
-	registry := NewProviderRegistry()
-	genericProvider := NewGenericProvider()
-	registry.RegisterProvider(genericProvider)
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		registry.ClearCache() // Clear cache for each iteration
-		registry.DetectProvider("https://auth.example.com")
-	}
-}
-
-func BenchmarkProviderRegistry_RegisterProvider(b *testing.B) {
-	registry := NewProviderRegistry()
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		provider := NewGenericProvider()
-		registry.RegisterProvider(provider)
-	}
-}

internal/providers/validation.go

@@ -1,151 +0,0 @@
-package providers
-
-import (
-	"fmt"
-	"net/url"
-	"strings"
-)
-
-// ConfigValidator provides common configuration validation utilities for providers.
-type ConfigValidator struct{}
-
-// NewConfigValidator creates a new configuration validator.
-func NewConfigValidator() *ConfigValidator {
-	return &ConfigValidator{}
-}
-
-// ValidateIssuerURL validates that an issuer URL is properly formatted and accessible.
-func (v *ConfigValidator) ValidateIssuerURL(issuerURL string) error {
-	if issuerURL == "" {
-		return fmt.Errorf("issuer URL cannot be empty")
-	}
-
-	parsedURL, err := url.Parse(issuerURL)
-	if err != nil {
-		return fmt.Errorf("invalid issuer URL format: %w", err)
-	}
-
-	if parsedURL.Scheme == "" {
-		return fmt.Errorf("issuer URL must include scheme (http/https)")
-	}
-
-	if parsedURL.Scheme != "http" && parsedURL.Scheme != "https" {
-		return fmt.Errorf("issuer URL scheme must be http or https")
-	}
-
-	if parsedURL.Host == "" {
-		return fmt.Errorf("issuer URL must include host")
-	}
-
-	return nil
-}
-
-// ValidateClientID validates that a client ID is properly formatted.
-func (v *ConfigValidator) ValidateClientID(clientID string) error {
-	if clientID == "" {
-		return fmt.Errorf("client ID cannot be empty")
-	}
-
-	if len(clientID) < 3 {
-		return fmt.Errorf("client ID appears to be too short")
-	}
-
-	return nil
-}
-
-// ValidateScopes validates that the provided scopes are reasonable.
-func (v *ConfigValidator) ValidateScopes(scopes []string) error {
-	if len(scopes) == 0 {
-		return fmt.Errorf("at least one scope must be provided")
-	}
-
-	hasOpenIDScope := false
-	for _, scope := range scopes {
-		if strings.TrimSpace(scope) == ScopeOpenID {
-			hasOpenIDScope = true
-			break
-		}
-	}
-
-	if !hasOpenIDScope {
-		return fmt.Errorf("'openid' scope is required for OIDC authentication")
-	}
-
-	return nil
-}
-
-// ValidateRedirectURL validates that a redirect URL is properly formatted.
-func (v *ConfigValidator) ValidateRedirectURL(redirectURL string) error {
-	if redirectURL == "" {
-		return fmt.Errorf("redirect URL cannot be empty")
-	}
-
-	parsedURL, err := url.Parse(redirectURL)
-	if err != nil {
-		return fmt.Errorf("invalid redirect URL format: %w", err)
-	}
-
-	if parsedURL.Scheme == "" {
-		return fmt.Errorf("redirect URL must include scheme (http/https)")
-	}
-
-	return nil
-}
-
-// ValidateProviderSpecificConfig performs provider-specific validation.
-func (v *ConfigValidator) ValidateProviderSpecificConfig(provider OIDCProvider, config map[string]interface{}) error {
-	switch provider.GetType() {
-	case ProviderTypeGoogle:
-		return v.validateGoogleConfig(config)
-	case ProviderTypeAzure:
-		return v.validateAzureConfig(config)
-	case ProviderTypeGeneric:
-		return v.validateGenericConfig(config)
-	default:
-		return fmt.Errorf("unknown provider type: %d", provider.GetType())
-	}
-}
-
-// validateGoogleConfig validates Google-specific configuration.
-func (v *ConfigValidator) validateGoogleConfig(config map[string]interface{}) error {
-	if issuerURL, ok := config["issuer_url"].(string); ok {
-		if !strings.Contains(issuerURL, "accounts.google.com") {
-			return fmt.Errorf("google provider requires issuer URL to contain accounts.google.com")
-		}
-	}
-
-	return nil
-}
-
-// validateAzureConfig validates Azure-specific configuration.
-func (v *ConfigValidator) validateAzureConfig(config map[string]interface{}) error {
-	if issuerURL, ok := config["issuer_url"].(string); ok {
-		if !strings.Contains(issuerURL, "login.microsoftonline.com") && !strings.Contains(issuerURL, "sts.windows.net") {
-			return fmt.Errorf("azure provider requires issuer URL to contain login.microsoftonline.com or sts.windows.net")
-		}
-	}
-
-	if issuerURL, ok := config["issuer_url"].(string); ok {
-		parsedURL, err := url.Parse(issuerURL)
-		if err == nil {
-			pathParts := strings.Split(parsedURL.Path, "/")
-			hasTenantID := false
-			for _, part := range pathParts {
-				if len(part) == 36 && strings.Count(part, "-") == 4 {
-					hasTenantID = true
-					break
-				}
-			}
-			if !hasTenantID {
-				return fmt.Errorf("azure issuer URL should include tenant ID")
-			}
-		}
-	}
-
-	return nil
-}
-
-// validateGenericConfig validates generic OIDC provider configuration.
-func (v *ConfigValidator) validateGenericConfig(config map[string]interface{}) error {
-	return nil
-}

