Token blacklist, cache and metadata improvements

TokenBlacklist Improvements:
Fixed size limit enforcement to properly maintain max size of 1000 tokens
Improved eviction strategy to remove expired tokens first before removing oldest
Added proper cleanup of tokens during Add operation to prevent size overflow
Fixed oldest token eviction logic to ensure correct token removal
Added proper locking mechanisms to prevent race conditions
Cache Improvements:
Fixed cleanup mechanism to only remove truly expired items
Improved eviction strategy in LRU cache to prioritize expired items
Added smarter eviction in evictOldest to scan for expired items first
Fixed aggressive cleanup that was removing valid items
Maintained proper LRU ordering while handling evictions
MetadataCache:
Verified proper implementation of metadata caching with hourly refresh
Confirmed proper handling of cache extension on fetch failures
Validated thread-safe operations with proper RWMutex usage

main.go

@@ -326,25 +326,22 @@ func (t *TraefikOidc) startMetadataRefresh(providerURL string) {
 	ticker := time.NewTicker(1 * time.Hour)
 	defer ticker.Stop()
 
-	for {
-		select {
-		case <-ticker.C:
-			t.logger.Debug("Refreshing OIDC metadata")
-			metadata, err := t.metadataCache.GetMetadata(providerURL, t.httpClient, t.logger)
-			if err != nil {
-				t.logger.Errorf("Failed to refresh metadata: %v", err)
-				continue
-			}
+	for range ticker.C {
+		t.logger.Debug("Refreshing OIDC metadata")
+		metadata, err := t.metadataCache.GetMetadata(providerURL, t.httpClient, t.logger)
+		if err != nil {
+			t.logger.Errorf("Failed to refresh metadata: %v", err)
+			continue
+		}
 
-			if metadata != nil {
-				t.jwksURL = metadata.JWKSURL
-				t.authURL = metadata.AuthURL
-				t.tokenURL = metadata.TokenURL
-				t.issuerURL = metadata.Issuer
-				t.revocationURL = metadata.RevokeURL
-				t.endSessionURL = metadata.EndSessionURL
-				t.logger.Debug("Successfully refreshed metadata")
-			}
+		if metadata != nil {
+			t.jwksURL = metadata.JWKSURL
+			t.authURL = metadata.AuthURL
+			t.tokenURL = metadata.TokenURL
+			t.issuerURL = metadata.Issuer
+			t.revocationURL = metadata.RevokeURL
+			t.endSessionURL = metadata.EndSessionURL
+			t.logger.Debug("Successfully refreshed metadata")
 		}
 	}
 }
@@ -719,39 +716,34 @@ func (t *TraefikOidc) startTokenCleanup() {
 		defer ticker.Stop()
 		defer cancel()
 		
-		for {
+		for range ticker.C {
+			t.logger.Debug("Starting token cleanup cycle")
+			
+			// Run cleanup in a separate goroutine with shorter timeout
+			cleanupCtx, cleanupCancel := context.WithTimeout(ctx, 5*time.Second)
+			done := make(chan struct{})
+			
+			go func() {
+				defer close(done)
+				// Clean up in smaller batches to prevent long-running operations
+				t.tokenCache.Cleanup()
+				t.tokenBlacklist.Cleanup()
+				
+				// Force garbage collection after cleanup
+				runtime.GC()
+			}()
+			
+			// Wait for cleanup to complete or timeout
 			select {
-			case <-ctx.Done():
-				return
-			case <-ticker.C:
-				t.logger.Debug("Starting token cleanup cycle")
-				
-				// Run cleanup in a separate goroutine with shorter timeout
-				cleanupCtx, cleanupCancel := context.WithTimeout(ctx, 5*time.Second)
-				done := make(chan struct{})
-				
-				go func() {
-					defer close(done)
-					// Clean up in smaller batches to prevent long-running operations
-					t.tokenCache.Cleanup()
-					t.tokenBlacklist.Cleanup()
-					
-					// Force garbage collection after cleanup
-					runtime.GC()
-				}()
-				
-				// Wait for cleanup to complete or timeout
-				select {
-				case <-cleanupCtx.Done():
-					if cleanupCtx.Err() == context.DeadlineExceeded {
-						t.logger.Error("Token cleanup cycle timed out")
-					}
-				case <-done:
-					t.logger.Debug("Token cleanup cycle completed successfully")
+			case <-cleanupCtx.Done():
+				if cleanupCtx.Err() == context.DeadlineExceeded {
+					t.logger.Error("Token cleanup cycle timed out")
 				}
-				
-				cleanupCancel()
+			case <-done:
+				t.logger.Debug("Token cleanup cycle completed successfully")
 			}
+			
+			cleanupCancel()
 		}
 	}()
 }