Add ability to set cookie max age - issue #91

Official redis client library won't work with yaegi.

.github/CODEOWNERS

@@ -0,0 +1,38 @@
+# Code Owners for traefik-oidc
+# These owners will be automatically requested for review when someone opens a PR
+
+# Default owner for everything in the repo
+* @lukaszraczylo
+
+# Core authentication and middleware
+/middleware/ @lukaszraczylo
+/auth/ @lukaszraczylo
+/handlers/ @lukaszraczylo
+
+# OIDC providers
+/internal/providers/ @lukaszraczylo
+
+# Session management and security
+/session/ @lukaszraczylo
+/internal/security/ @lukaszraczylo
+/security/ @lukaszraczylo
+
+# Token management
+/internal/token/ @lukaszraczylo
+
+# Configuration
+/config/ @lukaszraczylo
+/.traefik.yml @lukaszraczylo
+
+# GitHub Actions and CI/CD
+/.github/ @lukaszraczylo
+/.github/workflows/ @lukaszraczylo
+/.golangci.yml @lukaszraczylo
+
+# Documentation
+/docs/ @lukaszraczylo
+README.md @lukaszraczylo
+
+# Dependencies
+go.mod @lukaszraczylo
+go.sum @lukaszraczylo

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,123 @@
+## Description
+
+<!-- Provide a brief description of the changes in this PR -->
+
+## Type of Change
+
+<!-- Mark the relevant option with an "x" -->
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Documentation update
+- [ ] Performance improvement
+- [ ] Code refactoring
+- [ ] Security fix
+- [ ] Provider-specific fix/enhancement
+
+## Related Issues
+
+<!-- Link to related issues using #issue_number -->
+
+Fixes #
+Related to #
+
+## Changes Made
+
+<!-- List the main changes made in this PR -->
+
+-
+-
+-
+
+## Provider Impact
+
+<!-- If this affects specific OIDC providers, list them here -->
+
+- [ ] Google
+- [ ] Azure AD
+- [ ] Auth0
+- [ ] Okta
+- [ ] Keycloak
+- [ ] AWS Cognito
+- [ ] GitLab
+- [ ] GitHub
+- [ ] Generic OIDC
+- [ ] All providers
+
+## Testing Performed
+
+<!-- Describe the tests you ran to verify your changes -->
+
+- [ ] Unit tests pass locally
+- [ ] Integration tests pass locally
+- [ ] Race detector shows no issues
+- [ ] Memory leak tests pass
+- [ ] Manual testing performed
+
+### Test Configuration
+
+<!-- Provide details about your test configuration if applicable -->
+
+**Provider tested:**
+**Go version:**
+**Traefik version:**
+
+## Security Considerations
+
+<!-- Describe any security implications of these changes -->
+
+- [ ] This PR does not introduce security vulnerabilities
+- [ ] Security scanning has been performed
+- [ ] Credentials/secrets are properly handled
+- [ ] Input validation is implemented
+
+## Performance Impact
+
+<!-- Describe any performance implications -->
+
+- [ ] No performance impact expected
+- [ ] Performance improved (describe how)
+- [ ] Performance may be affected (describe why and mitigation)
+
+## Breaking Changes
+
+<!-- If this is a breaking change, describe the impact and migration path -->
+
+**Breaking changes:**
+
+
+**Migration guide:**
+
+
+## Checklist
+
+<!-- Ensure all items are checked before requesting review -->
+
+- [ ] My code follows the project's code style
+- [ ] I have performed a self-review of my code
+- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have made corresponding changes to the documentation
+- [ ] My changes generate no new warnings
+- [ ] I have added tests that prove my fix is effective or that my feature works
+- [ ] New and existing unit tests pass locally with my changes
+- [ ] Any dependent changes have been merged and published
+
+## Additional Context
+
+<!-- Add any other context, screenshots, or information about the PR here -->
+
+## Screenshots (if applicable)
+
+<!-- Add screenshots to help explain your changes -->
+
+---
+
+**For Reviewers:**
+
+Please verify:
+- [ ] Code quality and style
+- [ ] Test coverage is adequate
+- [ ] Security implications reviewed
+- [ ] Documentation is updated
+- [ ] No performance regressions

.github/dependabot.yml

@@ -0,0 +1,52 @@
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    reviewers:
+      - "lukaszraczylo"
+
+  # Maintain Go module dependencies
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "go"
+    reviewers:
+      - "lukaszraczylo"
+    # Group patch updates together
+    groups:
+      patch-updates:
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+      minor-updates:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+    # Ignore certain dependencies if needed
+    ignore:
+      # Example: ignore specific versions
+      # - dependency-name: "github.com/example/package"
+      #   versions: ["1.x", "2.x"]

.github/workflows/.gitattributes

@@ -0,0 +1,9 @@
+# Ensure consistent line endings
+* text=auto eol=lf
+
+# GitHub Actions files should use LF
+*.yml text eol=lf
+*.yaml text eol=lf
+
+# Shell scripts should use LF
+*.sh text eol=lf

.github/workflows/README.md

@@ -0,0 +1,225 @@
+# GitHub Actions Workflows
+
+This directory contains CI/CD workflows for the Traefik OIDC middleware.
+
+## Workflows
+
+### PR Validation (`pr-validation.yml`)
+
+A comprehensive validation workflow that runs **all checks in parallel** for maximum speed and thorough testing.
+
+**Triggered on:**
+- Pull requests to `main` branch
+- Pushes to `main` branch
+
+**Parallel Jobs (20+ concurrent checks):**
+
+#### Code Quality
+- **Quick Checks** - Format, go vet, go mod verify
+- **golangci-lint** - Comprehensive linting
+- **Staticcheck** - Static analysis
+
+#### Security
+- **Gosec** - Security vulnerability scanning
+- **Govulncheck** - Go vulnerability database check
+- **CodeQL** - GitHub's code analysis
+
+#### Testing
+- **Race Detector** - Concurrent access bug detection
+- **Coverage** - Test coverage with 75% threshold
+- **Memory Leaks** - Goroutine and memory leak detection
+- **Integration Tests** - Full integration test suite
+- **Regression Tests** - Prevent previously fixed bugs
+- **Security Edge Cases** - Security-specific scenarios
+- **Session Tests** - Session management validation
+- **Token Tests** - Token validation scenarios
+- **CSRF Tests** - CSRF protection validation
+
+#### Provider Testing (Matrix)
+Tests run in parallel for each OIDC provider:
+- Google
+- Azure AD
+- Auth0
+- Okta
+- Keycloak
+- AWS Cognito
+- GitLab
+- GitHub
+- Generic OIDC
+
+#### Performance & Compatibility
+- **Benchmarks** - Performance regression detection
+- **Build Matrix** - linux/darwin × amd64/arm64
+- **Go Versions** - Go 1.23 and 1.24 compatibility
+
+#### Final Validation
+- **All Checks Passed** - Ensures all jobs succeeded
+
+## Workflow Features
+
+### 🚀 Parallel Execution
+All independent checks run simultaneously for fastest feedback (~5-10 minutes for full suite).
+
+### 📊 Coverage Reporting
+- Automatic PR comments with coverage statistics
+- Per-package coverage breakdown
+- 75% coverage threshold enforcement
+
+### 🔒 Security First
+- Multiple security scanners (gosec, govulncheck, CodeQL)
+- SARIF report uploads for GitHub Security tab
+- Security edge case testing
+
+### 🎯 Comprehensive Testing
+- Race condition detection
+- Memory leak detection
+- Provider-specific testing
+- Integration and regression tests
+
+### 📈 Performance Tracking
+- Benchmark results stored as artifacts
+- Performance regression detection
+
+### ✅ Quality Gates
+All checks must pass before PR can be merged:
+- Code formatting and style
+- Security vulnerabilities
+- Test coverage threshold
+- Race conditions
+- Memory leaks
+- Build success on all platforms
+
+## Local Development
+
+### Run checks locally before pushing:
+
+```bash
+# Format code
+gofmt -s -w .
+
+# Run linter
+golangci-lint run
+
+# Run tests with race detector
+go test -race -timeout=15m -count=1 ./...
+
+# Check coverage
+go test -coverprofile=coverage.out ./...
+go tool cover -func=coverage.out
+
+# Run specific test suites
+go test -v -run='.*Leak.*' ./...           # Memory leak tests
+go test -v -run='.*Integration.*' ./...    # Integration tests
+go test -v -run='.*Regression.*' ./...     # Regression tests
+
+# Run benchmarks
+go test -bench=. -benchmem ./...
+
+# Security scan
+gosec ./...
+govulncheck ./...
+```
+
+### Required Tools
+
+Install these tools for local development:
+
+```bash
+# golangci-lint
+go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+
+# staticcheck
+go install honnef.co/go/tools/cmd/staticcheck@latest
+
+# gosec
+go install github.com/securego/gosec/v2/cmd/gosec@latest
+
+# govulncheck
+go install golang.org/x/vuln/cmd/govulncheck@latest
+```
+
+## Troubleshooting
+
+### Workflow Fails
+
+1. **Check job status** - Click on failed job for details
+2. **Review logs** - Expand failed steps to see error messages
+3. **Run locally** - Reproduce issue with local commands above
+4. **Check coverage** - Ensure test coverage meets 75% threshold
+
+### Coverage Below Threshold
+
+Add tests to increase coverage:
+```bash
+# See which lines aren't covered
+go test -coverprofile=coverage.out ./...
+go tool cover -html=coverage.out
+```
+
+### Race Condition Detected
+
+Run with race detector locally:
+```bash
+go test -race -v ./...
+```
+
+### Provider Test Failure
+
+Test specific provider:
+```bash
+go test -v -run='.*Azure.*' ./internal/providers/...
+```
+
+## Performance Optimization
+
+The workflow is optimized for speed:
+
+- **Parallel execution** - All independent jobs run simultaneously
+- **Go caching** - Dependencies cached between runs
+- **Strategic ordering** - Quick checks run first for fast feedback
+- **Fail-fast disabled** - Continue running all tests even if some fail
+
+## Workflow Monitoring
+
+### GitHub Actions Dashboard
+Monitor workflow runs at: `https://github.com/{owner}/{repo}/actions`
+
+### Status Badges
+Add to README.md:
+```markdown
+![PR Validation](https://github.com/{owner}/{repo}/actions/workflows/pr-validation.yml/badge.svg)
+```
+
+### Notifications
+Configure in repository settings:
+- Settings → Notifications
+- Choose email or Slack notifications for workflow failures
+
+## Maintenance
+
+### Update Go Version
+Edit in workflow file:
+```yaml
+go-version: '1.24'  # Update this
+```
+
+### Adjust Coverage Threshold
+Edit in workflow file:
+```yaml
+THRESHOLD=75  # Adjust this value
+```
+
+### Add New Provider
+Add to provider matrix:
+```yaml
+matrix:
+  provider:
+    - new_provider  # Add here
+```
+
+## Additional Resources
+
+- [GitHub Actions Documentation](https://docs.github.com/en/actions)
+- [golangci-lint Configuration](../.golangci.yml)
+- [Dependabot Configuration](../dependabot.yml)
+- [PR Template](../PULL_REQUEST_TEMPLATE.md)

.github/workflows/pr-validation.yml

@@ -0,0 +1,629 @@
+name: PR Validation
+
+on:
+  pull_request:
+    branches: [ main ]
+  push:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
+  security-events: write
+
+jobs:
+  # Fast feedback - format and basic checks
+  quick-checks:
+    name: Quick Checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Format check
+        run: |
+          # Exclude vendor directory from format checks
+          UNFORMATTED=$(gofmt -s -l . | grep -v "^vendor/" || true)
+          if [ -n "$UNFORMATTED" ]; then
+            echo "Code is not formatted. Run: gofmt -s -w ."
+            echo "Unformatted files:"
+            echo "$UNFORMATTED"
+            gofmt -s -d $(echo "$UNFORMATTED")
+            exit 1
+          fi
+
+      - name: Go vet
+        run: go vet ./...
+
+      - name: Go mod verify
+        run: go mod verify
+
+      - name: Go mod tidy check
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum
+
+  # Static analysis with golangci-lint (advisory - will not fail the build)
+  golangci-lint:
+    name: golangci-lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v8
+        with:
+          version: latest
+          args: --timeout=10m
+        continue-on-error: true  # Allow pipeline to continue even with linting warnings
+
+  # Staticcheck analysis
+  staticcheck:
+    name: Staticcheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Install staticcheck
+        run: go install honnef.co/go/tools/cmd/staticcheck@latest
+
+      - name: Run staticcheck
+        run: staticcheck ./...
+
+  # Security scanning with gosec
+  gosec:
+    name: Gosec Security Scanner
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run Gosec Security Scanner
+        run: |
+          go install github.com/securego/gosec/v2/cmd/gosec@latest
+          gosec -no-fail -fmt sarif -out results.sarif ./... || echo "Gosec completed with warnings"
+        continue-on-error: true
+
+      - name: Upload SARIF file
+        if: always() && hashFiles('results.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+        continue-on-error: true
+
+  # Vulnerability scanning
+  govulncheck:
+    name: Vulnerability Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: govulncheck ./...
+
+  # CodeQL analysis
+  codeql:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: go
+        continue-on-error: true
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+        continue-on-error: true
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        continue-on-error: true
+
+  # Unit tests with race detection
+  test-race:
+    name: Unit Tests (Race Detector)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run tests with race detector
+        run: go test -race -timeout=15m -count=1 -v ./...
+        env:
+          GOMAXPROCS: 4
+
+  # Coverage analysis with threshold check
+  test-coverage:
+    name: Test Coverage
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run tests with coverage
+        run: |
+          go test -coverprofile=coverage.out -covermode=atomic -timeout=15m ./...
+          go tool cover -func=coverage.out -o=coverage.txt
+
+      - name: Calculate coverage
+        id: coverage
+        run: |
+          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
+          echo "coverage=$COVERAGE" >> $GITHUB_OUTPUT
+          echo "Total Coverage: $COVERAGE%"
+
+          # Get per-package coverage
+          echo "## Coverage by Package" >> coverage_report.md
+          echo "" >> coverage_report.md
+          go tool cover -func=coverage.out | grep -v "total:" | awk '{print "- " $1 ": " $3}' >> coverage_report.md || true
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          file: ./coverage.out
+          flags: unittests
+          name: codecov-umbrella
+          fail_ci_if_error: false
+        continue-on-error: true
+
+      - name: Comment coverage on PR
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const fs = require('fs');
+            const coverage = '${{ steps.coverage.outputs.coverage }}';
+            let coverageReport = '';
+
+            try {
+              coverageReport = fs.readFileSync('coverage_report.md', 'utf8');
+            } catch (e) {
+              coverageReport = 'Coverage details not available';
+            }
+
+            const threshold = 70;
+            const coverageNum = parseFloat(coverage);
+            const emoji = coverageNum >= threshold ? '✅' : '⚠️';
+
+            const body = `## ${emoji} Test Coverage Report\n\n**Total Coverage:** ${coverage}%\n**Threshold:** ${threshold}%\n\n${coverageReport}`;
+
+            // Find existing comment
+            const { data: comments } = await github.rest.issues.listComments({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+            });
+
+            const botComment = comments.find(comment =>
+              comment.user.type === 'Bot' &&
+              comment.body.includes('Test Coverage Report')
+            );
+
+            if (botComment) {
+              await github.rest.issues.updateComment({
+                comment_id: botComment.id,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: body
+              });
+            } else {
+              await github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: body
+              });
+            }
+
+      - name: Check coverage threshold
+        run: |
+          COVERAGE=${{ steps.coverage.outputs.coverage }}
+          THRESHOLD=70
+          echo "Coverage: $COVERAGE%"
+          echo "Threshold: $THRESHOLD%"
+          if (( $(echo "$COVERAGE < $THRESHOLD" | bc -l) )); then
+            echo "⚠️  Coverage $COVERAGE% is below threshold $THRESHOLD%"
+            exit 1
+          fi
+          echo "✅ Coverage $COVERAGE% meets threshold $THRESHOLD%"
+
+  # Memory leak detection
+  test-memory-leaks:
+    name: Memory Leak Detection
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run goroutine leak tests
+        run: |
+          echo "Running goroutine leak detection tests..."
+          go test -v -timeout=20m -run='.*[Gg]oroutine.*[Ll]eak.*' ./... || echo "No goroutine leak tests found"
+
+      - name: Run memory leak tests
+        run: |
+          echo "Running memory leak detection tests..."
+          go test -v -timeout=20m -run='.*[Mm]emory.*[Ll]eak.*' ./... || echo "No memory leak tests found"
+
+      - name: Run cleanup tests
+        run: |
+          echo "Running cleanup and resource management tests..."
+          go test -v -timeout=20m -run='.*[Cc]leanup.*' ./... || echo "No cleanup tests found"
+
+  # Integration tests
+  test-integration:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run integration tests
+        run: |
+          if [ -d "./integration" ]; then
+            go test -v -timeout=20m ./integration/...
+          else
+            echo "Running integration tests from all packages..."
+            go test -v -timeout=20m -run='.*[Ii]ntegration.*' ./...
+          fi
+
+  # Regression tests
+  test-regression:
+    name: Regression Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run regression tests
+        run: |
+          echo "Running regression tests..."
+          go test -v -timeout=20m -run='.*[Rr]egression.*' ./...
+
+  # Provider-specific tests (parallel matrix)
+  test-providers:
+    name: Provider Tests (${{ matrix.provider }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        provider:
+          - google
+          - azure
+          - auth0
+          - okta
+          - keycloak
+          - cognito
+          - gitlab
+          - github
+          - generic
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run ${{ matrix.provider }} provider tests
+        run: |
+          PROVIDER_CAP=$(echo "${{ matrix.provider }}" | sed 's/.*/\u&/')
+          echo "Testing $PROVIDER_CAP provider..."
+          go test -v -timeout=10m -run=".*$PROVIDER_CAP.*" ./internal/providers/... || true
+          go test -v -timeout=10m -run=".*${{ matrix.provider }}.*" ./... || true
+
+  # Benchmark tests with performance tracking
+  benchmark:
+    name: Benchmark Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run benchmarks
+        run: |
+          echo "Running benchmark tests..."
+          go test -bench=. -benchmem -benchtime=1s -run=^$ ./... | tee benchmark.txt
+
+      - name: Upload benchmark results
+        uses: actions/upload-artifact@v4
+        with:
+          name: benchmark-results
+          path: benchmark.txt
+          retention-days: 30
+
+      - name: Compare benchmarks
+        if: github.event_name == 'pull_request'
+        continue-on-error: true
+        run: |
+          echo "Benchmark results available in artifacts"
+          echo "To compare with main branch, download previous benchmark results"
+
+  # Build validation across platforms
+  build:
+    name: Build (${{ matrix.os }}/${{ matrix.arch }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [linux, darwin]
+        arch: [amd64, arm64]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Build for ${{ matrix.os }}/${{ matrix.arch }}
+        env:
+          GOOS: ${{ matrix.os }}
+          GOARCH: ${{ matrix.arch }}
+        run: |
+          echo "Building for $GOOS/$GOARCH..."
+          go build -v -ldflags="-s -w" ./...
+
+  # Security-specific edge case tests
+  test-security-edge-cases:
+    name: Security Edge Cases
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run security edge case tests
+        run: |
+          echo "Running security edge case tests..."
+          go test -v -timeout=15m -run='.*[Ss]ecurity.*' ./...
+
+  # Session management tests
+  test-session:
+    name: Session Management Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run session tests
+        run: |
+          echo "Running session management tests..."
+          go test -v -timeout=15m -run='.*[Ss]ession.*' ./...
+
+  # Token validation tests
+  test-token:
+    name: Token Validation Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run token validation tests
+        run: |
+          echo "Running token validation tests..."
+          go test -v -timeout=15m -run='.*[Tt]oken.*' ./...
+
+  # CSRF and security tests
+  test-csrf:
+    name: CSRF and Security Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run CSRF tests
+        run: |
+          echo "Running CSRF and security tests..."
+          go test -v -timeout=15m -run='.*[Cc][Ss][Rr][Ff].*' ./...
+
+  # Multi-Go version compatibility
+  test-go-versions:
+    name: Go ${{ matrix.go-version }} Compatibility
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        go-version: ['1.24']
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go ${{ matrix.go-version }}
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ matrix.go-version }}
+          cache: true
+
+      - name: Run tests on Go ${{ matrix.go-version }}
+        run: go test -short -timeout=10m ./...
+
+  # Final validation - all checks must pass (golangci-lint is advisory)
+  all-checks-passed:
+    name: ✅ All Checks Passed
+    runs-on: ubuntu-latest
+    needs:
+      - quick-checks
+      - golangci-lint
+      - staticcheck
+      - gosec
+      - govulncheck
+      - codeql
+      - test-race
+      - test-coverage
+      - test-memory-leaks
+      - test-integration
+      - test-regression
+      - test-providers
+      - benchmark
+      - build
+      - test-security-edge-cases
+      - test-session
+      - test-token
+      - test-csrf
+      - test-go-versions
+    if: always()
+    steps:
+      - name: Check all jobs status
+        run: |
+          echo "Checking status of all jobs..."
+
+          # Check critical jobs (excluding golangci-lint which is advisory)
+          CRITICAL_FAILURES=false
+
+          if [ "${{ needs.quick-checks.result }}" == "failure" ] || \
+             [ "${{ needs.staticcheck.result }}" == "failure" ] || \
+             [ "${{ needs.test-race.result }}" == "failure" ] || \
+             [ "${{ needs.test-coverage.result }}" == "failure" ] || \
+             [ "${{ needs.build.result }}" == "failure" ]; then
+            CRITICAL_FAILURES=true
+          fi
+
+          if [ "$CRITICAL_FAILURES" == "true" ]; then
+            echo "❌ Critical checks failed"
+            exit 1
+          elif [ "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]; then
+            echo "⚠️  Some checks were cancelled"
+            exit 1
+          else
+            echo "✅ All critical checks passed successfully!"
+            if [ "${{ needs.golangci-lint.result }}" != "success" ]; then
+              echo "ℹ️  Note: golangci-lint reported issues (advisory only)"
+            fi
+          fi
+
+      - name: Post summary
+        if: always()
+        run: |
+          echo "# PR Validation Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "## Job Status" >> $GITHUB_STEP_SUMMARY
+          echo "- Quick Checks: ${{ needs.quick-checks.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Linting (advisory): ${{ needs.golangci-lint.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Static Analysis: ${{ needs.staticcheck.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Security Scan (gosec): ${{ needs.gosec.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Vulnerability Scan: ${{ needs.govulncheck.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- CodeQL: ${{ needs.codeql.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Race Detection: ${{ needs.test-race.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Coverage: ${{ needs.test-coverage.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Memory Leaks: ${{ needs.test-memory-leaks.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Integration Tests: ${{ needs.test-integration.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Regression Tests: ${{ needs.test-regression.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Provider Tests: ${{ needs.test-providers.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Benchmarks: ${{ needs.benchmark.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Build: ${{ needs.build.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Security Edge Cases: ${{ needs.test-security-edge-cases.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Session Tests: ${{ needs.test-session.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Token Tests: ${{ needs.test-token.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- CSRF Tests: ${{ needs.test-csrf.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Go Version Compatibility: ${{ needs.test-go-versions.result }}" >> $GITHUB_STEP_SUMMARY