internal/providers/validation_test.go

@@ -1,563 +0,0 @@
-package providers
-
-import (
-	"net/url"
-	"strings"
-	"testing"
-	"time"
-)
-
-// TestNewConfigValidator tests the creation of a ConfigValidator
-func TestNewConfigValidator(t *testing.T) {
-	validator := NewConfigValidator()
-	if validator == nil {
-		t.Error("expected non-nil validator")
-	}
-}
-
-// TestValidateIssuerURL tests the ValidateIssuerURL function
-func TestValidateIssuerURL(t *testing.T) {
-	tests := []struct {
-		name      string
-		issuerURL string
-		errMsg    string
-		wantErr   bool
-	}{
-		{
-			name:      "valid https URL",
-			issuerURL: "https://accounts.google.com",
-			wantErr:   false,
-		},
-		{
-			name:      "valid http URL",
-			issuerURL: "http://localhost:8080",
-			wantErr:   false,
-		},
-		{
-			name:      "valid URL with path",
-			issuerURL: "https://login.microsoftonline.com/tenant-id/v2.0",
-			wantErr:   false,
-		},
-		{
-			name:      "empty URL",
-			issuerURL: "",
-			wantErr:   true,
-			errMsg:    "issuer URL cannot be empty",
-		},
-		{
-			name:      "URL without scheme",
-			issuerURL: "accounts.google.com",
-			wantErr:   true,
-			errMsg:    "issuer URL must include scheme",
-		},
-		{
-			name:      "URL with invalid scheme",
-			issuerURL: "ftp://example.com",
-			wantErr:   true,
-			errMsg:    "issuer URL scheme must be http or https",
-		},
-		{
-			name:      "URL without host",
-			issuerURL: "https://",
-			wantErr:   true,
-			errMsg:    "issuer URL must include host",
-		},
-		{
-			name:      "malformed URL",
-			issuerURL: "ht!tp://[invalid",
-			wantErr:   true,
-			errMsg:    "invalid issuer URL format",
-		},
-		{
-			name:      "URL with port",
-			issuerURL: "https://auth.example.com:443/oauth",
-			wantErr:   false,
-		},
-		{
-			name:      "URL with query parameters",
-			issuerURL: "https://auth.example.com?tenant=123",
-			wantErr:   false,
-		},
-	}
-
-	validator := NewConfigValidator()
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validator.ValidateIssuerURL(tt.issuerURL)
-
-			if tt.wantErr {
-				if err == nil {
-					t.Error("expected error, got nil")
-				} else if tt.errMsg != "" && !strings.Contains(err.Error(), tt.errMsg) {
-					t.Errorf("expected error containing %q, got %q", tt.errMsg, err.Error())
-				}
-			} else {
-				if err != nil {
-					t.Errorf("unexpected error: %v", err)
-				}
-			}
-		})
-	}
-}
-
-// TestValidateClientID tests the ValidateClientID function
-func TestValidateClientID(t *testing.T) {
-	tests := []struct {
-		name     string
-		clientID string
-		errMsg   string
-		wantErr  bool
-	}{
-		{
-			name:     "valid client ID",
-			clientID: "my-application-client",
-			wantErr:  false,
-		},
-		{
-			name:     "valid UUID client ID",
-			clientID: "123e4567-e89b-12d3-a456-426614174000",
-			wantErr:  false,
-		},
-		{
-			name:     "empty client ID",
-			clientID: "",
-			wantErr:  true,
-			errMsg:   "client ID cannot be empty",
-		},
-		{
-			name:     "too short client ID",
-			clientID: "ab",
-			wantErr:  true,
-			errMsg:   "client ID appears to be too short",
-		},
-		{
-			name:     "minimum length client ID",
-			clientID: "abc",
-			wantErr:  false,
-		},
-		{
-			name:     "client ID with special characters",
-			clientID: "client-id_123.app",
-			wantErr:  false,
-		},
-		{
-			name:     "long client ID",
-			clientID: strings.Repeat("a", 255),
-			wantErr:  false,
-		},
-	}
-
-	validator := NewConfigValidator()
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validator.ValidateClientID(tt.clientID)
-
-			if tt.wantErr {
-				if err == nil {
-					t.Error("expected error, got nil")
-				} else if tt.errMsg != "" && !strings.Contains(err.Error(), tt.errMsg) {
-					t.Errorf("expected error containing %q, got %q", tt.errMsg, err.Error())
-				}
-			} else {
-				if err != nil {
-					t.Errorf("unexpected error: %v", err)
-				}
-			}
-		})
-	}
-}
-
-// TestValidateScopes tests the ValidateScopes function
-func TestValidateScopes(t *testing.T) {
-	tests := []struct {
-		name    string
-		errMsg  string
-		scopes  []string
-		wantErr bool
-	}{
-		{
-			name:    "valid scopes with openid",
-			scopes:  []string{"openid", "email", "profile"},
-			wantErr: false,
-		},
-		{
-			name:    "only openid scope",
-			scopes:  []string{"openid"},
-			wantErr: false,
-		},
-		{
-			name:    "openid with whitespace",
-			scopes:  []string{" openid ", "email"},
-			wantErr: false,
-		},
-		{
-			name:    "empty scopes",
-			scopes:  []string{},
-			wantErr: true,
-			errMsg:  "at least one scope must be provided",
-		},
-		{
-			name:    "nil scopes",
-			scopes:  nil,
-			wantErr: true,
-			errMsg:  "at least one scope must be provided",
-		},
-		{
-			name:    "missing openid scope",
-			scopes:  []string{"email", "profile"},
-			wantErr: true,
-			errMsg:  "'openid' scope is required",
-		},
-		{
-			name:    "duplicate openid scope",
-			scopes:  []string{"openid", "openid", "email"},
-			wantErr: false,
-		},
-		{
-			name:    "custom scopes with openid",
-			scopes:  []string{"openid", "api:read", "api:write"},
-			wantErr: false,
-		},
-	}
-
-	validator := NewConfigValidator()
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validator.ValidateScopes(tt.scopes)
-
-			if tt.wantErr {
-				if err == nil {
-					t.Error("expected error, got nil")
-				} else if tt.errMsg != "" && !strings.Contains(err.Error(), tt.errMsg) {
-					t.Errorf("expected error containing %q, got %q", tt.errMsg, err.Error())
-				}
-			} else {
-				if err != nil {
-					t.Errorf("unexpected error: %v", err)
-				}
-			}
-		})
-	}
-}
-
-// TestValidateRedirectURL tests the ValidateRedirectURL function
-func TestValidateRedirectURL(t *testing.T) {
-	tests := []struct {
-		name        string
-		redirectURL string
-		errMsg      string
-		wantErr     bool
-	}{
-		{
-			name:        "valid https redirect URL",
-			redirectURL: "https://example.com/callback",
-			wantErr:     false,
-		},
-		{
-			name:        "valid http redirect URL",
-			redirectURL: "http://localhost:3000/auth/callback",
-			wantErr:     false,
-		},
-		{
-			name:        "empty redirect URL",
-			redirectURL: "",
-			wantErr:     true,
-			errMsg:      "redirect URL cannot be empty",
-		},
-		{
-			name:        "redirect URL without scheme",
-			redirectURL: "example.com/callback",
-			wantErr:     true,
-			errMsg:      "redirect URL must include scheme",
-		},
-		{
-			name:        "malformed redirect URL",
-			redirectURL: "ht!tp://[invalid",
-			wantErr:     true,
-			errMsg:      "invalid redirect URL format",
-		},
-		{
-			name:        "redirect URL with query parameters",
-			redirectURL: "https://example.com/callback?state=abc",
-			wantErr:     false,
-		},
-		{
-			name:        "redirect URL with fragment",
-			redirectURL: "https://example.com/callback#section",
-			wantErr:     false,
-		},
-	}
-
-	validator := NewConfigValidator()
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validator.ValidateRedirectURL(tt.redirectURL)
-
-			if tt.wantErr {
-				if err == nil {
-					t.Error("expected error, got nil")
-				} else if tt.errMsg != "" && !strings.Contains(err.Error(), tt.errMsg) {
-					t.Errorf("expected error containing %q, got %q", tt.errMsg, err.Error())
-				}
-			} else {
-				if err != nil {
-					t.Errorf("unexpected error: %v", err)
-				}
-			}
-		})
-	}
-}
-
-// TestValidateProviderSpecificConfig tests provider-specific configuration validation
-func TestValidateProviderSpecificConfig(t *testing.T) {
-	tests := []struct {
-		provider OIDCProvider
-		config   map[string]interface{}
-		name     string
-		errMsg   string
-		wantErr  bool
-	}{
-		{
-			name:     "valid Google config",
-			provider: NewGoogleProvider(),
-			config: map[string]interface{}{
-				"issuer_url": "https://accounts.google.com",
-			},
-			wantErr: false,
-		},
-		{
-			name:     "invalid Google config - wrong issuer",
-			provider: NewGoogleProvider(),
-			config: map[string]interface{}{
-				"issuer_url": "https://example.com",
-			},
-			wantErr: true,
-			errMsg:  "google provider requires issuer URL to contain accounts.google.com",
-		},
-		{
-			name:     "valid Azure config with tenant ID",
-			provider: NewAzureProvider(),
-			config: map[string]interface{}{
-				"issuer_url": "https://login.microsoftonline.com/12345678-1234-1234-1234-123456789012/v2.0",
-			},
-			wantErr: false,
-		},
-		{
-			name:     "invalid Azure config - wrong domain",
-			provider: NewAzureProvider(),
-			config: map[string]interface{}{
-				"issuer_url": "https://example.com/tenant",
-			},
-			wantErr: true,
-			errMsg:  "azure provider requires issuer URL to contain login.microsoftonline.com",
-		},
-		{
-			name:     "Azure config with sts.windows.net",
-			provider: NewAzureProvider(),
-			config: map[string]interface{}{
-				"issuer_url": "https://sts.windows.net/12345678-1234-1234-1234-123456789012",
-			},
-			wantErr: false,
-		},
-		{
-			name:     "Azure config without tenant ID",
-			provider: NewAzureProvider(),
-			config: map[string]interface{}{
-				"issuer_url": "https://login.microsoftonline.com/common",
-			},
-			wantErr: true,
-			errMsg:  "azure issuer URL should include tenant ID",
-		},
-		{
-			name:     "valid generic provider config",
-			provider: NewGenericProvider(),
-			config: map[string]interface{}{
-				"issuer_url": "https://auth.example.com",
-			},
-			wantErr: false,
-		},
-		{
-			name:     "empty config for generic provider",
-			provider: NewGenericProvider(),
-			config:   map[string]interface{}{},
-			wantErr:  false,
-		},
-	}
-
-	validator := NewConfigValidator()