.golangci.yml

@@ -0,0 +1,192 @@
+version: "2"
+run:
+  go: "1.24"
+  modules-download-mode: readonly
+  tests: true
+linters:
+  enable:
+    - bodyclose
+    - dupl
+    - goconst
+    - gocritic
+    - gocyclo
+    - goprintffuncname
+    - gosec
+    - misspell
+    - noctx
+    - nolintlint
+    - prealloc
+    - revive
+    - rowserrcheck
+    - sqlclosecheck
+    - unconvert
+    - unparam
+    - whitespace
+  disable:
+    - exhaustive
+    - funlen
+    - gocognit
+    - lll
+    - mnd
+    - testpackage
+    - wsl
+  settings:
+    dupl:
+      threshold: 200  # Allow intentional duplication in provider patterns and token management
+    errcheck:
+      check-type-assertions: true
+      check-blank: false  # Allow explicit blank assignments (_ = ...) to ignore errors
+      exclude-functions:
+        - (io.Closer).Close
+        - (*database/sql.Rows).Close
+        - (*database/sql.Stmt).Close
+        - (io.Writer).Write
+        - (*net/http.ResponseWriter).Write
+        - fmt.Fprintf
+        - fmt.Fprint
+        - fmt.Fprintln
+    goconst:
+      min-len: 3
+      min-occurrences: 10  # Increased to reduce noise for standard OAuth2/OIDC strings
+      ignore-tests: true
+    gocritic:
+      # Using default enabled checks in v2
+      enabled-checks:
+        - appendCombine
+        - boolExprSimplify
+        - builtinShadow
+        - commentedOutCode
+        - emptyFallthrough
+        - equalFold
+        - hexLiteral
+        - indexAlloc
+        - initClause
+        - methodExprCall
+        - nestingReduce
+        - rangeExprCopy
+        - rangeValCopy
+        - stringXbytes
+        - typeAssertChain
+        - typeUnparen
+        - unlabelStmt
+        - yodaStyleExpr
+    gocyclo:
+      min-complexity: 30  # OAuth/OIDC flows are inherently complex; set higher for Yaegi compatibility
+    gosec:
+      excludes:
+        - G104
+        - G404
+      severity: medium
+      confidence: medium
+    govet:
+      disable:
+        - fieldalignment
+        - shadow
+      enable-all: true
+    misspell:
+      locale: US
+      ignore-rules:
+        - traefik
+        - oidc
+        - keycloak
+    nolintlint:
+      require-explanation: true
+      require-specific: true
+      allow-unused: false
+    prealloc:
+      simple: true
+      range-loops: true
+      for-loops: false
+    revive:
+      rules:
+        - name: blank-imports
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: dot-imports
+        - name: error-return
+        - name: error-strings
+        - name: error-naming
+        - name: exported
+        - name: if-return
+        - name: increment-decrement
+        - name: var-naming
+        - name: var-declaration
+        - name: package-comments
+        - name: range
+        - name: receiver-naming
+        - name: time-naming
+        - name: unexported-return
+        - name: indent-error-flow
+        - name: errorf
+        - name: empty-block
+        - name: superfluous-else
+        - name: unused-parameter
+        - name: unreachable-code
+        - name: redefines-builtin-id
+    unparam:
+      check-exported: false
+    staticcheck:
+      checks:
+        - all
+        - -QF1001  # De Morgan's law - style preference, may affect Yaegi
+        - -QF1003  # Tagged switch - style preference, may affect Yaegi
+        - -QF1007  # Merge conditional assignment - style preference
+        - -QF1008  # Remove embedded field - may break Yaegi compatibility
+        - -QF1012  # Use fmt.Fprintf - style preference
+        - -ST1003  # Package name format - allowed for test packages
+  exclusions:
+    generated: lax
+    rules:
+      - linters:
+          - bodyclose
+          - dupl
+          - errcheck
+          - goconst
+          - gocyclo
+          - gosec
+          - noctx
+          - prealloc
+          - unparam
+        path: _test\.go
+      - linters:
+          - dupl
+          - gocyclo
+        path: test.*\.go
+      - linters:
+          - gocritic
+          - unused
+        path: mocks.*\.go
+      - linters:
+          - gosec
+        text: 'G404:'
+      - linters:
+          - all
+        path: vendor/
+      - linters:
+          - goconst
+        path: (.+)_test\.go
+      - linters:
+          - dupl
+        path: internal/providers/(auth0|keycloak|okta|google|azure|github|gitlab|cognito|generic)\.go
+      - linters:
+          - dupl
+        path: session\.go
+      - linters:
+          - dupl
+        path: session_chunk_manager\.go
+        text: "(extractJWTExpiration|extractJWTIssuedAt)"
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+  uniq-by-line: true
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

.traefik.yml

@@ -31,6 +31,7 @@ summary: |
   - Flexible configuration with multiple deployment scenarios
   - Memory-efficient operation with automatic cleanup
   - Extensive logging and debugging capabilities
+  - Redis cache support for multi-replica deployments with automatic failover
   It supports various authentication scenarios including:
 
   - Basic authentication with customizable callback and logout URLs
@@ -73,7 +74,15 @@ testData:
     - admin
     - developer
 
-  forceHTTPS: false # Forces the use of HTTPS for all URLs (default: true for security)
+  # Custom claim names for Auth0 and other providers with namespaced claims
+  roleClaimName: roles # JWT claim name for extracting user roles (default: "roles")
+  groupClaimName: groups # JWT claim name for extracting user groups (default: "groups")
+
+  # ⚠️ CRITICAL for TLS termination scenarios (AWS ALB, Cloud Load Balancers, etc.)
+  # When NOT specified in config: defaults to FALSE (Go zero value)
+  # When running behind load balancer that terminates TLS: MUST set to TRUE
+  # See: https://github.com/lukaszraczylo/traefikoidc/issues/82
+  forceHTTPS: true # Forces HTTPS scheme for redirect URIs (default when not specified: false)
   logLevel: debug # Sets logging verbosity: debug, info, error (default: info)
   rateLimit: 100 # Maximum number of requests per second (default: 100, minimum: 10)
 
@@ -84,25 +93,34 @@ testData:
     - /metrics
     
   headers: # Custom headers to set with templated values from claims and tokens
-    # NOTE: If you encounter "can't evaluate field AccessToken in type bool" errors,
-    # you may need to escape the templates. See the headers section in configuration below.
+    # NOTE: Use double curly braces to escape template expressions in YAML
+    # See the headers section in configuration below for details
     - name: "X-User-Email"
-      value: "{{.Claims.email}}"
+      value: "{{{{.Claims.email}}}}"
     - name: "X-User-ID"
-      value: "{{.Claims.sub}}"
+      value: "{{{{.Claims.sub}}}}"
     - name: "Authorization"
-      value: "Bearer {{.AccessToken}}"
+      value: "Bearer {{{{.AccessToken}}}}"
     - name: "X-User-Roles"
-      value: "{{range $i, $e := .Claims.roles}}{{if $i}},{{end}}{{$e}}{{end}}"
+      value: "{{{{range $i, $e := .Claims.roles}}}}{{{{if $i}}}},{{{{end}}}}{{{{$e}}}}{{{{end}}}}"
 
   # Advanced parameters (usually discovered automatically from provider metadata)
   revocationURL: https://accounts.google.com/revoke # Endpoint for revoking tokens
   oidcEndSessionURL: https://accounts.google.com/logout # Provider's end session endpoint
   enablePKCE: false # Enables PKCE (Proof Key for Code Exchange) for additional security
   cookieDomain: "" # Explicit domain for session cookies (e.g., ".example.com" for multi-subdomain setups)
+  cookiePrefix: "" # Custom prefix for cookie names (e.g., "_oidc_myapp_" for session isolation between middleware instances)
+  sessionMaxAge: 86400 # Maximum session age in seconds (default: 86400 = 24 hours, 0 = use default)
   overrideScopes: false # When true, replaces default scopes instead of appending (default: false)
   refreshGracePeriodSeconds: 60 # Seconds before token expiry to attempt proactive refresh (default: 60)
-  
+
+  # Auth0 / Custom API Audience Configuration
+  audience: "" # Custom audience for access token validation (default: clientID)
+  strictAudienceValidation: false # Reject sessions with audience mismatch (prevents token confusion attacks)
+  allowOpaqueTokens: false # Enable opaque (non-JWT) access token support via RFC 7662 introspection
+  requireTokenIntrospection: false # Force introspection for opaque tokens (requires introspection endpoint)
+  disableReplayDetection: false # Disable JTI replay detection for multi-replica deployments (default: false)
+
   # Security Headers Configuration (enabled by default with 'default' profile)
   securityHeaders:
     enabled: true
@@ -115,11 +133,53 @@ testData:
       - "https://*.example.com"
     corsAllowCredentials: true
     
+    # Cross-origin policies
+    permissionsPolicy: "geolocation=(), camera=(), microphone=()"
+    crossOriginEmbedderPolicy: "require-corp"
+    crossOriginOpenerPolicy: "same-origin"
+    crossOriginResourcePolicy: "same-origin"
+
     # Custom headers
     customHeaders:
       X-Custom-Header: "production"
       X-API-Version: "v1"
 
+# Example with Redis cache for multi-replica deployments
+testDataWithRedis:
+  # Required OIDC parameters (same as standard configuration)
+  providerURL: https://auth.example.com
+  clientID: your-client-id
+  clientSecret: your-client-secret
+  callbackURL: /oauth2/callback
+  sessionEncryptionKey: your-64-character-encryption-key-at-least-32-bytes
+
+  # Standard optional parameters
+  logLevel: info
+  allowedUserDomains:
+    - company.com
+
+  # Redis cache configuration for multi-replica support
+  redis:
+    enabled: true                    # Enable Redis caching
+    address: "redis:6379"           # Redis server address
+    password: "redis-password"       # Redis authentication password
+    db: 0                           # Redis database number (0-15)
+    keyPrefix: "traefikoidc:"       # Prefix for all Redis keys
+    cacheMode: "hybrid"             # Cache mode: redis, hybrid, or memory
+    poolSize: 20                    # Maximum number of connections
+    connectTimeout: 5               # Connection timeout in seconds
+    readTimeout: 3                  # Read operation timeout
+    writeTimeout: 3                 # Write operation timeout
+    enableTLS: false                # Use TLS for Redis connection
+    tlsSkipVerify: false           # Skip TLS certificate verification
+    hybridL1Size: 500              # L1 cache size for hybrid mode
+    hybridL1MemoryMB: 10           # L1 memory limit for hybrid mode
+    enableCircuitBreaker: true     # Enable circuit breaker
+    circuitBreakerThreshold: 5     # Failures before opening circuit
+    circuitBreakerTimeout: 60      # Timeout before retry (seconds)
+    enableHealthCheck: true         # Enable periodic health checks
+    healthCheckInterval: 30         # Health check interval (seconds)
+
 # --- Common Configuration Examples ---
 #
 # 🔒 HIGH-SECURITY CONFIGURATION
@@ -169,11 +229,11 @@ testData:
 #     corsAllowedOrigins: ["https://app.example.com"]
 #     corsAllowedMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
 #     corsAllowedHeaders: ["Authorization", "Content-Type", "X-API-Key"]
-#   headers:  # Custom headers with OIDC claims
+#   headers:  # Custom headers with OIDC claims (use double curly braces)
 #     - name: "X-User-Email"
-#       value: "{{.Claims.email}}"
+#       value: "{{{{.Claims.email}}}}"
 #     - name: "X-User-ID"
-#       value: "{{.Claims.sub}}"
+#       value: "{{{{.Claims.sub}}}}"
 