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validator.ValidateProviderSpecificConfig(tt.provider, tt.config)
-
-			if tt.wantErr {
-				if err == nil {
-					t.Error("expected error, got nil")
-				} else if tt.errMsg != "" && !strings.Contains(err.Error(), tt.errMsg) {
-					t.Errorf("expected error containing %q, got %q", tt.errMsg, err.Error())
-				}
-			} else {
-				if err != nil {
-					t.Errorf("unexpected error: %v", err)
-				}
-			}
-		})
-	}
-}
-
-// TestValidateProviderSpecificConfig_UnknownProvider tests handling of unknown provider types
-func TestValidateProviderSpecificConfig_UnknownProvider(t *testing.T) {
-	validator := NewConfigValidator()
-
-	// Create a mock provider with invalid type
-	mockProvider := &mockUnknownProvider{}
-
-	err := validator.ValidateProviderSpecificConfig(mockProvider, map[string]interface{}{})
-	if err == nil {
-		t.Error("expected error for unknown provider type")
-	}
-	if !strings.Contains(err.Error(), "unknown provider type") {
-		t.Errorf("expected 'unknown provider type' error, got: %v", err)
-	}
-}
-
-// mockUnknownProvider is a test provider with an invalid type
-type mockUnknownProvider struct{}
-
-func (m *mockUnknownProvider) GetType() ProviderType {
-	return ProviderType(999) // Invalid type
-}
-
-func (m *mockUnknownProvider) GetCapabilities() ProviderCapabilities {
-	return ProviderCapabilities{}
-}
-
-func (m *mockUnknownProvider) ValidateTokens(session Session, verifier TokenVerifier, tokenCache TokenCache, refreshGracePeriod time.Duration) (*ValidationResult, error) {
-	return &ValidationResult{}, nil
-}
-
-func (m *mockUnknownProvider) BuildAuthParams(baseParams url.Values, scopes []string) (*AuthParams, error) {
-	return &AuthParams{}, nil
-}
-
-func (m *mockUnknownProvider) HandleTokenRefresh(tokenData *TokenResult) error {
-	return nil
-}
-
-func (m *mockUnknownProvider) ValidateConfig() error {
-	return nil
-}
-
-// TestValidateGoogleConfig_EdgeCases tests edge cases for Google config validation
-func TestValidateGoogleConfig_EdgeCases(t *testing.T) {
-	validator := NewConfigValidator()
-	googleProvider := NewGoogleProvider()
-
-	tests := []struct {
-		config  map[string]interface{}
-		name    string
-		wantErr bool
-	}{
-		{
-			name:    "config without issuer_url",
-			config:  map[string]interface{}{},
-			wantErr: false, // Should pass as issuer_url is not present
-		},
-		{
-			name: "config with non-string issuer_url",
-			config: map[string]interface{}{
-				"issuer_url": 123,
-			},
-			wantErr: false, // Should pass as type assertion fails
-		},
-		{
-			name: "config with accounts.google.com in path",
-			config: map[string]interface{}{
-				"issuer_url": "https://example.com/accounts.google.com",
-			},
-			wantErr: false, // Should pass as it contains the required string
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validator.ValidateProviderSpecificConfig(googleProvider, tt.config)
-
-			if tt.wantErr && err == nil {
-				t.Error("expected error, got nil")
-			} else if !tt.wantErr && err != nil {
-				t.Errorf("unexpected error: %v", err)
-			}
-		})
-	}
-}
-
-// TestValidateAzureConfig_EdgeCases tests edge cases for Azure config validation
-func TestValidateAzureConfig_EdgeCases(t *testing.T) {
-	validator := NewConfigValidator()
-	azureProvider := NewAzureProvider()
-
-	tests := []struct {
-		config  map[string]interface{}
-		name    string
-		errMsg  string
-		wantErr bool
-	}{
-		{
-			name: "valid tenant ID format",
-			config: map[string]interface{}{
-				"issuer_url": "https://login.microsoftonline.com/a1b2c3d4-e5f6-7890-abcd-ef1234567890/v2.0",
-			},
-			wantErr: false,
-		},
-		{
-			name: "tenant ID in different position",
-			config: map[string]interface{}{
-				"issuer_url": "https://login.microsoftonline.com/v2.0/a1b2c3d4-e5f6-7890-abcd-ef1234567890/oauth",
-			},
-			wantErr: false,
-		},
-		{
-			name: "malformed URL for parsing",
-			config: map[string]interface{}{
-				"issuer_url": "https://login.microsoftonline.com/[invalid",
-			},
-			wantErr: true,
-			errMsg:  "azure issuer URL should include tenant ID",
-		},
-		{
-			name:    "config without issuer_url",
-			config:  map[string]interface{}{},
-			wantErr: false,
-		},
-		{
-			name: "config with non-string issuer_url",
-			config: map[string]interface{}{
-				"issuer_url": []string{"https://login.microsoftonline.com"},
-			},
-			wantErr: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validator.ValidateProviderSpecificConfig(azureProvider, tt.config)
-
-			if tt.wantErr {
-				if err == nil {
-					t.Error("expected error, got nil")
-				} else if tt.errMsg != "" && !strings.Contains(err.Error(), tt.errMsg) {
-					t.Errorf("expected error containing %q, got %q", tt.errMsg, err.Error())
-				}
-			} else {
-				if err != nil {
-					t.Errorf("unexpected error: %v", err)
-				}
-			}
-		})
-	}
-}