 # --- Provider Specific Configuration Examples ---
 #
@@ -312,6 +372,20 @@ testData:
 #   clientSecret: your-auth0-client-secret # Store securely
 #   callbackURL: /oauth2/callback
 #   sessionEncryptionKey: "a-very-secure-key-at-least-32-bytes-long-for-auth0"
+#
+#   # Auth0 Audience Configuration (for custom APIs)
+#   # Scenario 1 (Recommended): Custom API with JWT access tokens
+#   audience: "https://my-api.example.com" # Your API identifier from Auth0 dashboard
+#   strictAudienceValidation: true # Enforce proper audience validation for security
+#
+#   # Scenario 2 (Backward Compatible): Default audience (uses client_id)
+#   # audience: "" # Leave empty or omit to use client_id as audience
+#   # strictAudienceValidation: false # Allows fallback to ID token validation (logs warnings)
+#
+#   # Scenario 3: Opaque (non-JWT) access tokens
+#   # allowOpaqueTokens: true # Enable opaque token support
+#   # requireTokenIntrospection: true # Require RFC 7662 token introspection
+#
 #   scopes: # Defaults ["openid", "profile", "email"]. Add custom scopes if your Auth0 Rules/Actions require them.
 #     - read:custom_data # Example custom scope
 #   allowedRolesAndGroups: # Based on claims added via Auth0 Rules or Actions (e.g. namespaced claims)
@@ -319,7 +393,7 @@ testData:
 #     - editor
 #   # Use Auth0 Rules or Actions to add custom claims (roles, permissions) to the ID Token.
 #   # Ensure postLogoutRedirectURI is in Auth0 app's "Allowed Logout URLs".
-#   # See README.md "Provider Configuration Recommendations" for Auth0.
+#   # For detailed Auth0 audience configuration, see AUTH0_AUDIENCE_GUIDE.md
 
 # --- Generic OIDC Provider Example ---
 # testDataGenericOIDC:
@@ -448,9 +522,24 @@ configuration:
   forceHTTPS:
     type: boolean
     description: |
-      Forces the use of HTTPS for all URLs.
-      This is recommended for security in production environments.
-      Default: true
+      Forces HTTPS scheme for redirect URIs regardless of request headers or TLS state.
+
+      ⚠️ CRITICAL CONFIGURATION for TLS Termination Scenarios:
+
+      When running Traefik behind a load balancer that terminates TLS (AWS ALB,
+      Google Cloud Load Balancer, Azure Application Gateway, etc.), you MUST set
+      this to true. Without it, redirect URIs will use http:// instead of https://,
+      causing OAuth callback failures.
+
+      How it works:
+      - When true: Always uses https:// for redirect URIs (highest priority)
+      - When false: Detects scheme from X-Forwarded-Proto header or TLS state
+      - When NOT specified: Defaults to false (Go zero value for bool)
+
+      Default: false (when not specified in configuration)
+      Recommended: true (for production environments and TLS termination scenarios)
+
+      See: https://github.com/lukaszraczylo/traefikoidc/issues/82
     required: false
 
   rateLimit:
@@ -549,28 +638,101 @@ configuration:
   cookieDomain:
     type: string
     description: |
-      Explicit domain for session cookies. This is important for multi-subdomain setups 
+      Explicit domain for session cookies. This is important for multi-subdomain setups
       and reverse proxy deployments to ensure consistent cookie handling.
-      
+
       When set, all session cookies will use this domain. When not set, the domain
       is auto-detected from the request headers (X-Forwarded-Host or Host).
-      
+
       Use a leading dot for subdomain-wide cookies (e.g., ".example.com" allows
       cookies to be shared between app.example.com, api.example.com, etc.).
-      
+
       Use a specific domain for host-only cookies (e.g., "app.example.com" restricts
       cookies to that exact domain).
-      
+
       This setting is crucial to prevent authentication issues like "CSRF token missing
       in session" errors that can occur when cookies are created with inconsistent domains.
-      
+
       Examples:
       - ".example.com" - Allows all subdomains to share cookies
       - "app.example.com" - Restricts cookies to this specific host
-      
+
       Default: "" (auto-detected from request headers)
     required: false
 
+  cookiePrefix:
+    type: string
+    description: |
+      Custom prefix for session cookie names. This is essential for running multiple
+      middleware instances with different authorization requirements on the same domain.
+
+      By default, all middleware instances use the same cookie names (_oidc_raczylo_m,
+      _oidc_raczylo_a, etc.), which means they share session state. When you have
+      multiple instances with different access restrictions (e.g., one for general users
+      and one for admins), this session sharing can lead to authorization bypass issues.
+
+      Setting a unique cookiePrefix for each middleware instance ensures complete
+      session isolation, preventing users authenticated via one middleware from
+      automatically gaining access to routes protected by a different middleware.
+
+      The prefix is prepended to all session cookie names:
+      - Main session cookie: {prefix}m
+      - Access token cookie: {prefix}a
+      - Refresh token cookie: {prefix}r
+      - ID token cookie: {prefix}id
+
+      Examples:
+      - "_oidc_userauth_" - For general user authentication middleware
+      - "_oidc_adminauth_" - For admin-only authentication middleware
+      - "_oidc_api_" - For API-specific authentication middleware
+
+      Security Note: Use different cookie prefixes AND different sessionEncryptionKey
+      values for each middleware instance to ensure complete isolation.
+
+      Default: "_oidc_raczylo_" (standard prefix for backward compatibility)
+
+      See: https://github.com/lukaszraczylo/traefikoidc/issues/87
+    required: false
+
+  sessionMaxAge:
+    type: integer
+    description: |
+      Maximum session age in seconds before requiring re-authentication.
+
+      This setting controls how long a user's authentication session remains valid
+      before they must authenticate again through the OIDC provider. The session
+      age is tracked from the initial authentication time (created_at).
+
+      When a session exceeds this age:
+      - The session is cleared and invalidated
+      - The user is redirected to re-authenticate
+      - All session cookies are removed
+
+      Use Cases:
+      - High-security applications: Use shorter durations (e.g., 3600 = 1 hour)
+      - Standard applications: Default 24 hours balances security and UX
+      - Long-lived sessions: Extend for applications accessed infrequently
+        (e.g., 604800 = 7 days, 2592000 = 30 days)
+
+      Security Considerations:
+      - Shorter sessions provide better security but require more frequent logins
+      - Longer sessions improve user experience but increase security risk
+      - Consider your application's security requirements and user access patterns
+      - This is independent of token refresh - tokens can be refreshed during the session
+
+      Common Values:
+      - 3600 (1 hour) - High security applications
+      - 28800 (8 hours) - Working day session
+      - 86400 (24 hours) - Default, balances security and convenience
+      - 604800 (7 days) - Weekly session for less frequently accessed apps
+      - 2592000 (30 days) - Monthly session for infrequently used applications
+
+      Default: 86400 (24 hours)
+      Minimum: 0 (uses default of 24 hours)
+
+      See: https://github.com/lukaszraczylo/traefikoidc/issues/91
+    required: false
+
   overrideScopes:
     type: boolean
     description: |
@@ -588,16 +750,159 @@ configuration:
     type: integer
     description: |
       The number of seconds before a token expires to attempt proactive refresh.
-      
+
       When a request is made and the access token will expire within this grace period,
       the middleware will attempt to refresh the token proactively. This helps prevent
       authentication interruptions for active users.
-      
+
       Setting this to 0 disables proactive refresh (tokens are only refreshed after expiry).
-      
+
       Default: 60 (1 minute before expiry)
     required: false
 
+  audience:
+    type: string
+    description: |
+      Custom audience value for access token validation.
+
+      This configures the expected audience claim in access tokens. Per OAuth 2.0 and OIDC
+      specifications:
+      - ID tokens always have aud=client_id (per OIDC Core 1.0)
+      - Access tokens can have custom audiences (e.g., API identifiers)
+
+      Auth0 Scenarios:
+      1. Custom API audience (recommended): Set to your API identifier from Auth0
+         Example: "https://my-api.example.com"
+         Result: Access tokens will contain this audience
+
+      2. Default audience: Leave empty or omit (uses client_id)
+         Result: Access tokens may not contain client_id, triggering warnings
+
+      3. Opaque tokens: Use with allowOpaqueTokens=true for non-JWT tokens
+
+      When configured and different from client_id, the middleware automatically adds
+      the audience parameter to the authorize endpoint request.
+
+      Default: "" (uses client_id as audience)
+      See: AUTH0_AUDIENCE_GUIDE.md for detailed configuration
+    required: false
+
+  strictAudienceValidation:
+    type: boolean
+    description: |
+      Enforce strict audience validation for access tokens.
+
+      When enabled, sessions are rejected if access token validation fails due to
+      audience mismatch. This prevents falling back to ID token validation, addressing
+      potential token confusion attacks where tokens intended for different APIs could
+      be used to grant access.
+
+      Auth0 Scenario 2 Protection:
+      - When true: Rejects sessions with mismatched access token audience
+      - When false: Logs security warnings but allows fallback to ID token (backward compatible)
+
+      Security Recommendation:
+      - Production environments: Set to true for maximum security
+      - Development/testing: Can use false with monitoring of security warnings
+
+      This setting addresses security concerns where access tokens without proper
+      audience claims could bypass API-specific authorization checks.
+
+      Default: false (backward compatible)
+      See: https://github.com/lukaszraczylo/traefikoidc/issues/74
+    required: false
+
+  allowOpaqueTokens:
+    type: boolean
+    description: |
+      Enable acceptance of opaque (non-JWT) access tokens.
+
+      When enabled, the middleware accepts access tokens that are not in JWT format
+      (3-part base64 structure). Opaque tokens are validated using OAuth 2.0 Token
+      Introspection (RFC 7662) if the provider exposes an introspection endpoint.
+
+      Auth0 Scenario 3:
+      Some Auth0 configurations issue opaque access tokens when no default API is
+      configured. This setting allows those tokens to be validated.
+
+      Requirements:
+      - Provider must support introspection_endpoint in OIDC discovery
+      - Client must have appropriate introspection permissions
+
+      Validation Process:
+      1. Detects opaque token (not 3-part JWT structure)
+      2. Calls provider's introspection endpoint with client credentials
+      3. Validates response (active status, expiration, audience if present)
+      4. Caches result for 5 minutes or token expiry (whichever is shorter)
+      5. Falls back to ID token validation if introspection unavailable
+         (unless requireTokenIntrospection=true)
+
+      Default: false (only JWT access tokens accepted)
+      See: AUTH0_AUDIENCE_GUIDE.md for configuration examples
+    required: false
+
+  requireTokenIntrospection:
+    type: boolean
+    description: |
+      Require token introspection for all opaque access tokens.
+
+      When enabled with allowOpaqueTokens=true, opaque tokens are rejected if:
+      - Introspection endpoint is not available from provider metadata
+      - Introspection request fails
+      - Introspection response indicates token is not active
+
+      Security Levels:
+      - requireTokenIntrospection=true + allowOpaqueTokens=true:
+        Maximum security - rejects opaque tokens without successful introspection
+
+      - requireTokenIntrospection=false + allowOpaqueTokens=true:
+        Backward compatible - falls back to ID token validation if introspection fails
+
+      - requireTokenIntrospection=true + allowOpaqueTokens=false:
+        No effect - opaque tokens are already rejected
+
+      Recommended Configuration:
+      When accepting opaque tokens, always set this to true for maximum security:
+      ```yaml
+      allowOpaqueTokens: true
+      requireTokenIntrospection: true
+      ```
+
+      Default: false (allows fallback to ID token)
+      See: RFC 7662 OAuth 2.0 Token Introspection specification
+    required: false
+
+  disableReplayDetection:
+    type: boolean
+    description: |
+      Disable JTI-based replay attack detection for multi-replica deployments.
+
+      When running multiple Traefik replicas, each instance maintains its own in-memory
+      JTI (JWT Token ID) cache. This causes false positives when the same valid token
+      hits different replicas:
+      - Request → Replica A → JTI added to cache → OK
+      - Request → Replica B → JTI not in Replica B's cache → OK
+      - Request → Replica A again → JTI found → FALSE POSITIVE "replay detected"
+
+      Security Impact:
+      When disabled, the following validations remain active:
+      - RSA/ECDSA signature verification
+      - Token expiration (exp claim)
+      - Issuer validation (iss claim)
+      - Audience validation (aud claim)
+      - Not-before validation (nbf claim)
+      - Issued-at validation (iat claim)
+
+      Only the JTI replay check is skipped.
+
+      Recommendations:
+      - Single-instance deployment: false (default, enables replay protection)
+      - Multi-replica deployment: true (prevents false positives)
+      - Production with shared cache: false (use Redis/Memcached for shared JTI cache)
+
+      Default: false (replay detection enabled)
+    required: false
+
   headers:
     type: array
     description: |
@@ -614,29 +919,23 @@ configuration:
       IMPORTANT: Template Escaping
       If you encounter the error "can't evaluate field AccessToken in type bool" when
       starting Traefik, this means Traefik is trying to evaluate the template expressions
-      before passing them to the plugin. To fix this, you need to escape the templates
-      using one of these methods:
+      before passing them to the plugin.
 
-      1. Use YAML literal style (recommended):
-         headers:
-           - name: "Authorization"
-             value: |
-               Bearer {{.AccessToken}}
+      SOLUTION: You must escape the template expressions using double curly braces:
 
-      2. Use single quotes:
-         headers:
-           - name: "Authorization"
-             value: 'Bearer {{.AccessToken}}'
+      headers:
+        - name: "Authorization"
+          value: "Bearer {{{{.AccessToken}}}}"
 
-      3. For inline double quotes, escape the braces:
-         headers:
-           - name: "Authorization"
-             value: "Bearer {{"{{.AccessToken}}"}}"
+      This is the only reliable method that works consistently. Here's why:
+      - The YAML parser converts {{{{  →  {{ and }}}}  →  }}
+      - Result: Bearer {{.AccessToken}} reaches the Go template engine correctly
+      - Other methods (YAML literal style, single quotes) do NOT work reliably
 
       Examples:
-      - name: "X-User-Email", value: "{{.Claims.email}}"
-      - name: "Authorization", value: "Bearer {{.AccessToken}}"
-      - name: "X-User-Roles", value: "{{range $i, $e := .Claims.roles}}{{if $i}},{{end}}{{$e}}{{end}}"
+      - name: "X-User-Email", value: "{{{{.Claims.email}}}}"
+      - name: "Authorization", value: "Bearer {{{{.AccessToken}}}}"
+      - name: "X-User-Roles", value: "{{{{range $i, $e := .Claims.roles}}}}{{{{if $i}}}},{{{{end}}}}{{{{$e}}}}{{{{end}}}}"
     required: false
     items:
       type: object
@@ -899,3 +1198,317 @@ configuration:
           Remove the X-Powered-By header to hide technology stack information.
           Default: true
         required: false
+
+      permissionsPolicy:
+        type: string
+        description: |
+          Permissions-Policy header to control browser feature permissions.
+          This header allows you to control which features and APIs can be used.
+
+          Examples:
+          - "geolocation=(), camera=(), microphone=()" (deny all)
+          - "geolocation=(self), camera=()" (allow geolocation for same origin only)
+
+          Common directives: accelerometer, camera, geolocation, gyroscope,
+          magnetometer, microphone, payment, usb
+        required: false
+
+      crossOriginEmbedderPolicy:
+        type: string
+        description: |
+          Cross-Origin-Embedder-Policy (COEP) header to prevent untrusted
+          resources from being loaded.
+
+          Options:
+          - "require-corp": Resources must explicitly grant permission
+          - "credentialless": Load without credentials for cross-origin resources
+          - "unsafe-none": No restrictions (default)
+
+          Required for certain browser features like SharedArrayBuffer.
+        required: false
+
+      crossOriginOpenerPolicy:
+        type: string
+        description: |
+          Cross-Origin-Opener-Policy (COOP) header to isolate browsing context
+          from cross-origin windows.
+
+          Options:
+          - "same-origin": Isolate from cross-origin documents
+          - "same-origin-allow-popups": Allow popups that don't set COOP
+          - "unsafe-none": No isolation (default)
+
+          Helps prevent cross-origin attacks and Spectre-like vulnerabilities.
+        required: false
+
+      crossOriginResourcePolicy:
+        type: string
+        description: |
+          Cross-Origin-Resource-Policy (CORP) header to control which origins
+          can load this resource.
+
+          Options:
+          - "same-origin": Only same-origin requests can load the resource
+          - "same-site": Only same-site requests can load the resource
+          - "cross-origin": Any origin can load the resource (default)
+
+          Prevents your resources from being embedded on other sites.
+        required: false
+
+  redis:
+    type: object
+    description: |
+      Optional Redis cache configuration for multi-replica deployments.
+
+      When running multiple Traefik instances, Redis provides shared caching to:
+      - Prevent JTI replay detection false positives across replicas
+      - Share token verification results between instances
+      - Maintain consistent session state across the cluster
+      - Improve performance by reducing redundant OIDC provider calls
+
+      Features:
+      - Automatic failover to memory-only mode when Redis is unavailable
+      - Circuit breaker pattern for resilience against Redis failures
+      - Health checking with automatic recovery
+      - Multiple cache modes: redis-only, hybrid (L1 memory + L2 Redis), memory-only
+      - Configurable timeouts and connection pooling
+      - TLS support for secure Redis connections
+
+      The middleware gracefully handles Redis failures by falling back to in-memory
+      caching, ensuring your authentication flow continues even during Redis outages.
+
+      Example configuration:
+      ```yaml
+      redis:
+        enabled: true
+        address: "redis:6379"
+        cacheMode: "hybrid"
+        enableCircuitBreaker: true
+      ```
+    required: false
+    properties:
+      enabled:
+        type: boolean
+        description: |
+          Enable Redis caching for distributed session and token management.
+          When enabled, the middleware will attempt to connect to Redis and use it
+          for shared state across multiple Traefik instances.
+
+          Default: false
+        required: false
+
+      address:
+        type: string
+        description: |
+          Redis server address in host:port format.
+
+          Examples:
+          - "redis:6379" (Docker/Kubernetes service)
+          - "localhost:6379" (local Redis)
+          - "redis.example.com:6380" (custom host/port)
+          - "redis-cluster.default.svc.cluster.local:6379" (Kubernetes)
+
+          Required when Redis is enabled.
+        required: false
+
+      password:
+        type: string
+        description: |
+          Password for Redis authentication.
+          Leave empty if Redis doesn't require authentication.
+
+          For Kubernetes deployments, you can use secret references:
+          urn:k8s:secret:namespace:secret-name:key
+
+          Default: "" (no authentication)
+        required: false
+
+      db:
+        type: integer
+        description: |
+          Redis database number to use (0-15).
+          Different databases can be used to isolate data between environments.
+
+          Default: 0
+        required: false
+
+      keyPrefix:
+        type: string
+        description: |
+          Prefix for all Redis keys created by this middleware.
+          Useful for:
+          - Avoiding key collisions with other applications
+          - Identifying keys for monitoring/debugging
+          - Supporting multiple environments in the same Redis instance
+
+          Default: "traefikoidc:"
+        required: false
+
+      cacheMode:
+        type: string
+        description: |
+          Determines the caching strategy:
+
+          - "redis": Redis-only caching. All cache operations go directly to Redis.
+            Best for: Consistent state across all replicas, minimal memory usage.
+
+          - "hybrid": Two-tier caching with in-memory L1 and Redis L2.
+            Best for: High performance with shared state, reduced Redis load.
+            L1 provides fast local cache, L2 provides shared state.
+
+          - "memory": Memory-only caching (Redis disabled even if configured).
+            Best for: Single instance deployments, development/testing.
+
+          Default: "redis" (when Redis is enabled)
+        required: false
+        enum:
+          - redis
+          - hybrid
+          - memory
+
+      poolSize:
+        type: integer
+        description: |
+          Maximum number of socket connections to Redis.
+          Higher values allow more concurrent operations but consume more resources.
+
+          Recommendations:
+          - Small deployments: 10-20
+          - Medium deployments: 20-50
+          - Large deployments: 50-100
+
+          Default: 10
+        required: false
+
+      connectTimeout:
+        type: integer
+        description: |
+          Timeout in seconds for establishing new connections to Redis.
+          Should be higher than network latency but low enough to fail fast.
+
+          Default: 5 seconds
+        required: false
+
+      readTimeout:
+        type: integer
+        description: |
+          Timeout in seconds for Redis read operations.
+          Includes the time to send the command, wait for Redis to process it,
+          and receive the response.
+
+          Default: 3 seconds
+        required: false
+
+      writeTimeout:
+        type: integer
+        description: |
+          Timeout in seconds for Redis write operations.
+          Should account for network latency and Redis persistence settings.
+
+          Default: 3 seconds
+        required: false
+
+      enableTLS:
+        type: boolean
+        description: |
+          Enable TLS encryption for Redis connections.
+          Required when connecting to Redis instances that enforce TLS,
+          such as AWS ElastiCache with encryption in transit.
+
+          Default: false
+        required: false
+
+      tlsSkipVerify:
+        type: boolean
+        description: |
+          Skip TLS certificate verification for Redis connections.
+
+          ⚠️ WARNING: Only use in development environments.
+          This option bypasses certificate validation and should never be used
+          in production as it's vulnerable to man-in-the-middle attacks.
+
+          Default: false
+        required: false
+
+      hybridL1Size:
+        type: integer
+        description: |
+          Maximum number of items in the L1 (in-memory) cache for hybrid mode.
+          Controls how many cache entries are kept in local memory before eviction.
+
+          Only applies when cacheMode is "hybrid".
+
+          Default: 500
+        required: false
+
+      hybridL1MemoryMB:
+        type: integer
+        description: |
+          Maximum memory in megabytes for L1 cache in hybrid mode.
+          The cache will start evicting items when this limit is approached.
+
+          Only applies when cacheMode is "hybrid".
+
+          Default: 10 MB
+        required: false
+
+      enableCircuitBreaker:
+        type: boolean
+        description: |
+          Enable circuit breaker pattern for Redis connection failures.
+
+          When enabled, the middleware will:
+          1. Track Redis operation failures
+          2. Open the circuit after threshold failures (stop trying Redis)
+          3. Fall back to in-memory caching
+          4. Periodically attempt to reconnect (half-open state)
+          5. Resume Redis operations when connection recovers
+
+          This prevents cascading failures and improves resilience.
+
+          Default: true
+        required: false
+
+      circuitBreakerThreshold:
+        type: integer
+        description: |
+          Number of consecutive Redis failures before opening the circuit.
+          Lower values make the system more sensitive to Redis issues,
+          higher values tolerate more failures before switching to fallback.
+
+          Default: 5
+        required: false
+
+      circuitBreakerTimeout:
+        type: integer
+        description: |
+          Time in seconds to wait before attempting to close the circuit.
+          After this timeout, the circuit breaker will allow one test request
+          to Redis. If successful, normal operations resume.
+
+          Default: 60 seconds
+        required: false
+
+      enableHealthCheck:
+        type: boolean
+        description: |
+          Enable periodic health checks for Redis connection.
+
+          Health checks:
+          - Run in the background at regular intervals
+          - Detect Redis availability without affecting request processing
+          - Automatically reconnect when Redis becomes available
+          - Update circuit breaker state based on health status
+
+          Default: true
+        required: false
+
+      healthCheckInterval:
+        type: integer
+        description: |
+          Interval in seconds between Redis health checks.
+          Lower values detect issues faster but increase Redis load.
+          Higher values reduce overhead but delay failure detection.
+
+          Default: 30 seconds
+        required: false

CI_SETUP.md

@@ -0,0 +1,286 @@
+# CI/CD Setup Guide
+
+## 📋 Overview
+
+This repository now has a comprehensive CI/CD pipeline that runs **20+ parallel checks** on every pull request to ensure code quality, security, and reliability.
+
+## 🎯 What Was Added
+
+### GitHub Actions Workflow
+- **`.github/workflows/pr-validation.yml`** - Main CI/CD pipeline (single file, all parallel)
+
+### Configuration Files
+- **`.golangci.yml`** - Linter configuration with 30+ enabled checks
+- **`.github/dependabot.yml`** - Automated dependency updates
+- **`.github/CODEOWNERS`** - Automatic PR reviewer assignment
+- **`.github/PULL_REQUEST_TEMPLATE.md`** - Standardized PR descriptions
+- **`.github/workflows/README.md`** - Detailed workflow documentation
+- **`.github/workflows/.gitattributes`** - Consistent line endings
+
+## ✅ What Gets Tested (All in Parallel)
+
+### Code Quality (3 checks)
+- **Format & Basic Checks** - gofmt, go vet, go mod
+- **golangci-lint** - 30+ linters including style, complexity, bugs
+- **Staticcheck** - Advanced static analysis
+
+### Security (3 checks)
+- **Gosec** - Security vulnerability scanning with SARIF reports
+- **Govulncheck** - Go vulnerability database scanning
+- **CodeQL** - GitHub's semantic code analysis
+
+### Testing (9 test suites)
+- **Race Detector** - Concurrent access bugs
+- **Coverage** - 75% threshold with PR comments
+- **Memory Leaks** - Goroutine and memory leak detection
+- **Integration Tests** - Full integration suite
+- **Regression Tests** - Prevent old bugs from returning
+- **Security Edge Cases** - Security-specific scenarios
+- **Session Tests** - Session management
+- **Token Tests** - Token validation
+- **CSRF Tests** - CSRF protection
+
+### Provider Testing (9 providers in parallel)
+- Google, Azure AD, Auth0, Okta, Keycloak, AWS Cognito, GitLab, GitHub, Generic
+
+### Performance & Build (3 checks)
+- **Benchmarks** - Performance regression detection
+- **Multi-platform Build** - 4 combinations (linux/darwin × amd64/arm64)
+- **Go Version Compatibility** - Go 1.23 & 1.24
+
+## 🚀 Quick Start
+
+### 1. Push to GitHub
+```bash
+git add .github .golangci.yml CI_SETUP.md
+git commit -m "Add comprehensive CI/CD pipeline"
+git push origin main
+```
+
+### 2. Create a Test PR
+```bash
+# Create a feature branch
+git checkout -b feature/test-ci
+echo "# Test" >> test.md
+git add test.md
+git commit -m "Test CI pipeline"
+git push origin feature/test-ci
+
+# Create PR on GitHub
+# Watch all 20+ checks run in parallel! ⚡
+```
+
+### 3. Monitor Results
+- Go to Actions tab: `https://github.com/{owner}/{repo}/actions`
+- Click on latest workflow run
+- See all parallel checks in action
+- Review coverage comment on PR
+
+## 📊 Key Features
+
+### ⚡ Maximum Speed
+- **Parallel execution** - All checks run simultaneously
+- **Smart caching** - Go modules and build cache
+- **Optimized order** - Quick checks first for fast feedback
+- **Expected runtime**: 5-10 minutes for full suite
+
+### 🔒 Security First
+- **3 security scanners** - gosec, govulncheck, CodeQL
+- **SARIF integration** - Results in GitHub Security tab
+- **Dependency scanning** - Automated with Dependabot
+- **Security edge case tests**
+
+### 📈 Coverage Tracking
+- **Automatic PR comments** with coverage stats
+- **Per-package breakdown** included
+- **75% threshold** enforced (configurable)
+- **Codecov integration** ready (optional)
+
+### 🎨 Developer Experience
+- **Clear PR template** guides contributors
+- **Auto code owners** assignment
+- **Detailed error messages** for failures
+- **Benchmark tracking** for performance
+
+## 🛠️ Local Development
+
+### Install Required Tools
+```bash
+# golangci-lint (comprehensive linting)
+go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+
+# staticcheck (static analysis)
+go install honnef.co/go/tools/cmd/staticcheck@latest
+
+# gosec (security scanning)
+go install github.com/securego/gosec/v2/cmd/gosec@latest
+
+# govulncheck (vulnerability scanning)
+go install golang.org/x/vuln/cmd/govulncheck@latest
+```
+
+### Run Checks Locally
+```bash
+# Quick validation (before committing)
+gofmt -s -w .                    # Format code
+go vet ./...                     # Basic checks
+go mod tidy                      # Clean dependencies
+
+# Linting
+golangci-lint run                # Full lint suite
+staticcheck ./...                # Static analysis
+
+# Testing
+go test -race -timeout=15m ./... # Tests with race detector
+go test -coverprofile=coverage.out ./...  # Coverage
+go tool cover -func=coverage.out # View coverage
+
+# Security
+gosec ./...                      # Security scan
+govulncheck ./...                # Vulnerability check
+
+# Benchmarks
+go test -bench=. -benchmem ./... # Performance tests
+```
+
+### Pre-commit Checklist
+```bash
+# Run this before every commit
+gofmt -s -w . && \
+go mod tidy && \
+golangci-lint run && \
+go test -race -short ./... && \
+echo "✅ Ready to commit!"
+```
+
+## 📝 Configuration
+
+### Adjust Coverage Threshold
+Edit `.github/workflows/pr-validation.yml`:
+```yaml
+THRESHOLD=75  # Change to desired percentage
+```
+
+### Modify Linter Rules
+Edit `.golangci.yml`:
+```yaml
+linters:
+  enable:
+    - newlinter  # Add new linters here
+```
+
+### Update Go Version
+Edit `.github/workflows/pr-validation.yml`:
+```yaml
+go-version: '1.24'  # Update version
+```
+
+## 🐛 Troubleshooting
+
+### Coverage Below Threshold
+```bash
+# See uncovered lines in browser
+go test -coverprofile=coverage.out ./...
+go tool cover -html=coverage.out
+```
+
+### Race Condition Found
+```bash
+# Run specific test with race detector
+go test -race -v -run=TestName ./...
+```
+
+### Linter Errors
+```bash
+# See detailed lint errors
+golangci-lint run -v
+
+# Auto-fix some issues
+golangci-lint run --fix
+```
+
+### Provider Test Fails
+```bash
+# Test specific provider
+go test -v -run='.*Azure.*' ./internal/providers/
+```
+
+## 📈 Metrics & Monitoring
+
+### GitHub Actions Dashboard
+- View all runs: `Actions` tab
+- Filter by workflow, branch, status
+- Download logs and artifacts
+
+### Status Badge
+Add to README.md:
+```markdown
+[![PR Validation](https://github.com/lukaszraczylo/traefikoidc/actions/workflows/pr-validation.yml/badge.svg)](https://github.com/lukaszraczylo/traefikoidc/actions/workflows/pr-validation.yml)
+```
+
+### Notifications
+- Configure in: Settings → Notifications
+- Email alerts for workflow failures
+- Slack/Discord webhooks supported
+
+## 🔄 Continuous Improvement
+
+### Dependabot Updates
+- Automatic weekly dependency checks (Mondays 9 AM)
+- Security updates prioritized
+- Groups patch updates together
+
+### Code Owners
+- Auto-assigns reviewers based on file paths
+- Ensures expertise reviews changes
+- Speeds up PR review process
+
+## 📚 Additional Resources
+
+- [Workflow Documentation](.github/workflows/README.md)
+- [golangci-lint Rules](.golangci.yml)
+- [PR Template](.github/PULL_REQUEST_TEMPLATE.md)
+- [Dependabot Config](.github/dependabot.yml)
+
+## 🎉 Benefits
+
+### For Contributors
+- Clear expectations via PR template
+- Fast feedback (5-10 min)
+- Comprehensive local tooling
+- Detailed error messages
+
+### For Maintainers
+- Automated code review
+- Security scanning
+- Performance tracking
+- Quality gates enforcement
+
+### For Users
+- Higher code quality
+- Fewer bugs in production
+- Better security
+- Consistent performance
+
+## 🚦 Success Criteria
+
+All PRs must pass:
+- ✅ All 20+ parallel checks
+- ✅ 75% test coverage minimum
+- ✅ Zero security vulnerabilities
+- ✅ No race conditions
+- ✅ No memory leaks
+- ✅ All providers tested
+- ✅ Builds on all platforms
+
+## 💡 Tips
+
+1. **Run checks locally** before pushing to save CI time
+2. **Watch for PR comments** - coverage stats posted automatically
+3. **Check Security tab** for gosec/CodeQL findings
+4. **Review benchmark results** in artifacts
+5. **Use draft PRs** for work-in-progress to skip some checks
+
+---
+
+**Ready to go!** 🚀 Push your changes and create a PR to see it in action.