internal/providers/warnings.go

@@ -1,152 +0,0 @@
-package providers
-
-import (
-	"fmt"
-	"strings"
-)
-
-// ProviderWarning represents a warning about provider limitations or requirements.
-type ProviderWarning struct {
-	Level        string
-	Message      string
-	ProviderType ProviderType
-}
-
-// GetProviderWarnings returns warnings about provider-specific limitations.
-func GetProviderWarnings(providerType ProviderType) []ProviderWarning {
-	var warnings []ProviderWarning
-
-	switch providerType {
-	case ProviderTypeGitHub:
-		warnings = append(warnings,
-			ProviderWarning{
-				ProviderType: ProviderTypeGitHub,
-				Level:        "warning",
-				Message:      "GitHub uses OAuth 2.0, not OpenID Connect. ID tokens are not available. Use access tokens for API calls only.",
-			},
-			ProviderWarning{
-				ProviderType: ProviderTypeGitHub,
-				Level:        "info",
-				Message:      "GitHub OAuth apps do not support refresh tokens. Users will need to re-authenticate when tokens expire.",
-			})
-
-	case ProviderTypeAuth0:
-		warnings = append(warnings, ProviderWarning{
-			ProviderType: ProviderTypeAuth0,
-			Level:        "info",
-			Message:      "Auth0 requires 'offline_access' scope for refresh tokens. This will be automatically added.",
-		})
-
-	case ProviderTypeOkta:
-		warnings = append(warnings, ProviderWarning{
-			ProviderType: ProviderTypeOkta,
-			Level:        "info",
-			Message:      "Okta requires proper application configuration in your Okta admin console for OIDC to work.",
-		})
-
-	case ProviderTypeKeycloak:
-		warnings = append(warnings, ProviderWarning{
-			ProviderType: ProviderTypeKeycloak,
-			Level:        "info",
-			Message:      "Keycloak detection is based on URL path '/auth/realms/'. Ensure your issuer URL follows this pattern.",
-		})
-
-	case ProviderTypeAWSCognito:
-		warnings = append(warnings, ProviderWarning{
-			ProviderType: ProviderTypeAWSCognito,
-			Level:        "info",
-			Message:      "AWS Cognito uses regional endpoints. Ensure your issuer URL includes the correct region (e.g., cognito-idp.us-east-1.amazonaws.com).",
-		})
-
-	case ProviderTypeGitLab:
-		warnings = append(warnings, ProviderWarning{
-			ProviderType: ProviderTypeGitLab,
-			Level:        "info",
-			Message:      "GitLab supports OIDC but requires application registration in GitLab admin settings.",
-		})
-	}
-
-	return warnings
-}
-
-// ValidateProviderCompatibility checks if a provider is suitable for OIDC authentication.
-func ValidateProviderCompatibility(providerType ProviderType, requiresOIDC bool) error {
-	switch providerType {
-	case ProviderTypeGitHub:
-		if requiresOIDC {
-			return fmt.Errorf("GitHub does not support OpenID Connect. It only supports OAuth 2.0. Consider using a different provider for OIDC authentication")
-		}
-		return nil
-	default:
-		return nil
-	}
-}
-
-// GetProviderRecommendations returns setup recommendations for each provider.
-func GetProviderRecommendations(providerType ProviderType) []string {
-	switch providerType {
-	case ProviderTypeGitHub:
-		return []string{
-			"Register an OAuth App in GitHub Settings > Developer settings > OAuth Apps",
-			"Use scopes: 'user:email', 'read:user' for basic profile access",
-			"GitHub tokens expire, plan for re-authentication flow",
-		}
-
-	case ProviderTypeAuth0:
-		return []string{
-			"Create an Application in Auth0 Dashboard",
-			"Set Application Type to 'Regular Web Application'",
-			"Configure Allowed Callback URLs with your redirect URI",
-			"Enable 'offline_access' scope for refresh tokens",
-		}
-
-	case ProviderTypeOkta:
-		return []string{
-			"Create an App Integration in Okta Admin Console",
-			"Choose 'OIDC - OpenID Connect' as sign-in method",
-			"Select 'Web Application' as application type",
-			"Configure redirect URIs and assign users/groups",
-		}
-
-	case ProviderTypeKeycloak:
-		return []string{
-			"Create a Client in your Keycloak realm",
-			"Set Client Protocol to 'openid-connect'",
-			"Configure Valid Redirect URIs",
-			"Ensure issuer URL format: https://your-keycloak/auth/realms/your-realm",
-		}
-
-	case ProviderTypeAWSCognito:
-		return []string{
-			"Create a User Pool in AWS Cognito",
-			"Create an App Client with 'Authorization code grant' enabled",
-			"Configure App Client settings and callback URLs",
-			"Use issuer URL format: https://cognito-idp.{region}.amazonaws.com/{userPoolId}",
-		}
-
-	case ProviderTypeGitLab:
-		return []string{
-			"Create an Application in GitLab (Admin Area > Applications)",
-			"Select 'openid', 'profile', 'email' scopes",
-			"Configure Redirect URI",
-			"Use issuer URL: https://gitlab.com (for GitLab.com)",
-		}
-
-	default:
-		return []string{}
-	}
-}
-
-// FormatProviderWarnings formats warnings for display.
-func FormatProviderWarnings(warnings []ProviderWarning) string {
-	if len(warnings) == 0 {
-		return ""
-	}
-
-	var result strings.Builder
-	for _, warning := range warnings {
-		result.WriteString(fmt.Sprintf("[%s] %s\n", strings.ToUpper(warning.Level), warning.Message))
-	}
-
-	return result.String()
-}