README.md

@@ -8,6 +8,7 @@ The Traefik OIDC middleware provides a complete OIDC authentication solution wit
 
 - **Universal provider support**: Works with 9+ OIDC providers including Google, Azure AD, Auth0, Okta, Keycloak, AWS Cognito, GitLab, and more
 - **Automatic provider detection**: Automatically detects and configures provider-specific settings
+- **Automatic scope filtering**: Intelligently filters OAuth scopes based on provider capabilities declared in OIDC discovery documents, preventing authentication failures with unsupported scopes
 - **Security headers**: Comprehensive security headers with CORS, CSP, HSTS, and custom profiles
 - **Domain restrictions**: Limit access to specific email domains or individual users
 - **Role-based access control**: Restrict access based on roles and groups from OIDC claims
@@ -75,7 +76,7 @@ experimental:
   plugins:
     traefikoidc:
       moduleName: github.com/lukaszraczylo/traefikoidc
-      version: v0.2.1  # Use the latest version
+      version: v0.7.10  # Use the latest version
 ```
 
 2. Configure the middleware in your dynamic configuration (see examples below).
@@ -114,19 +115,43 @@ The middleware supports the following configuration options:
 | `scopes` | OAuth 2.0 scopes to use for authentication | `["openid", "profile", "email"]` (always included by default) | `["roles", "custom_scope"]` (appended to defaults) |
 | `overrideScopes` | When true, replaces default scopes with provided scopes instead of appending | `false` | `true` (use only the scopes explicitly provided) |
 | `logLevel` | Sets the logging verbosity | `info` | `debug`, `info`, `error` |
-| `forceHTTPS` | Forces the use of HTTPS for all URLs | `true` | `true`, `false` |
+| `forceHTTPS` | Forces HTTPS scheme for redirect URIs (**REQUIRED** for TLS termination at load balancer like AWS ALB) | `false` (when not specified) | `true`, `false` |
 | `rateLimit` | Sets the maximum number of requests per second | `100` | `500` |
 | `excludedURLs` | Lists paths that bypass authentication | none | `["/health", "/metrics", "/public"]` |
 | `allowedUserDomains` | Restricts access to specific email domains | none | `["company.com", "subsidiary.com"]` |
 | `allowedUsers` | A list of specific email addresses that are allowed access | none | `["[email protected]", "[email protected]"]` |
 | `allowedRolesAndGroups` | Restricts access to users with specific roles or groups | none | `["admin", "developer"]` |
+| `roleClaimName` | JWT claim name for extracting user roles (supports namespaced claims for Auth0) | `"roles"` | `"https://myapp.com/roles"`, `"user_roles"` |
+| `groupClaimName` | JWT claim name for extracting user groups (supports namespaced claims for Auth0) | `"groups"` | `"https://myapp.com/groups"`, `"user_groups"` |
 | `revocationURL` | The endpoint for revoking tokens | auto-discovered | `https://accounts.google.com/revoke` |
 | `oidcEndSessionURL` | The provider's end session endpoint | auto-discovered | `https://accounts.google.com/logout` |
 | `enablePKCE` | Enables PKCE (Proof Key for Code Exchange) for authorization code flow | `false` | `true`, `false` |
 | `refreshGracePeriodSeconds` | Seconds before token expiry to attempt proactive refresh | `60` | `120` |
 | `cookieDomain` | Explicit domain for session cookies (important for multi-subdomain setups) | auto-detected | `.example.com`, `app.example.com` |
+| `cookiePrefix` | Custom prefix for session cookie names (for isolating multiple middleware instances) | `_oidc_raczylo_` | `_oidc_userauth_`, `_oidc_admin_` |
+| `sessionMaxAge` | Maximum session age in seconds before requiring re-authentication | `86400` (24 hours) | `3600` (1 hour), `604800` (7 days) |
+| `audience` | Custom audience for access token validation (for Auth0 custom APIs, etc.) | `clientID` | `https://my-api.example.com` |
+| `strictAudienceValidation` | Reject sessions with access token audience mismatch (prevents token confusion attacks) | `false` | `true` |
+| `allowOpaqueTokens` | Enable opaque (non-JWT) access token support via RFC 7662 introspection | `false` | `true` |
+| `requireTokenIntrospection` | Require introspection for opaque tokens (force validation, no fallback) | `false` | `true` |
 | `headers` | Custom HTTP headers with templates that can access OIDC claims and tokens | none | See "Templated Headers" section |
 | `securityHeaders` | Configure security headers including CSP, HSTS, CORS, and custom headers | enabled with default profile | See "Security Headers Configuration" section |
+| `disableReplayDetection` | Disable JTI-based replay attack detection for multi-replica deployments | `false` | `true` |
+| `redis` | Redis cache configuration for distributed deployments | disabled | See "Redis Cache" section |
+
+> **⚠️ IMPORTANT - TLS Termination at Load Balancer:**
+>
+> If you're running Traefik behind a load balancer (AWS ALB, Google Cloud Load Balancer, Azure Application Gateway, etc.) that terminates TLS:
+> - **You MUST set `forceHTTPS: true`** in your configuration
+> - Without this setting, redirect URIs will use `http://` instead of `https://`, causing OAuth callback failures
+> - This is especially critical for AWS ALB which may overwrite the `X-Forwarded-Proto` header
+>
+> **Default behavior:**
+> - When `forceHTTPS` is **not specified** in your config → defaults to `false` (Go zero value)
+> - When `forceHTTPS: true` is explicitly set → always uses `https://` for redirect URIs
+> - When `forceHTTPS: false` is explicitly set → scheme detection based on headers/TLS
+>
+> See [GitHub Issue #82](https://github.com/lukaszraczylo/traefikoidc/issues/82) for details.
 
 ## Scope Configuration
 
@@ -201,6 +226,103 @@ scopes: []
 
 The default append behavior ensures essential OIDC scopes are always present, while the override mode gives you complete control over the exact scopes requested from the provider.
 
+## Auth0 Audience Validation & Security
+
+The middleware provides comprehensive support for Auth0 audience validation to prevent token confusion attacks. Auth0 can issue tokens in three different scenarios, each requiring specific configuration.
+
+### Understanding Token Audiences
+
+Per OAuth 2.0 and OIDC specifications:
+- **ID Tokens**: MUST have `aud = client_id` (OIDC Core 1.0 spec)
+- **Access Tokens**: Can have custom audiences (e.g., API identifiers)
+
+Proper audience validation prevents **token confusion attacks** where a token intended for one API is used to access another API.
+
+### Auth0 Scenarios
+
+#### Scenario 1: Custom API Audience ✅ (RECOMMENDED)
+
+**Configuration:**
+```yaml
+audience: "https://my-api.example.com"  # Your API identifier from Auth0
+strictAudienceValidation: true          # Enforce strict validation
+```
+
+**Result**: Fully secure, OIDC compliant with proper access token audience validation.
+
+#### Scenario 2: Default Audience ⚠️ (USE WITH CAUTION)
+
+**Configuration:**
+```yaml
+# audience not specified (defaults to client_id)
+strictAudienceValidation: true  # Recommended: reject mismatched tokens
+```
+
+**Behavior**: Access tokens may not contain client_id in audience, triggering security warnings. Set `strictAudienceValidation: true` to reject such sessions.
+
+#### Scenario 3: Opaque Access Tokens ✅ (SUPPORTED)
+
+**Configuration:**
+```yaml
+allowOpaqueTokens: true              # Enable opaque token support
+requireTokenIntrospection: true      # Require introspection (recommended)
+```
+
+**Result**: Secure with OAuth 2.0 Token Introspection (RFC 7662).
+
+### Security Configuration Options
+
+| Option | Purpose | Recommended Value |
+|--------|---------|-------------------|
+| `audience` | Expected audience for access tokens | Your API identifier or leave empty |
+| `strictAudienceValidation` | Reject sessions with audience mismatch | `true` for production |
+| `allowOpaqueTokens` | Accept non-JWT access tokens | `true` if provider issues opaque tokens |
+| `requireTokenIntrospection` | Force introspection for opaque tokens | `true` when `allowOpaqueTokens=true` |
+
+### Complete Auth0 Configuration Examples
+
+**Production Configuration (Scenario 1):**
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-auth0-secure
+spec:
+  plugin:
+    traefikoidc:
+      providerURL: https://your-auth0-domain.auth0.com
+      clientID: your-auth0-client-id
+      clientSecret: your-auth0-client-secret
+      sessionEncryptionKey: your-secure-encryption-key-min-32-chars
+      callbackURL: /oauth2/callback
+      audience: "https://my-api.example.com"
+      strictAudienceValidation: true
+      allowedRolesAndGroups:
+        - "https://your-app.com/roles:admin"
+        - editor
+```
+
+**Opaque Token Configuration (Scenario 3):**
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-auth0-opaque
+spec:
+  plugin:
+    traefikoidc:
+      providerURL: https://your-auth0-domain.auth0.com
+      clientID: your-auth0-client-id
+      clientSecret: your-auth0-client-secret
+      sessionEncryptionKey: your-secure-encryption-key-min-32-chars
+      callbackURL: /oauth2/callback
+      allowOpaqueTokens: true
+      requireTokenIntrospection: true
+      strictAudienceValidation: true
+```
+
+For detailed Auth0 configuration including all three scenarios, troubleshooting, and security best practices, see **[AUTH0_AUDIENCE_GUIDE.md](docs/AUTH0_AUDIENCE_GUIDE.md)**.
+
 ## Security Headers Configuration
 
 The middleware includes comprehensive security headers support to protect your applications against common web vulnerabilities. Security headers are applied to all authenticated responses.
@@ -319,6 +441,10 @@ securityHeaders:
 | `customHeaders` | Additional custom headers | `{}` | `{"X-Custom": "value"}` |
 | `disableServerHeader` | Remove Server header | `true` | `true`, `false` |
 | `disablePoweredByHeader` | Remove X-Powered-By header | `true` | `true`, `false` |
+| `permissionsPolicy` | Permissions-Policy header | `` | `"geolocation=(), camera=(), microphone=()"` |
+| `crossOriginEmbedderPolicy` | Cross-Origin-Embedder-Policy header | `` | `"require-corp"`, `"credentialless"`, `"unsafe-none"` |
+| `crossOriginOpenerPolicy` | Cross-Origin-Opener-Policy header | `` | `"same-origin"`, `"same-origin-allow-popups"`, `"unsafe-none"` |
+| `crossOriginResourcePolicy` | Cross-Origin-Resource-Policy header | `` | `"same-origin"`, `"same-site"`, `"cross-origin"` |
 
 ### CORS Wildcard Support
 
@@ -390,6 +516,199 @@ securityHeaders:
   corsAllowedOrigins: ["http://localhost:*"]
 ```
 
+### Multi-Replica Deployment Configuration
+
+When running multiple Traefik replicas with the OIDC plugin, you may encounter false positive replay detection errors. Each replica maintains its own in-memory JTI (JWT Token ID) cache, causing legitimate token reuse to be flagged as replay attacks.
+
+**Problem**: When the same valid token hits different replicas:
+- Request → Replica A → JTI added to Replica A's cache ✓
+- Request → Replica B → JTI NOT in Replica B's cache ✓
+- Request → Replica A → ❌ **FALSE POSITIVE**: "token replay detected"
+
+**Solution 1 (Simple)**: Disable replay detection for distributed deployments:
+
+```yaml
+disableReplayDetection: true  # Disable JTI replay detection for multi-replica setups
+```
+
+**Solution 2 (Recommended)**: Use Redis cache backend for shared state (see [Redis Cache](#redis-cache-optional) section)
+
+**Security Note**: When `disableReplayDetection: true`:
+- ✅ Token signatures still validated
+- ✅ Expiration still checked
+- ✅ All other claims still verified
+- ❌ JTI replay check **skipped**
+
+**Example Configuration**:
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-multi-replica
+  namespace: traefik
+spec:
+  plugin:
+    traefikoidc:
+      providerURL: https://accounts.google.com
+      clientID: your-client-id
+      clientSecret: your-client-secret
+      sessionEncryptionKey: your-secure-encryption-key-min-32-chars
+      callbackURL: /oauth2/callback
+      disableReplayDetection: true  # Required for multi-replica deployments without Redis
+```
+
+**Recommendation**: For single-instance deployments, leave this setting at `false` (default) to maintain replay attack protection. For multi-replica deployments, use the Redis cache backend for proper replay detection across all instances.
+
+## Redis Cache (Optional)
+
+The plugin supports optional Redis caching for multi-replica deployments. This solves issues with JTI replay detection and session management when running multiple Traefik instances behind a load balancer.
+
+> **✨ Yaegi Compatible**: Redis support is implemented using a pure-Go RESP protocol client that works seamlessly with Traefik's Yaegi interpreter (no `unsafe` package). Full Redis functionality is available for both dynamic plugin loading and pre-compiled deployments.
+
+### Why Use Redis Cache?
+
+When running multiple Traefik replicas, each instance maintains its own in-memory cache for:
+- JTI (JWT Token ID) replay detection
+- Session data
+- Token metadata
+
+Without a shared cache, you may experience:
+- False positive replay detection errors
+- Session inconsistencies between replicas
+- Users needing to re-authenticate when hitting different instances
+
+### Basic Configuration
+
+Redis is configured through Traefik's dynamic configuration (YAML, labels, etc.):
+
+```yaml
+# Enable Redis cache in your middleware configuration
+redis:
+  enabled: true
+  address: "localhost:6379"
+  password: "your-password"  # Optional
+  db: 0
+  keyPrefix: "traefikoidc:"
+```
+
+### Configuration Priority
+
+The plugin uses the following priority for Redis configuration:
+
+1. **Traefik Dynamic Configuration** (PRIMARY) - Configure via YAML files or Docker/Kubernetes labels
+2. **Environment Variables** (FALLBACK) - Used only when not set in Traefik config
+
+This approach allows you to manage all settings through Traefik's configuration system while maintaining backward compatibility with environment variables.
+
+### Configuration Options
+
+| Parameter | Description | Default | Example |
+|-----------|-------------|---------|---------|
+| `enabled` | Enable Redis caching | `false` | `true` |
+| `address` | Redis server address | - | `redis:6379` |
+| `password` | Redis password | - | `YOUR_PASSWORD` |
+| `db` | Database number | `0` | `1` |
+| `keyPrefix` | Key prefix for namespacing | `traefikoidc:` | `myapp:` |
+| `cacheMode` | Cache mode: `redis`, `hybrid`, `memory` | `redis` | `hybrid` |
+| `poolSize` | Connection pool size | `10` | `20` |
+| `connectTimeout` | Connection timeout (seconds) | `5` | `10` |
+| `readTimeout` | Read timeout (seconds) | `3` | `5` |
+| `writeTimeout` | Write timeout (seconds) | `3` | `5` |
+| `enableTLS` | Enable TLS | `false` | `true` |
+| `tlsSkipVerify` | Skip TLS verification | `false` | `true` |
+| `enableCircuitBreaker` | Circuit breaker for failures | `true` | `true` |
+| `circuitBreakerThreshold` | Failures before circuit opens | `5` | `10` |
+| `circuitBreakerTimeout` | Circuit reset timeout (seconds) | `60` | `30` |
+| `enableHealthCheck` | Periodic health checks | `true` | `true` |
+| `healthCheckInterval` | Health check interval (seconds) | `30` | `60` |
+
+### Environment Variables (Fallback)
+
+If not configured through Traefik, these environment variables can be used as fallback:
+
+- `REDIS_ENABLED` - Enable Redis cache
+- `REDIS_ADDRESS` - Redis server address
+- `REDIS_PASSWORD` - Redis password
+- `REDIS_DB` - Database number
+- `REDIS_KEY_PREFIX` - Key prefix
+- `REDIS_CACHE_MODE` - Cache mode
+- `REDIS_POOL_SIZE` - Connection pool size
+- `REDIS_CONNECT_TIMEOUT` - Connection timeout
+- `REDIS_READ_TIMEOUT` - Read timeout
+- `REDIS_WRITE_TIMEOUT` - Write timeout
+- `REDIS_ENABLE_TLS` - Enable TLS
+- `REDIS_TLS_SKIP_VERIFY` - Skip TLS verification
+
+### Cache Modes
+
+The plugin supports three cache modes:
+
+- **memory** (default): In-memory cache only, suitable for single-instance deployments
+- **redis**: Redis-only cache, all data stored in Redis
+- **hybrid**: Two-tier caching with local memory cache + Redis backend for optimal performance
+
+### Example Configurations
+
+#### Docker Compose with Redis
+
+```yaml
+services:
+  redis:
+    image: redis:alpine
+    command: redis-server --requirepass yourpassword
+
+  traefik:
+    image: traefik:v3.2
+    # ... rest of your Traefik configuration
+    labels:
+      # Configure the OIDC middleware with Redis
+      - "traefik.http.middlewares.oidc.plugin.traefikoidc.clientID=your-client-id"
+      - "traefik.http.middlewares.oidc.plugin.traefikoidc.clientSecret=your-secret"
+      - "traefik.http.middlewares.oidc.plugin.traefikoidc.providerURL=https://auth.example.com"
+      - "traefik.http.middlewares.oidc.plugin.traefikoidc.callbackURL=/oauth2/callback"
+      - "traefik.http.middlewares.oidc.plugin.traefikoidc.sessionEncryptionKey=your-64-char-key"
+      # Redis configuration via labels
+      - "traefik.http.middlewares.oidc.plugin.traefikoidc.redis.enabled=true"
+      - "traefik.http.middlewares.oidc.plugin.traefikoidc.redis.address=redis:6379"
+      - "traefik.http.middlewares.oidc.plugin.traefikoidc.redis.password=yourpassword"
+      - "traefik.http.middlewares.oidc.plugin.traefikoidc.redis.cacheMode=hybrid"
+```
+
+#### Kubernetes with Redis
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-with-redis
+spec:
+  plugin:
+    traefikoidc:
+      providerURL: https://accounts.google.com
+      clientID: your-client-id
+      clientSecret: your-client-secret
+      sessionEncryptionKey: your-encryption-key
+      callbackURL: /oauth2/callback
+      redis:
+        enabled: true
+        address: "redis-service.redis-namespace:6379"
+        password: "urn:k8s:secret:redis-secret:password"
+        db: 0
+        keyPrefix: "traefikoidc"
+        cacheMode: "hybrid"
+```
+
+### Advanced Redis Configuration
+
+See [Redis Cache Documentation](docs/REDIS_CACHE.md) for:
+- Detailed architecture overview
+- High availability setup with Redis Sentinel
+- Redis Cluster configuration
+- Performance tuning guidelines
+- Monitoring and observability
+- Troubleshooting guide
+- Migration from memory-only cache
+
 ## Usage Examples
 
 ### Basic Configuration
@@ -568,6 +887,87 @@ spec:
 
 **Important**: The `cookieDomain` parameter is crucial when running behind a reverse proxy or when your application serves multiple subdomains. Without it, cookies may be created with inconsistent domains, leading to authentication issues like "CSRF token missing in session" errors.
 
+### With Multiple Middleware Instances (Session Isolation)
+
+When running multiple middleware instances with different authorization requirements (e.g., one for general users and one for admins), you must use different `cookiePrefix` values to prevent session sharing between instances:
+
+```yaml
+# Middleware for general user authentication
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-userauth
+  namespace: traefik
+spec:
+  plugin:
+    traefikoidc:
+      providerURL: https://auth.example.com
+      clientID: your-client-id
+      clientSecret: your-client-secret
+      sessionEncryptionKey: user-key-at-least-32-bytes-long
+      callbackURL: /oauth2/callback
+      cookiePrefix: "_oidc_userauth_"  # Unique prefix for this instance
+---
+# Middleware for admin authentication with stricter requirements
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-adminauth
+  namespace: traefik
+spec:
+  plugin:
+    traefikoidc:
+      providerURL: https://auth.example.com
+      clientID: your-client-id
+      clientSecret: your-client-secret
+      sessionEncryptionKey: admin-key-at-least-32-bytes-long  # Different encryption key
+      callbackURL: /oauth2/admin/callback  # Different callback URL
+      cookiePrefix: "_oidc_adminauth_"  # Different prefix for isolation
+      allowedUsers:  # Restricted to specific admin users
+        - [email protected]
+        - [email protected]
+```
+
+**Security Note**: When running multiple instances, ensure you use:
+1. **Different `cookiePrefix`** values to prevent cookie name collisions
+2. **Different `sessionEncryptionKey`** values for complete session isolation
+3. **Different `callbackURL`** paths to avoid routing conflicts
+
+This configuration prevents authorization bypass issues where a user authenticated via the general middleware could access admin-protected routes. See [issue #87](https://github.com/lukaszraczylo/traefikoidc/issues/87) for more details.
+
+### With Extended Session Duration
+
+For applications that users access infrequently (weekly or monthly), you can extend the session duration beyond the default 24 hours to reduce authentication friction:
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-long-session
+  namespace: traefik
+spec:
+  plugin:
+    traefikoidc:
+      providerURL: https://auth.example.com
+      clientID: your-client-id
+      clientSecret: your-client-secret
+      sessionEncryptionKey: your-key-at-least-32-bytes-long
+      callbackURL: /oauth2/callback
+      sessionMaxAge: 604800  # 7 days (in seconds)
+      # Other common values:
+      # 259200   - 3 days
+      # 604800   - 7 days
+      # 1209600  - 14 days
+      # 2592000  - 30 days
+```
+
+**Security Note**: Longer session durations improve user experience but increase security risk. Consider your application's security requirements:
+- **High-security apps**: Use shorter sessions (3600 = 1 hour)
+- **Standard apps**: Default 24 hours balances security and UX
+- **Low-frequency access apps**: Extend to 7-30 days for better UX
+
+See [issue #91](https://github.com/lukaszraczylo/traefikoidc/issues/91) for more details.
+
 ### With Custom Logging and Rate Limiting
 
 ```yaml
@@ -740,14 +1140,26 @@ spec:
       sessionEncryptionKey: your-secure-encryption-key-min-32-chars
       callbackURL: /oauth2/callback
       logoutURL: /oauth2/logout
+
+      # Audience configuration for custom APIs
+      audience: "https://my-api.example.com"  # Your API identifier from Auth0
+      strictAudienceValidation: true          # Enforce proper audience validation
+
       scopes:
         - read:custom_data  # Custom scopes as needed
+
+      # Custom claim names for Auth0 namespaced claims
+      roleClaimName: "https://your-app.com/roles"   # Auth0 requires namespaced custom claims
+      groupClaimName: "https://your-app.com/groups" # Must match claims added in Auth0 Actions
+
       allowedRolesAndGroups:
-        - "https://your-app.com/roles:admin"  # Namespaced claims from Actions
+        - admin    # Will match "admin" in https://your-app.com/roles claim
         - editor
       postLogoutRedirectURI: /logged-out-page  # Must be in Auth0 Allowed Logout URLs
 ```
 
+**Note**: For detailed Auth0 audience configuration including opaque tokens and all security scenarios, see [AUTH0_AUDIENCE_GUIDE.md](docs/AUTH0_AUDIENCE_GUIDE.md).
+
 ### Okta Configuration
 
 ```yaml
@@ -920,7 +1332,7 @@ services:
     image: traefik:v3.2.1
     command:
       - "--experimental.plugins.traefikoidc.modulename=github.com/lukaszraczylo/traefikoidc"
-      - "--experimental.plugins.traefikoidc.version=v0.2.1"
+      - "--experimental.plugins.traefikoidc.version=v0.7.10"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./traefik-config/traefik.yml:/etc/traefik/traefik.yml
@@ -1027,58 +1439,6 @@ http:
                 {{range $i, $e := .Claims.roles}}{{if $i}},{{end}}{{$e}}{{end}}
 ```
 
-## Advanced Configuration
-
-### Session Management
-
-The middleware uses encrypted cookies to manage user sessions. The `sessionEncryptionKey` must be at least 32 bytes long and should be kept secret.
-
-### PKCE Support
-
-The middleware supports PKCE (Proof Key for Code Exchange), which is an extension to the authorization code flow to prevent authorization code interception attacks. When enabled via the `enablePKCE` option, the middleware will generate a code verifier for each authentication request and derive a code challenge from it. The code verifier is stored in the user's session and sent during the token exchange process.
-
-PKCE is recommended when:
-- Your OIDC provider supports it (most modern providers do)
-- You need an additional layer of security for the authorization code flow
-- You're concerned about potential authorization code interception attacks
-
-Note that not all OIDC providers support PKCE, so check your provider's documentation before enabling this feature.
-
-### Session Duration and Token Refresh
-
-This middleware aims to provide long-lived user sessions, typically up to 24 hours, by utilizing OIDC refresh tokens.
-
-**How it works:**
-- When a user authenticates, the middleware requests an access token and, if available, a refresh token from the OIDC provider.
-- The access token usually has a short lifespan (e.g., 1 hour).
-- Before the access token expires (controlled by `refreshGracePeriodSeconds`), the middleware uses the refresh token to obtain a new access token from the provider without requiring the user to log in again.
-- This process repeats, allowing the session to remain valid for as long as the refresh token is valid (often 24 hours or more, depending on the provider).
-
-**Provider-Specific Considerations (e.g., Google):**
-- Some providers, like Google, issue short-lived access tokens (e.g., 1 hour) and require specific configurations for long-term sessions.
-- To enable session extension beyond the initial token expiry with Google and similar providers, the middleware automatically includes the `offline_access` scope in the authentication request. This scope is necessary to obtain a refresh token.
-- For Google specifically, the middleware also adds the `prompt=consent` parameter to the initial authorization request. This ensures Google issues a refresh token, which is crucial for extending the session.
-- If a refresh attempt fails (e.g., the refresh token is revoked or expired), the user will be required to re-authenticate. The middleware includes enhanced error handling and logging for these scenarios.
-- Ensure your OIDC provider is configured to issue refresh tokens and allows their use for extending sessions. Check your provider's documentation for details on refresh token validity periods.
-
-### Google OAuth Compatibility Fix
-
-The middleware includes a specific fix for Google's OAuth implementation, which differs from the standard OIDC specification in how it handles refresh tokens:
-
-- **Issue**: Google does not support the standard `offline_access` scope for requesting refresh tokens and instead requires special parameters.
-  
-- **Automatic Solution**: The middleware detects Google as the provider based on the issuer URL and:
-  - Uses `access_type=offline` query parameter instead of the `offline_access` scope
-  - Adds `prompt=consent` to ensure refresh tokens are consistently issued
-  - Properly handles token refresh with Google's implementation
-
-You do not need any special configuration to use Google OAuth - just set `providerURL` to `https://accounts.google.com` and the middleware will automatically apply the proper parameters.
-
-For detailed information on the Google OAuth fix, see the [dedicated documentation](docs/google-oauth-fix.md).
-
-### Token Caching and Blacklisting
-
-The middleware automatically caches validated tokens to improve performance and maintains a blacklist of revoked tokens.
 ### Templated Headers
 
 The middleware supports setting custom HTTP headers with values templated from OIDC claims and tokens. This allows you to pass authentication information to downstream services in a flexible, customized format.
@@ -1280,32 +1640,6 @@ GitLab supports OIDC for both GitLab.com and self-hosted instances.
 *   **Scopes**: Use `user:email`, `read:user` for basic profile access
 *   **Detection**: Auto-detected from `github.com` in issuer URL
 
-### Azure AD (Microsoft Entra ID)
-
-Azure AD generally works well with standard OIDC configurations.
-
-*   **ID Token Claims**: Azure AD typically includes standard claims like `email`, `name`, `preferred_username`, and `oid` (Object ID) in the ID Token by default when `openid profile email` scopes are requested.
-*   **Group Claims**: To include group claims in the ID Token, you need to configure this in the Azure AD application registration:
-    *   Go to your App Registration -> Token configuration -> Add groups claim.
-    *   You can choose which types of groups (Security groups, Directory roles, All groups) to include.
-    *   Be aware of the "overage" issue: If a user is a member of too many groups, Azure AD will send a link to fetch groups instead of embedding them. This plugin currently expects group claims to be directly in the ID token. For users with many groups, consider alternative role/permission management strategies.
-    *   The claim name for groups is typically `groups`.
-*   **Optional Claims**: You can add other optional claims via the "Token configuration" section of your App Registration. Ensure these are configured for the ID token.
-*   **Endpoints**: The `providerURL` should be `https://login.microsoftonline.com/{your-tenant-id}/v2.0`. The plugin will auto-discover the necessary endpoints.
-*   **Optimization**: Ensure your application manifest in Azure AD is configured for the desired token version (v1.0 or v2.0). This plugin works with v2.0 endpoints.
-
-### Google Workspace / Google Cloud Identity
-
-Google's OIDC implementation is well-supported.
-
-*   **Optimal Configuration**: The plugin automatically handles Google-specific requirements, such as using `access_type=offline` and `prompt=consent` to ensure refresh tokens are issued for long-lived sessions. You do not need to add `offline_access` to scopes.
-*   **ID Token Claims**: Google includes standard claims like `email`, `sub`, `name`, `given_name`, `family_name`, `picture` in the ID Token by default with `openid profile email` scopes.
-*   **Hosted Domain (hd claim)**: If you are using Google Workspace and want to restrict access to users within your organization's domain, Google includes an `hd` (hosted domain) claim in the ID Token. You can use this with the `allowedUserDomains` setting or for custom header logic.
-*   **Best Practices**:
-    *   Use the `providerURL`: `https://accounts.google.com`.
-    *   Ensure your OAuth consent screen in Google Cloud Console is configured correctly and published. For production, it should be "External" and in "Production" status. "Testing" status limits refresh token lifetime.
-    *   Refer to the [Google OAuth Compatibility Fix](#google-oauth-compatibility-fix) section for more details on how the plugin handles Google's specifics.
-
 ### Auth0
 
 Auth0 is generally OIDC compliant and works well.

audience_test.go

@@ -0,0 +1,143 @@
+package traefikoidc
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// TestAudienceConfiguration tests the custom audience configuration feature
+func TestAudienceConfiguration(t *testing.T) {
+	tests := []struct {
+		name             string
+		configAudience   string
+		clientID         string
+		expectedAudience string
+	}{
+		{
+			name:             "no custom audience - uses clientID",
+			configAudience:   "",
+			clientID:         "test-client-id",
+			expectedAudience: "test-client-id",
+		},
+		{
+			name:             "custom audience specified",
+			configAudience:   "api://custom-audience",
+			clientID:         "test-client-id",
+			expectedAudience: "api://custom-audience",
+		},
+		{
+			name:             "auth0 style custom audience",
+			configAudience:   "https://api.example.com",
+			clientID:         "test-client-id",
+			expectedAudience: "https://api.example.com",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create config with custom audience
+			config := CreateConfig()
+			config.ProviderURL = "https://provider.example.com"
+			config.ClientID = tt.clientID
+			config.ClientSecret = "test-secret"
+			config.SessionEncryptionKey = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+			config.CallbackURL = "/callback"
+			config.Audience = tt.configAudience
+
+			// Create middleware instance
+			next := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusOK)
+			})
+
+			traefikOidc, err := NewWithContext(context.Background(), config, next, "test")
+			if err != nil {
+				t.Fatalf("Failed to create middleware: %v", err)
+			}
+
+			// Verify audience is set correctly
+			if traefikOidc.audience != tt.expectedAudience {
+				t.Errorf("Expected audience %s, got %s", tt.expectedAudience, traefikOidc.audience)
+			}
+
+			// Cleanup
+			_ = traefikOidc.Close()
+		})
+	}
+}
+
+// TestAudienceValidation tests the audience validation in Config.Validate()
+func TestAudienceValidation(t *testing.T) {
+	tests := []struct {
+		name          string
+		audience      string
+		expectError   bool
+		errorContains string
+	}{
+		{
+			name:        "valid custom audience URL",
+			audience:    "https://api.example.com",
+			expectError: false,
+		},
+		{
+			name:        "valid azure style audience",
+			audience:    "api://12345678-1234-1234-1234-123456789012",
+			expectError: false,
+		},
+		{
+			name:        "empty audience is valid (uses clientID)",
+			audience:    "",
+			expectError: false,
+		},
+		{
+			name:          "http URL not allowed",
+			audience:      "http://api.example.com",
+			expectError:   true,
+			errorContains: "audience URL must use HTTPS",
+		},
+		{
+			name:          "wildcard not allowed",
+			audience:      "https://*.example.com",
+			expectError:   true,
+			errorContains: "audience must not contain wildcards",
+		},
+		{
+			name:          "too long audience",
+			audience:      "https://" + string(make([]byte, 250)) + ".com",
+			expectError:   true,
+			errorContains: "audience must not exceed 256 characters",
+		},
+		{
+			name:          "invalid characters",
+			audience:      "api://test\ninjection",
+			expectError:   true,
+			errorContains: "audience contains invalid characters",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := CreateConfig()
+			config.ProviderURL = "https://provider.example.com"
+			config.ClientID = "test-client"
+			config.ClientSecret = "test-secret"
+			config.SessionEncryptionKey = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+			config.CallbackURL = "/callback"
+			config.Audience = tt.audience
+
+			err := config.Validate()
+			if tt.expectError {
+				if err == nil {
+					t.Errorf("Expected error but got none")
+				} else if tt.errorContains != "" && !strings.Contains(err.Error(), tt.errorContains) {
+					t.Errorf("Expected error containing '%s', got: %v", tt.errorContains, err)
+				}
+			} else {
+				if err != nil {
+					t.Errorf("Unexpected error: %v", err)
+				}
+			}
+		})
+	}
+}