internal/providers/warnings_test.go

@@ -1,195 +0,0 @@
-package providers
-
-import (
-	"strings"
-	"testing"
-)
-
-// TestGetProviderWarnings tests that warnings are provided for providers with limitations
-func TestGetProviderWarnings(t *testing.T) {
-	tests := []struct {
-		name         string
-		checkContent string
-		providerType ProviderType
-		expectCount  int
-	}{
-		{
-			name:         "GitHub has OAuth 2.0 warning",
-			providerType: ProviderTypeGitHub,
-			expectCount:  2,
-			checkContent: "OAuth 2.0",
-		},
-		{
-			name:         "Auth0 has offline_access info",
-			providerType: ProviderTypeAuth0,
-			expectCount:  1,
-			checkContent: "offline_access",
-		},
-		{
-			name:         "Okta has configuration info",
-			providerType: ProviderTypeOkta,
-			expectCount:  1,
-			checkContent: "admin console",
-		},
-		{
-			name:         "AWS Cognito has regional endpoint info",
-			providerType: ProviderTypeAWSCognito,
-			expectCount:  1,
-			checkContent: "regional endpoints",
-		},
-		{
-			name:         "Generic provider has no warnings",
-			providerType: ProviderTypeGeneric,
-			expectCount:  0,
-			checkContent: "",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			warnings := GetProviderWarnings(tt.providerType)
-
-			if len(warnings) != tt.expectCount {
-				t.Errorf("Expected %d warnings, got %d", tt.expectCount, len(warnings))
-			}
-
-			if tt.checkContent != "" {
-				found := false
-				for _, warning := range warnings {
-					if strings.Contains(strings.ToLower(warning.Message), strings.ToLower(tt.checkContent)) {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("Expected warning content '%s' not found", tt.checkContent)
-				}
-			}
-		})
-	}
-}
-
-// TestValidateProviderCompatibility tests OIDC compatibility validation
-func TestValidateProviderCompatibility(t *testing.T) {
-	tests := []struct {
-		name         string
-		providerType ProviderType
-		requiresOIDC bool
-		expectError  bool
-	}{
-		{
-			name:         "GitHub with OIDC requirement should error",
-			providerType: ProviderTypeGitHub,
-			requiresOIDC: true,
-			expectError:  true,
-		},
-		{
-			name:         "GitHub without OIDC requirement should pass",
-			providerType: ProviderTypeGitHub,
-			requiresOIDC: false,
-			expectError:  false,
-		},
-		{
-			name:         "Auth0 with OIDC requirement should pass",
-			providerType: ProviderTypeAuth0,
-			requiresOIDC: true,
-			expectError:  false,
-		},
-		{
-			name:         "Google with OIDC requirement should pass",
-			providerType: ProviderTypeGoogle,
-			requiresOIDC: true,
-			expectError:  false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := ValidateProviderCompatibility(tt.providerType, tt.requiresOIDC)
-
-			if tt.expectError && err == nil {
-				t.Error("Expected error but got none")
-			}
-
-			if !tt.expectError && err != nil {
-				t.Errorf("Unexpected error: %v", err)
-			}
-		})
-	}
-}
-
-// TestGetProviderRecommendations tests that recommendations are provided
-func TestGetProviderRecommendations(t *testing.T) {
-	tests := []struct {
-		name         string
-		providerType ProviderType
-		expectMin    int
-	}{
-		{
-			name:         "GitHub recommendations",
-			providerType: ProviderTypeGitHub,
-			expectMin:    3,
-		},
-		{
-			name:         "Auth0 recommendations",
-			providerType: ProviderTypeAuth0,
-			expectMin:    3,
-		},
-		{
-			name:         "AWS Cognito recommendations",
-			providerType: ProviderTypeAWSCognito,
-			expectMin:    3,
-		},
-		{
-			name:         "Generic provider no recommendations",
-			providerType: ProviderTypeGeneric,
-			expectMin:    0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			recommendations := GetProviderRecommendations(tt.providerType)
-
-			if len(recommendations) < tt.expectMin {
-				t.Errorf("Expected at least %d recommendations, got %d", tt.expectMin, len(recommendations))
-			}
-		})
-	}
-}
-
-// TestFormatProviderWarnings tests warning formatting
-func TestFormatProviderWarnings(t *testing.T) {
-	warnings := []ProviderWarning{
-		{
-			ProviderType: ProviderTypeGitHub,
-			Level:        "warning",
-			Message:      "Test warning message",
-		},
-		{
-			ProviderType: ProviderTypeGitHub,
-			Level:        "info",
-			Message:      "Test info message",
-		},
-	}
-
-	formatted := FormatProviderWarnings(warnings)
-
-	if !strings.Contains(formatted, "[WARNING]") {
-		t.Error("Expected formatted output to contain [WARNING]")
-	}
-
-	if !strings.Contains(formatted, "[INFO]") {
-		t.Error("Expected formatted output to contain [INFO]")
-	}
-
-	if !strings.Contains(formatted, "Test warning message") {
-		t.Error("Expected formatted output to contain warning message")
-	}
-
-	// Test empty warnings
-	emptyFormatted := FormatProviderWarnings([]ProviderWarning{})
-	if emptyFormatted != "" {
-		t.Error("Expected empty string for no warnings")
-	}
-}