audience_validation_test.go

@@ -0,0 +1,931 @@
+package traefikoidc
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"golang.org/x/time/rate"
+)
+
+// TestConfigAudienceValidation tests the Config.Validate() method for the audience field
+func TestConfigAudienceValidation(t *testing.T) {
+	tests := []struct {
+		name        string
+		audience    string
+		wantErr     bool
+		errContains string
+	}{
+		{
+			name:     "Empty audience is valid for backward compatibility",
+			audience: "",
+			wantErr:  false,
+		},
+		{
+			name:     "Valid HTTPS URL audience Auth0 format",
+			audience: "https://api.example.com",
+			wantErr:  false,
+		},
+		{
+			name:     "Valid identifier audience",
+			audience: "my-api",
+			wantErr:  false,
+		},
+		{
+			name:     "Valid Azure AD Application ID URI format",
+			audience: "api://12345-guid-67890",
+			wantErr:  false,
+		},
+		{
+			name:     "Valid Auth0 API identifier",
+			audience: "https://my-company.auth0.com/api/v2/",
+			wantErr:  false,
+		},
+		{
+			name:        "HTTP URL audience should fail",
+			audience:    "http://api.example.com",
+			wantErr:     true,
+			errContains: "must use HTTPS",
+		},
+		{
+			name:        "Audience with wildcard should fail",
+			audience:    "https://api.*.example.com",
+			wantErr:     true,
+			errContains: "must not contain wildcards",
+		},
+		{
+			name:        "Audience with single asterisk should fail",
+			audience:    "*",
+			wantErr:     true,
+			errContains: "must not contain wildcards",
+		},
+		{
+			name:        "Audience over 256 characters should fail",
+			audience:    strings.Repeat("a", 257),
+			wantErr:     true,
+			errContains: "must not exceed 256 characters",
+		},
+		{
+			name:        "Audience with newline should fail",
+			audience:    "my-api\ninjection",
+			wantErr:     true,
+			errContains: "contains invalid characters",
+		},
+		{
+			name:        "Audience with carriage return should fail",
+			audience:    "my-api\rinjection",
+			wantErr:     true,
+			errContains: "contains invalid characters",
+		},
+		{
+			name:        "Audience with tab should fail",
+			audience:    "my-api\tinjection",
+			wantErr:     true,
+			errContains: "contains invalid characters",
+		},
+		{
+			name:     "Valid audience exactly 256 characters",
+			audience: strings.Repeat("a", 256),
+			wantErr:  false,
+		},
+		{
+			name:     "Valid simple identifier",
+			audience: "my-service-api",
+			wantErr:  false,
+		},
+		{
+			name:     "Valid URN format",
+			audience: "urn:myservice:api:v1",
+			wantErr:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := CreateConfig()
+			config.ProviderURL = "https://provider.example.com"
+			config.ClientID = "test-client-id"
+			config.ClientSecret = "test-client-secret"
+			config.CallbackURL = "/callback"
+			config.SessionEncryptionKey = strings.Repeat("a", MinSessionEncryptionKeyLength)
+			config.Audience = tt.audience
+
+			err := config.Validate()
+			if (err != nil) != tt.wantErr {
+				t.Errorf("Validate() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if err != nil && tt.errContains != "" && !strings.Contains(err.Error(), tt.errContains) {
+				t.Errorf("Error message should contain %q, got: %v", tt.errContains, err)
+			}
+		})
+	}
+}
+
+// TestJWTAudienceVerification tests JWT verification with custom audience values
+func TestJWTAudienceVerification(t *testing.T) {
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
+	// Generate RSA key for signing JWTs
+	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("Failed to generate RSA key: %v", err)
+	}
+	rsaPublicKey := &rsaPrivateKey.PublicKey
+
+	// Create JWK
+	jwk := JWK{
+		Kty: "RSA",
+		Kid: "test-key-id",
+		Alg: "RS256",
+		N:   base64.RawURLEncoding.EncodeToString(rsaPublicKey.N.Bytes()),
+		E:   base64.RawURLEncoding.EncodeToString([]byte{1, 0, 1}),
+	}
+	jwks := &JWKSet{
+		Keys: []JWK{jwk},
+	}
+
+	mockJWKCache := &MockJWKCache{
+		JWKS: jwks,
+		Err:  nil,
+	}
+
+	logger := NewLogger("debug")
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())
+
+	tests := []struct {
+		name            string
+		configAudience  string
+		tokenAudience   interface{}
+		wantErr         bool
+		errContains     string
+		skipReplayCheck bool
+	}{
+		{
+			name:            "JWT with string aud matching configured audience",
+			configAudience:  "https://api.example.com",
+			tokenAudience:   "https://api.example.com",
+			wantErr:         false,
+			skipReplayCheck: true,
+		},
+		{
+			name:            "JWT with array aud containing configured audience",
+			configAudience:  "https://api.example.com",
+			tokenAudience:   []interface{}{"https://other.com", "https://api.example.com", "https://another.com"},
+			wantErr:         false,
+			skipReplayCheck: true,
+		},
+		{
+			name:            "JWT with string aud NOT matching configured audience",
+			configAudience:  "https://api.example.com",
+			tokenAudience:   "https://wrong-api.example.com",
+			wantErr:         true,
+			errContains:     "invalid audience",
+			skipReplayCheck: true,
+		},
+		{
+			name:            "JWT with array aud NOT containing configured audience",
+			configAudience:  "https://api.example.com",
+			tokenAudience:   []interface{}{"https://other.com", "https://another.com"},
+			wantErr:         true,
+			errContains:     "invalid audience",
+			skipReplayCheck: true,
+		},
+		{
+			name:            "JWT with clientID as aud when no custom audience configured",
+			configAudience:  "",
+			tokenAudience:   "test-client-id",
+			wantErr:         false,
+			skipReplayCheck: true,
+		},
+		{
+			name:            "JWT with empty string aud",
+			configAudience:  "https://api.example.com",
+			tokenAudience:   "",
+			wantErr:         true,
+			errContains:     "invalid audience",
+			skipReplayCheck: true,
+		},
+		{
+			name:            "Azure AD Application ID URI format",
+			configAudience:  "api://12345-app-id",
+			tokenAudience:   "api://12345-app-id",
+			wantErr:         false,
+			skipReplayCheck: true,
+		},
+		{
+			name:            "Auth0 custom API audience",
+			configAudience:  "https://mycompany.com/api",
+			tokenAudience:   "https://mycompany.com/api",
+			wantErr:         false,
+			skipReplayCheck: true,
+		},
+		{
+			name:            "Token confusion attack - audience for different service",
+			configAudience:  "https://service-a.example.com",
+			tokenAudience:   "https://service-b.example.com",
+			wantErr:         true,
+			errContains:     "invalid audience",
+			skipReplayCheck: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create TraefikOidc instance
+			tOidc := &TraefikOidc{
+				issuerURL:      "https://test-issuer.com",
+				clientID:       "test-client-id",
+				clientSecret:   "test-client-secret",
+				jwkCache:       mockJWKCache,
+				jwksURL:        "https://test-jwks-url.com",
+				tokenBlacklist: tokenBlacklist,
+				tokenCache:     tokenCache,
+				limiter:        rate.NewLimiter(rate.Every(time.Second), 10),
+				logger:         logger,
+				httpClient:     &http.Client{},
+			}
+
+			// Set up the token verifier and JWT verifier
+			tOidc.jwtVerifier = tOidc
+			tOidc.tokenVerifier = tOidc
+
+			// Determine the expected audience for validation
+			expectedAudience := tt.configAudience
+			if expectedAudience == "" {
+				expectedAudience = tOidc.clientID
+			}
+
+			// Set the audience field on the tOidc instance
+			tOidc.audience = expectedAudience
+
+			// Create JWT with specified audience
+			jti := generateRandomString(16)
+			if tt.skipReplayCheck {
+				// Use a unique JTI for each test to avoid replay detection
+				jti = fmt.Sprintf("test-%s-%s", tt.name, jti)
+			}
+
+			jwt, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+				"iss":   "https://test-issuer.com",
+				"aud":   tt.tokenAudience,
+				"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+				"iat":   float64(time.Now().Add(-2 * time.Minute).Unix()),
+				"sub":   "test-subject",
+				"email": "[email protected]",
+				"jti":   jti,
+			})
+			if err != nil {
+				t.Fatalf("Failed to create test JWT: %v", err)
+			}
+
+			// Verify the token
+			err = tOidc.VerifyToken(jwt)
+
+			if (err != nil) != tt.wantErr {
+				t.Errorf("VerifyToken() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if err != nil && tt.errContains != "" && !strings.Contains(err.Error(), tt.errContains) {
+				t.Errorf("Error message should contain %q, got: %v", tt.errContains, err)
+			}
+		})
+	}
+}
+
+// TestJWTAudienceBackwardCompatibility tests that existing behavior is preserved
+// when the Audience field is not set
+func TestJWTAudienceBackwardCompatibility(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Test with no custom audience configured - should use clientID
+	jwt, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss":   "https://test-issuer.com",
+		"aud":   "test-client-id", // Should match clientID
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Add(-2 * time.Minute).Unix()),
+		"sub":   "test-subject",
+		"email": "[email protected]",
+		"jti":   generateRandomString(16),
+	})
+	if err != nil {
+		t.Fatalf("Failed to create test JWT: %v", err)
+	}
+
+	err = ts.tOidc.VerifyToken(jwt)
+	if err != nil {
+		t.Errorf("Backward compatibility broken: VerifyToken() error = %v, expected nil", err)
+	}
+}
+
+// TestAudienceIntegrationAuth0Scenario tests Auth0-specific use case
+func TestAudienceIntegrationAuth0Scenario(t *testing.T) {
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
+	// Simulate Auth0 scenario: custom audience for API access
+	config := CreateConfig()
+	config.ProviderURL = "https://mycompany.auth0.com"
+	config.ClientID = "auth0-client-id"
+	config.ClientSecret = "auth0-client-secret"
+	config.CallbackURL = "/callback"
+	config.SessionEncryptionKey = strings.Repeat("a", MinSessionEncryptionKeyLength)
+	config.Audience = "https://api.mycompany.com" // Custom API audience
+
+	// Validate config
+	if err := config.Validate(); err != nil {
+		t.Fatalf("Auth0 config validation failed: %v", err)
+	}
+
+	// Generate test keys
+	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("Failed to generate RSA key: %v", err)
+	}
+	rsaPublicKey := &rsaPrivateKey.PublicKey
+
+	jwk := JWK{
+		Kty: "RSA",
+		Kid: "auth0-key-id",
+		Alg: "RS256",
+		N:   base64.RawURLEncoding.EncodeToString(rsaPublicKey.N.Bytes()),
+		E:   base64.RawURLEncoding.EncodeToString([]byte{1, 0, 1}),
+	}
+	jwks := &JWKSet{
+		Keys: []JWK{jwk},
+	}
+
+	mockJWKCache := &MockJWKCache{
+		JWKS: jwks,
+		Err:  nil,
+	}
+
+	logger := NewLogger("debug")
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())
+
+	tOidc := &TraefikOidc{
+		issuerURL:      config.ProviderURL,
+		clientID:       config.ClientID,
+		clientSecret:   config.ClientSecret,
+		audience:       config.Audience, // Set audience from config
+		jwkCache:       mockJWKCache,
+		jwksURL:        "https://mycompany.auth0.com/.well-known/jwks.json",
+		tokenBlacklist: tokenBlacklist,
+		tokenCache:     tokenCache,
+		limiter:        rate.NewLimiter(rate.Every(time.Second), 10),
+		logger:         logger,
+		httpClient:     &http.Client{},
+	}
+
+	// Default audience to clientID if not specified
+	if tOidc.audience == "" {
+		tOidc.audience = tOidc.clientID
+	}
+
+	tOidc.jwtVerifier = tOidc
+	tOidc.tokenVerifier = tOidc
+
+	t.Run("Valid Auth0 API access token with custom audience", func(t *testing.T) {
+		jwt, err := createTestJWT(rsaPrivateKey, "RS256", "auth0-key-id", map[string]interface{}{
+			"iss":   config.ProviderURL,
+			"aud":   config.Audience, // Matches configured audience
+			"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+			"iat":   float64(time.Now().Add(-2 * time.Minute).Unix()),
+			"sub":   "auth0|123456",
+			"email": "[email protected]",
+			"jti":   generateRandomString(16),
+		})
+		if err != nil {
+			t.Fatalf("Failed to create Auth0 JWT: %v", err)
+		}
+
+		err = tOidc.VerifyToken(jwt)
+		if err != nil {
+			t.Errorf("Auth0 token verification failed: %v", err)
+		}
+	})
+
+	t.Run("Auth0 ACCESS token with clientID instead of API audience should fail", func(t *testing.T) {
+		jwt, err := createTestJWT(rsaPrivateKey, "RS256", "auth0-key-id", map[string]interface{}{
+			"iss":   config.ProviderURL,
+			"aud":   config.ClientID,        // Using clientID instead of API audience
+			"scope": "openid profile email", // Mark as access token
+			"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+			"iat":   float64(time.Now().Add(-2 * time.Minute).Unix()),
+			"sub":   "auth0|123456",
+			"email": "[email protected]",
+			"jti":   generateRandomString(16),
+		})
+		if err != nil {
+			t.Fatalf("Failed to create Auth0 JWT: %v", err)
+		}
+
+		err = tOidc.VerifyToken(jwt)
+		if err == nil {
+			t.Error("Auth0 access token with wrong audience should have been rejected")
+		} else if !strings.Contains(err.Error(), "invalid audience") {
+			t.Errorf("Expected 'invalid audience' error, got: %v", err)
+		}
+	})
+}
+
+// TestAudienceIntegrationAzureADScenario tests Azure AD-specific use case
+func TestAudienceIntegrationAzureADScenario(t *testing.T) {
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
+	// Simulate Azure AD scenario: Application ID URI format
+	config := CreateConfig()
+	config.ProviderURL = "https://login.microsoftonline.com/tenant-id/v2.0"
+	config.ClientID = "azure-client-id"
+	config.ClientSecret = "azure-client-secret"
+	config.CallbackURL = "/callback"
+	config.SessionEncryptionKey = strings.Repeat("a", MinSessionEncryptionKeyLength)
+	config.Audience = "api://12345-abcd-6789-efgh" // Azure AD Application ID URI
+
+	// Validate config
+	if err := config.Validate(); err != nil {
+		t.Fatalf("Azure AD config validation failed: %v", err)
+	}
+
+	// Generate test keys
+	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("Failed to generate RSA key: %v", err)
+	}
+	rsaPublicKey := &rsaPrivateKey.PublicKey
+
+	jwk := JWK{
+		Kty: "RSA",
+		Kid: "azure-key-id",
+		Alg: "RS256",
+		N:   base64.RawURLEncoding.EncodeToString(rsaPublicKey.N.Bytes()),
+		E:   base64.RawURLEncoding.EncodeToString([]byte{1, 0, 1}),
+	}
+	jwks := &JWKSet{
+		Keys: []JWK{jwk},
+	}
+
+	mockJWKCache := &MockJWKCache{
+		JWKS: jwks,
+		Err:  nil,
+	}
+
+	logger := NewLogger("debug")
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())
+
+	tOidc := &TraefikOidc{
+		issuerURL:      config.ProviderURL,
+		clientID:       config.ClientID,
+		clientSecret:   config.ClientSecret,
+		audience:       config.Audience, // Set audience from config
+		jwkCache:       mockJWKCache,
+		jwksURL:        config.ProviderURL + "/.well-known/jwks.json",
+		tokenBlacklist: tokenBlacklist,
+		tokenCache:     tokenCache,
+		limiter:        rate.NewLimiter(rate.Every(time.Second), 10),
+		logger:         logger,
+		httpClient:     &http.Client{},
+	}
+
+	// Default audience to clientID if not specified
+	if tOidc.audience == "" {
+		tOidc.audience = tOidc.clientID
+	}
+
+	tOidc.jwtVerifier = tOidc
+	tOidc.tokenVerifier = tOidc
+
+	t.Run("Valid Azure AD token with Application ID URI audience", func(t *testing.T) {
+		jwt, err := createTestJWT(rsaPrivateKey, "RS256", "azure-key-id", map[string]interface{}{
+			"iss":   config.ProviderURL,
+			"aud":   config.Audience, // Matches Application ID URI
+			"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+			"iat":   float64(time.Now().Add(-2 * time.Minute).Unix()),
+			"sub":   "azure-user-id",
+			"email": "[email protected]",
+			"oid":   "object-id-12345",
+			"tid":   "tenant-id",
+			"jti":   generateRandomString(16),
+		})
+		if err != nil {
+			t.Fatalf("Failed to create Azure AD JWT: %v", err)
+		}
+
+		err = tOidc.VerifyToken(jwt)
+		if err != nil {
+			t.Errorf("Azure AD token verification failed: %v", err)
+		}
+	})
+
+	t.Run("Azure AD token with multiple audiences including correct one", func(t *testing.T) {
+		jwt, err := createTestJWT(rsaPrivateKey, "RS256", "azure-key-id", map[string]interface{}{
+			"iss":   config.ProviderURL,
+			"aud":   []interface{}{config.ClientID, config.Audience, "https://graph.microsoft.com"},
+			"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+			"iat":   float64(time.Now().Add(-2 * time.Minute).Unix()),
+			"sub":   "azure-user-id",
+			"email": "[email protected]",
+			"oid":   "object-id-12345",
+			"tid":   "tenant-id",
+			"jti":   generateRandomString(16),
+		})
+		if err != nil {
+			t.Fatalf("Failed to create Azure AD JWT: %v", err)
+		}
+
+		err = tOidc.VerifyToken(jwt)
+		if err != nil {
+			t.Errorf("Azure AD token with multiple audiences verification failed: %v", err)
+		}
+	})
+}
+
+// TestAudienceSecurityTokenConfusionAttack tests security against token confusion attacks
+func TestAudienceSecurityTokenConfusionAttack(t *testing.T) {
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
+	// Generate test keys
+	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("Failed to generate RSA key: %v", err)
+	}
+	rsaPublicKey := &rsaPrivateKey.PublicKey
+
+	jwk := JWK{
+		Kty: "RSA",
+		Kid: "test-key-id",
+		Alg: "RS256",
+		N:   base64.RawURLEncoding.EncodeToString(rsaPublicKey.N.Bytes()),
+		E:   base64.RawURLEncoding.EncodeToString([]byte{1, 0, 1}),
+	}
+	jwks := &JWKSet{
+		Keys: []JWK{jwk},
+	}
+
+	mockJWKCache := &MockJWKCache{
+		JWKS: jwks,
+		Err:  nil,
+	}
+
+	logger := NewLogger("debug")
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())
+
+	// Service A configuration
+	serviceA := &TraefikOidc{
+		issuerURL:      "https://auth.example.com",
+		clientID:       "service-a-client-id",
+		clientSecret:   "service-a-secret",
+		audience:       "service-a-client-id", // Service A uses its clientID as audience
+		jwkCache:       mockJWKCache,
+		jwksURL:        "https://auth.example.com/.well-known/jwks.json",
+		tokenBlacklist: tokenBlacklist,
+		tokenCache:     tokenCache,
+		limiter:        rate.NewLimiter(rate.Every(time.Second), 10),
+		logger:         logger,
+		httpClient:     &http.Client{},
+	}
+	serviceA.jwtVerifier = serviceA
+	serviceA.tokenVerifier = serviceA
+
+	t.Run("Token confusion - Try to use service B token on service A", func(t *testing.T) {
+		// Create a token intended for service B
+		serviceBToken, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+			"iss":   "https://auth.example.com",
+			"aud":   "https://service-b.example.com", // For service B
+			"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+			"iat":   float64(time.Now().Add(-2 * time.Minute).Unix()),
+			"sub":   "[email protected]",
+			"email": "[email protected]",
+			"jti":   generateRandomString(16),
+		})
+		if err != nil {
+			t.Fatalf("Failed to create service B token: %v", err)
+		}
+
+		// Try to verify the service B token on service A
+		err = serviceA.VerifyToken(serviceBToken)
+		switch {
+		case err == nil:
+			t.Error("SECURITY VULNERABILITY: Token confusion attack succeeded - service B token was accepted by service A")
+		case !strings.Contains(err.Error(), "invalid audience"):
+			t.Errorf("Expected 'invalid audience' error for token confusion, got: %v", err)
+		default:
+			t.Logf("Token confusion attack correctly prevented: %v", err)
+		}
+	})
+}
+
+// TestAudienceSecurityWildcardInjection tests that wildcards are rejected
+func TestAudienceSecurityWildcardInjection(t *testing.T) {
+	tests := []struct {
+		name     string
+		audience string
+	}{
+		{
+			name:     "Single asterisk",
+			audience: "*",
+		},
+		{
+			name:     "Wildcard in URL",
+			audience: "https://*.example.com",
+		},
+		{
+			name:     "Wildcard in path",
+			audience: "https://api.example.com/*",
+		},
+		{
+			name:     "Multiple wildcards",
+			audience: "https://*.*.example.com",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := CreateConfig()
+			config.ProviderURL = "https://provider.example.com"
+			config.ClientID = "test-client-id"
+			config.ClientSecret = "test-client-secret"
+			config.CallbackURL = "/callback"
+			config.SessionEncryptionKey = strings.Repeat("a", MinSessionEncryptionKeyLength)
+			config.Audience = tt.audience
+
+			err := config.Validate()
+			if err == nil {
+				t.Errorf("SECURITY VULNERABILITY: Wildcard audience %q was not rejected", tt.audience)
+			} else if !strings.Contains(err.Error(), "must not contain wildcards") {
+				t.Errorf("Expected 'must not contain wildcards' error, got: %v", err)
+			}
+		})
+	}
+}
+
+// TestAudienceSecurityInjectionAttempts tests various injection attempts
+func TestAudienceSecurityInjectionAttempts(t *testing.T) {
+	tests := []struct {
+		name        string
+		audience    string
+		errContains string
+	}{
+		{
+			name:        "Newline injection",
+			audience:    "api.example.com\nmalicious.com",
+			errContains: "contains invalid characters",
+		},
+		{
+			name:        "Carriage return injection",
+			audience:    "api.example.com\rmalicious.com",
+			errContains: "contains invalid characters",
+		},
+		{
+			name:        "Tab injection",
+			audience:    "api.example.com\tmalicious.com",
+			errContains: "contains invalid characters",
+		},
+		{
+			name:        "Null byte injection",
+			audience:    "api.example.com\x00malicious.com",
+			errContains: "contains invalid characters",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := CreateConfig()
+			config.ProviderURL = "https://provider.example.com"
+			config.ClientID = "test-client-id"
+			config.ClientSecret = "test-client-secret"
+			config.CallbackURL = "/callback"
+			config.SessionEncryptionKey = strings.Repeat("a", MinSessionEncryptionKeyLength)
+			config.Audience = tt.audience
+
+			err := config.Validate()
+			if err == nil {
+				t.Errorf("SECURITY VULNERABILITY: Injection attempt with %q was not rejected", tt.name)
+			} else if !strings.Contains(err.Error(), tt.errContains) {
+				t.Errorf("Expected error containing %q, got: %v", tt.errContains, err)
+			}
+		})
+	}
+}
+
+// TestAudienceWithReplayProtection tests that replay protection works correctly with custom audiences
+func TestAudienceWithReplayProtection(t *testing.T) {
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
+	// Generate test keys
+	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("Failed to generate RSA key: %v", err)
+	}
+	rsaPublicKey := &rsaPrivateKey.PublicKey
+
+	jwk := JWK{
+		Kty: "RSA",
+		Kid: "test-key-id",
+		Alg: "RS256",
+		N:   base64.RawURLEncoding.EncodeToString(rsaPublicKey.N.Bytes()),
+		E:   base64.RawURLEncoding.EncodeToString([]byte{1, 0, 1}),
+	}
+	jwks := &JWKSet{
+		Keys: []JWK{jwk},
+	}
+
+	mockJWKCache := &MockJWKCache{
+		JWKS: jwks,
+		Err:  nil,
+	}
+
+	logger := NewLogger("debug")
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())
+
+	tOidc := &TraefikOidc{
+		issuerURL:      "https://auth.example.com",
+		clientID:       "test-client-id",
+		clientSecret:   "test-client-secret",
+		jwkCache:       mockJWKCache,
+		jwksURL:        "https://auth.example.com/.well-known/jwks.json",
+		tokenBlacklist: tokenBlacklist,
+		tokenCache:     tokenCache,
+		limiter:        rate.NewLimiter(rate.Every(time.Second), 10),
+		logger:         logger,
+		httpClient:     &http.Client{},
+	}
+	tOidc.jwtVerifier = tOidc
+	tOidc.tokenVerifier = tOidc
+
+	// Create a token with custom audience and fixed JTI
+	fixedJTI := "replay-test-jti-" + generateRandomString(8)
+	customAudience := "https://api.example.com"
+
+	// Set the audience field to match what we expect
+	tOidc.audience = customAudience
+
+	jwt, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss":   "https://auth.example.com",
+		"aud":   customAudience,
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Add(-2 * time.Minute).Unix()),
+		"sub":   "test-user",
+		"email": "[email protected]",
+		"jti":   fixedJTI,
+	})
+	if err != nil {
+		t.Fatalf("Failed to create JWT: %v", err)
+	}
+
+	// First verification should succeed
+	err = tOidc.VerifyToken(jwt)
+	if err != nil {
+		t.Fatalf("First verification failed: %v", err)
+	}
+
+	// Verify that the JTI was blacklisted
+	if blacklisted, exists := tOidc.tokenBlacklist.Get(fixedJTI); !exists || blacklisted == nil {
+		t.Logf("Note: JTI was not added to blacklist (may be due to test token prefix)")
+	} else {
+		t.Logf("Replay protection verified: JTI %s is correctly blacklisted", fixedJTI)
+	}
+}
+
+// TestAudienceEndToEndScenario tests a complete end-to-end scenario with middleware
+func TestAudienceEndToEndScenario(t *testing.T) {
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
+	// Create a test next handler
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("Authenticated with custom audience"))
+	})
+
+	// Generate test keys
+	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("Failed to generate RSA key: %v", err)
+	}
+	rsaPublicKey := &rsaPrivateKey.PublicKey
+
+	jwk := JWK{
+		Kty: "RSA",
+		Kid: "test-key-id",
+		Alg: "RS256",
+		N:   base64.RawURLEncoding.EncodeToString(rsaPublicKey.N.Bytes()),
+		E:   base64.RawURLEncoding.EncodeToString([]byte{1, 0, 1}),
+	}
+	jwks := &JWKSet{
+		Keys: []JWK{jwk},
+	}
+
+	mockJWKCache := &MockJWKCache{
+		JWKS: jwks,
+		Err:  nil,
+	}
+
+	logger := NewLogger("debug")
+	sm, err := NewSessionManager(strings.Repeat("a", MinSessionEncryptionKeyLength), false, "", "", 0, logger)
+	if err != nil {
+		t.Fatalf("Failed to create session manager: %v", err)
+	}
+
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())
+
+	customAudience := "https://api.company.com"
+
+	tOidc := &TraefikOidc{
+		next:               nextHandler,
+		name:               "test",
+		redirURLPath:       "/callback",
+		logoutURLPath:      "/callback/logout",
+		issuerURL:          "https://auth.company.com",
+		clientID:           "test-client-id",
+		clientSecret:       "test-client-secret",
+		audience:           customAudience, // Set custom audience
+		jwkCache:           mockJWKCache,
+		jwksURL:            "https://auth.company.com/.well-known/jwks.json",
+		tokenBlacklist:     tokenBlacklist,
+		tokenCache:         tokenCache,
+		limiter:            rate.NewLimiter(rate.Every(time.Second), 10),
+		logger:             logger,
+		allowedUserDomains: map[string]struct{}{"company.com": {}},
+		excludedURLs:       map[string]struct{}{},
+		httpClient:         &http.Client{},
+		initComplete:       make(chan struct{}),
+		sessionManager:     sm,
+		extractClaimsFunc:  extractClaims,
+	}
+	tOidc.jwtVerifier = tOidc
+	tOidc.tokenVerifier = tOidc
+	close(tOidc.initComplete)
+
+	t.Run("End-to-end with correct custom audience", func(t *testing.T) {
+		// Create a valid token with the custom audience
+		validJWT, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+			"iss":   "https://auth.company.com",
+			"aud":   customAudience,
+			"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+			"iat":   float64(time.Now().Add(-2 * time.Minute).Unix()),
+			"sub":   "user-123",
+			"email": "[email protected]",
+			"jti":   generateRandomString(16),
+		})
+		if err != nil {
+			t.Fatalf("Failed to create valid JWT: %v", err)
+		}
+
+		// Create a request with authenticated session
+		req := httptest.NewRequest("GET", "/protected", nil)
+		req.Header.Set("X-Forwarded-Proto", "https")
+		req.Header.Set("X-Forwarded-Host", "company.com")
+
+		// Create session with token
+		resp := httptest.NewRecorder()
+		session, err := sm.GetSession(req)
+		if err != nil {
+			t.Fatalf("Failed to get session: %v", err)
+		}
+
+		if err := session.SetAuthenticated(true); err != nil {
+			t.Fatalf("Failed to set authenticated: %v", err)
+		}
+		session.SetEmail("[email protected]")
+		session.SetIDToken(validJWT)
+		session.SetAccessToken(validJWT)
+
+		if err := session.Save(req, resp); err != nil {
+			t.Fatalf("Failed to save session: %v", err)
+		}
+
+		// Get cookies and add them to a new request
+		cookies := resp.Result().Cookies()
+		req = httptest.NewRequest("GET", "/protected", nil)
+		req.Header.Set("X-Forwarded-Proto", "https")
+		req.Header.Set("X-Forwarded-Host", "company.com")
+		for _, cookie := range cookies {
+			req.AddCookie(cookie)
+		}
+
+		resp = httptest.NewRecorder()
+		tOidc.ServeHTTP(resp, req)
+
+		if resp.Code != http.StatusOK {
+			t.Errorf("Expected status 200, got %d. Body: %s", resp.Code, resp.Body.String())
+		}
+	})
+}