internal/recovery/circuit_breaker.go

@@ -177,8 +177,18 @@ func (cb *CircuitBreaker) recordSuccess() {
 	state := CircuitBreakerState(atomic.LoadInt32(&cb.state))
 
 	// #nosec G115 -- SuccessThreshold is a small config value that fits in int32
-	if state == CircuitBreakerHalfOpen && successes >= int32(cb.config.SuccessThreshold) {
-		cb.transitionToClosed()
+	if state == CircuitBreakerHalfOpen {
+		if successes >= int32(cb.config.SuccessThreshold) {
+			cb.transitionToClosed() // resets halfOpenRequests to 0
+		} else {
+			// Release the probe slot so the half-open gate can accept the
+			// next request. Without this, halfOpenRequests stays pinned at
+			// MaxRequests once the first batch of probes completes, every
+			// later request is rejected, and consecutiveSuccesses can never
+			// reach SuccessThreshold if it exceeds MaxRequests — leaving the
+			// circuit stuck half-open forever.
+			atomic.AddInt32(&cb.halfOpenRequests, -1)
+		}
 	}
 }
 

internal/recovery/metrics.go

@@ -3,6 +3,8 @@ package recovery
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
 	"math"
 	"math/rand"
@@ -129,6 +131,42 @@ func (re *RetryExecutor) Execute(ctx context.Context, fn func() error) error {
 	return re.ExecuteWithContext(ctx, fn)
 }
 
+// asHTTPError reports whether err is, or (via a chain of Unwrap() error
+// methods) wraps, an *HTTPError. It exists because errors.As cannot be used
+// here: under yaegi v0.16.1 (the interpreter Traefik uses to load the
+// traefikoidc plugin, which imports this package transitively via
+// internal/utils), errors.As(err, &target) panics with "errors: *target must
+// be interface or implement error" whenever target's pointed-to type is
+// itself interpreted, and *HTTPError is declared in this package so it is
+// always interpreted at runtime, regardless of err's own concrete type.
+//
+// This manually reimplements errors.As's single-chain Unwrap() walk using
+// only type assertions and errors.Unwrap, both yaegi-safe, so native
+// classification is byte-for-byte identical to errors.As (see
+// TestR175_WrappedRetryableErrorIsRetried). See asOIDCError for the *OIDCError
+// equivalent.
+func asHTTPError(err error) (*HTTPError, bool) {
+	for err != nil {
+		if httpErr, ok := err.(*HTTPError); ok {
+			return httpErr, true
+		}
+		err = errors.Unwrap(err)
+	}
+	return nil, false
+}
+
+// asOIDCError is asHTTPError's counterpart for *OIDCError. See asHTTPError's
+// doc comment for why this exists instead of errors.As.
+func asOIDCError(err error) (*OIDCError, bool) {
+	for err != nil {
+		if oidcErr, ok := err.(*OIDCError); ok {
+			return oidcErr, true
+		}
+		err = errors.Unwrap(err)
+	}
+	return nil, false
+}
+
 // isRetryableError determines if an error should trigger a retry
 func (re *RetryExecutor) isRetryableError(err error) bool {
 	if err == nil {
@@ -144,8 +182,13 @@ func (re *RetryExecutor) isRetryableError(err error) bool {
 		}
 	}
 
-	// Check for HTTP errors
-	if httpErr, ok := err.(*HTTPError); ok {
+	// Check for HTTP errors. Use asHTTPError (not errors.As -- see its doc
+	// comment) so an error that wraps an *HTTPError — e.g. fmt.Errorf("token
+	// exchange failed: %w", httpErr) — is still recognized as retryable: a
+	// wrapped retryable error must not be misclassified as terminal and bail
+	// after one attempt, defeating retry despite the production wrapping
+	// pattern.
+	if httpErr, ok := asHTTPError(err); ok {
 		for _, code := range re.config.RetryableStatusCodes {
 			if httpErr.StatusCode == code {
 				return true
@@ -157,13 +200,13 @@ func (re *RetryExecutor) isRetryableError(err error) bool {
 		}
 	}
 
-	// Check for OIDC errors
-	if oidcErr, ok := err.(*OIDCError); ok {
+	// Check for OIDC errors (unwrapped or wrapped).
+	if oidcErr, ok := asOIDCError(err); ok {
 		return oidcErr.IsRetryable()
 	}
 
 	// Check for context errors (don't retry these)
-	if err == context.Canceled || err == context.DeadlineExceeded {
+	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
 		return false
 	}
 
@@ -186,6 +229,12 @@ func (re *RetryExecutor) calculateDelay(attempt int) time.Duration {
 	if re.config.RandomizationFactor > 0 {
 		jitter := delay * re.config.RandomizationFactor
 		minDelay := delay - jitter
+		// A RandomizationFactor > 1 makes minDelay negative, which turns
+		// time.After(negative) into an immediate (zero) backoff and defeats
+		// the retry spacing (R150). Clamp to zero so backoff stays bounded.
+		if minDelay < 0 {
+			minDelay = 0
+		}
 		maxDelay := delay + jitter
 		delay = minDelay + rand.Float64()*(maxDelay-minDelay)
 	}
@@ -376,9 +425,13 @@ func (rm *RecoveryMetrics) HTTPMetricsHandler() http.HandlerFunc {
 			"health":  health,
 		}
 
-		// Would normally use json.Marshal here, but keeping it simple for the module
+		body, err := json.Marshal(response)
+		if err != nil {
+			http.Error(w, "failed to marshal metrics", http.StatusInternalServerError)
+			return
+		}
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusOK)
-		fmt.Fprintf(w, "%v", response)
+		_, _ = w.Write(body)
 	}
 }

internal/recovery/metrics_test.go

@@ -4,6 +4,7 @@ package recovery
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"net/http"
 	"net/http/httptest"
@@ -720,6 +721,16 @@ func TestRecoveryMetrics_HTTPMetricsHandler(t *testing.T) {
 	if body == "" {
 		t.Error("Expected non-empty response body")
 	}
+
+	// Body must be valid JSON (R147): the handler previously declared
+	// Content-Type: application/json but wrote Go map syntax via fmt.
+	var decoded map[string]any
+	if err := json.Unmarshal([]byte(body), &decoded); err != nil {
+		t.Errorf("metrics body is not valid JSON: %v (body: %s)", err, body)
+	}
+	if _, ok := decoded["metrics"]; !ok {
+		t.Errorf("metrics JSON body must contain a \"metrics\" key, got: %s", body)
+	}
 }
 
 // =============================================================================

internal/recovery/review_halfopen_regression_test.go

@@ -0,0 +1,59 @@
+package recovery
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+// TestCircuitBreaker_HalfOpenRecoversWhenSuccessThresholdExceedsMaxRequests
+// guards the fix that releases the half-open probe slot when a probe
+// completes below the success threshold.
+//
+// Repro scenario: SuccessThreshold (3) exceeds MaxRequests (1). Without
+// the fix, the single allowed half-open probe stays counted in
+// halfOpenRequests after it completes, so every later request is rejected
+// by the MaxRequests gate and consecutiveSuccesses can never reach the
+// threshold — the circuit hangs half-open forever. With the fix the slot
+// is released on completion, so sequential successful probes accumulate
+// to the threshold and the circuit closes.
+func TestCircuitBreaker_HalfOpenRecoversWhenSuccessThresholdExceedsMaxRequests(t *testing.T) {
+	config := CircuitBreakerConfig{
+		FailureThreshold: 1,
+		SuccessThreshold: 3,
+		Timeout:          50 * time.Millisecond,
+		MaxRequests:      1,
+	}
+	cb := NewCircuitBreaker(config, &mockLogger{})
+
+	// Drive the circuit open with a single failure.
+	if err := cb.ExecuteWithContext(context.Background(), func() error {
+		return errors.New("fail")
+	}); err == nil {
+		t.Fatal("expected error from failed execution")
+	}
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Fatalf("expected open after failure, got %s", cb.GetState())
+	}
+
+	// Wait for the open timeout so the next request transitions to half-open.
+	time.Sleep(70 * time.Millisecond)
+
+	// Accumulate successes one at a time (MaxRequests == 1). With the fix
+	// each completed probe releases its slot, so the breaker reaches the
+	// success threshold and closes.
+	for i := 0; i < config.SuccessThreshold; i++ {
+		err := cb.ExecuteWithContext(context.Background(), func() error {
+			return nil
+		})
+		if err != nil {
+			t.Fatalf("successful execution %d returned error: %v (state %s)", i, err, cb.GetState())
+		}
+	}
+
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Fatalf("expected circuit to close after %d half-open successes, got %s",
+			config.SuccessThreshold, cb.GetState())
+	}
+}

internal/recovery/review_r150_test.go

@@ -0,0 +1,25 @@
+package recovery
+
+import (
+	"testing"
+	"time"
+)
+
+// TestRetryExecutor_HighRandomizationNoNegativeDelay guards the R150 fix in
+// RetryExecutor.calculateDelay: with RandomizationFactor > 1 the raw
+// minDelay = delay*(1-RF) is negative, letting time.After(negative)
+// fire immediately and defeating backoff. Delays must be clamped to
+// >= 0.
+func TestRetryExecutor_HighRandomizationNoNegativeDelay(t *testing.T) {
+	exec := NewRetryExecutor(RetryConfig{
+		InitialDelay:        100 * time.Millisecond,
+		MaxDelay:            2 * time.Second,
+		Multiplier:          2.0,
+		RandomizationFactor: 2.5, // > 1: un-fixed code yields negative delays
+	}, &mockLogger{})
+	for attempt := 1; attempt <= 2000; attempt++ {
+		if d := exec.calculateDelay(attempt); d < 0 {
+			t.Fatalf("attempt %d produced negative delay %v", attempt, d)
+		}
+	}
+}