auth/auth_handler.go

@@ -11,17 +11,24 @@ import (
 	"github.com/google/uuid"
 )
 
-// AuthHandler provides core authentication functionality for OIDC flows
-type AuthHandler struct {
-	logger         Logger
-	enablePKCE     bool
-	isGoogleProv   func() bool
-	isAzureProv    func() bool
-	clientID       string
-	authURL        string
-	issuerURL      string
-	scopes         []string
-	overrideScopes bool
+// ScopeFilter interface for filtering OAuth scopes based on provider capabilities
+type ScopeFilter interface {
+	FilterSupportedScopes(requestedScopes, supportedScopes []string, providerURL string) []string
+}
+
+// Handler provides core authentication functionality for OIDC flows
+type Handler struct {
+	logger          Logger
+	enablePKCE      bool
+	isGoogleProv    func() bool
+	isAzureProv     func() bool
+	clientID        string
+	authURL         string
+	issuerURL       string
+	scopes          []string
+	overrideScopes  bool
+	scopeFilter     ScopeFilter // NEW
+	scopesSupported []string    // NEW - from provider metadata
 }
 
 // Logger interface for dependency injection
@@ -30,29 +37,31 @@ type Logger interface {
 	Errorf(format string, args ...interface{})
 }
 
-// NewAuthHandler creates a new AuthHandler instance
+// NewAuthHandler creates a new Handler instance
 func NewAuthHandler(logger Logger, enablePKCE bool, isGoogleProv, isAzureProv func() bool,
-	clientID, authURL, issuerURL string, scopes []string, overrideScopes bool) *AuthHandler {
-	return &AuthHandler{
-		logger:         logger,
-		enablePKCE:     enablePKCE,
-		isGoogleProv:   isGoogleProv,
-		isAzureProv:    isAzureProv,
-		clientID:       clientID,
-		authURL:        authURL,
-		issuerURL:      issuerURL,
-		scopes:         scopes,
-		overrideScopes: overrideScopes,
+	clientID, authURL, issuerURL string, scopes []string, overrideScopes bool,
+	scopeFilter ScopeFilter, scopesSupported []string) *Handler {
+	return &Handler{
+		logger:          logger,
+		enablePKCE:      enablePKCE,
+		isGoogleProv:    isGoogleProv,
+		isAzureProv:     isAzureProv,
+		clientID:        clientID,
+		authURL:         authURL,
+		issuerURL:       issuerURL,
+		scopes:          scopes,
+		overrideScopes:  overrideScopes,
+		scopeFilter:     scopeFilter,     // NEW
+		scopesSupported: scopesSupported, // NEW
 	}
 }
 
 // InitiateAuthentication initiates the OIDC authentication flow.
 // It generates CSRF tokens, nonce, PKCE parameters (if enabled), clears the session,
 // stores authentication state, and redirects the user to the OIDC provider.
-func (h *AuthHandler) InitiateAuthentication(rw http.ResponseWriter, req *http.Request,
+func (h *Handler) InitiateAuthentication(rw http.ResponseWriter, req *http.Request,
 	session SessionData, redirectURL string,
 	generateNonce, generateCodeVerifier, deriveCodeChallenge func() (string, error)) {
-
 	h.logger.Debugf("Initiating new OIDC authentication flow for request: %s", req.URL.RequestURI())
 
 	const maxRedirects = 5
@@ -128,7 +137,7 @@ func (h *AuthHandler) InitiateAuthentication(rw http.ResponseWriter, req *http.R
 // BuildAuthURL constructs the OIDC provider authorization URL.
 // It builds the URL with all necessary parameters including client_id, scopes,
 // PKCE parameters, and provider-specific parameters for Google and Azure.
-func (h *AuthHandler) BuildAuthURL(redirectURL, state, nonce, codeChallenge string) string {
+func (h *Handler) BuildAuthURL(redirectURL, state, nonce, codeChallenge string) string {
 	params := url.Values{}
 	params.Set("client_id", h.clientID)
 	params.Set("response_type", "code")
@@ -144,49 +153,19 @@ func (h *AuthHandler) BuildAuthURL(redirectURL, state, nonce, codeChallenge stri
 	scopes := make([]string, len(h.scopes))
 	copy(scopes, h.scopes)
 
-	if h.isGoogleProv() {
-		params.Set("access_type", "offline")
-		h.logger.Debugf("Google OIDC provider detected, added access_type=offline for refresh tokens")
+	// Apply discovery-based scope filtering if available
+	if h.scopeFilter != nil && len(h.scopesSupported) > 0 {
+		scopes = h.scopeFilter.FilterSupportedScopes(scopes, h.scopesSupported, h.issuerURL)
+		h.logger.Debugf("AuthHandler.BuildAuthURL: After discovery filtering: %v", scopes)
+	}
 
-		params.Set("prompt", "consent")
-		h.logger.Debugf("Google OIDC provider detected, added prompt=consent to ensure refresh tokens")
-	} else if h.isAzureProv() {
-		params.Set("response_mode", "query")
-		h.logger.Debugf("Azure AD provider detected, added response_mode=query")
+	// Apply provider-specific modifications
+	scopes, params = h.applyProviderSpecificConfig(scopes, params)
 
-		hasOfflineAccess := false
-
-		for _, scope := range scopes {
-			if scope == "offline_access" {
-				hasOfflineAccess = true
-				break
-			}
-		}
-
-		if !h.overrideScopes || (h.overrideScopes && len(h.scopes) == 0) {
-			if !hasOfflineAccess {
-				scopes = append(scopes, "offline_access")
-				h.logger.Debugf("Azure AD provider: Added offline_access scope (overrideScopes: %t, user scopes count: %d)", h.overrideScopes, len(h.scopes))
-			}
-		} else {
-			h.logger.Debugf("Azure AD provider: User is overriding scopes (count: %d), offline_access not automatically added.", len(h.scopes))
-		}
-	} else {
-		if !h.overrideScopes || (h.overrideScopes && len(h.scopes) == 0) {
-			hasOfflineAccess := false
-			for _, scope := range scopes {
-				if scope == "offline_access" {
-					hasOfflineAccess = true
-					break
-				}
-			}
-			if !hasOfflineAccess {
-				scopes = append(scopes, "offline_access")
-				h.logger.Debugf("Standard provider: Added offline_access scope (overrideScopes: %t, user scopes count: %d)", h.overrideScopes, len(h.scopes))
-			}
-		} else {
-			h.logger.Debugf("Standard provider: User is overriding scopes (count: %d), offline_access not automatically added.", len(h.scopes))
-		}
+	// Final filtering pass to remove anything the provider doesn't support
+	if h.scopeFilter != nil && len(h.scopesSupported) > 0 {
+		scopes = h.scopeFilter.FilterSupportedScopes(scopes, h.scopesSupported, h.issuerURL)
+		h.logger.Debugf("AuthHandler.BuildAuthURL: After final filtering: %v", scopes)
 	}
 
 	if len(scopes) > 0 {
@@ -198,10 +177,80 @@ func (h *AuthHandler) BuildAuthURL(redirectURL, state, nonce, codeChallenge stri
 	return h.buildURLWithParams(h.authURL, params)
 }
 
+// applyProviderSpecificConfig applies provider-specific scope and parameter modifications
+func (h *Handler) applyProviderSpecificConfig(scopes []string, params url.Values) ([]string, url.Values) {
+	switch {
+	case h.isGoogleProv():
+		return h.applyGoogleConfig(scopes, params)
+	case h.isAzureProv():
+		return h.applyAzureConfig(scopes, params)
+	default:
+		return h.applyStandardProviderConfig(scopes, params)
+	}
+}
+
+// applyGoogleConfig applies Google-specific configuration
+func (h *Handler) applyGoogleConfig(scopes []string, params url.Values) ([]string, url.Values) {
+	// Google: Remove offline_access if present, add access_type=offline
+	filteredScopes := make([]string, 0, len(scopes))
+	for _, scope := range scopes {
+		if scope != "offline_access" {
+			filteredScopes = append(filteredScopes, scope)
+		}
+	}
+	params.Set("access_type", "offline")
+	h.logger.Debugf("Google OIDC provider detected, added access_type=offline")
+	params.Set("prompt", "consent")
+	h.logger.Debugf("Google OIDC provider detected, added prompt=consent to ensure refresh tokens")
+	return filteredScopes, params
+}
+
+// applyAzureConfig applies Azure AD-specific configuration
+func (h *Handler) applyAzureConfig(scopes []string, params url.Values) ([]string, url.Values) {
+	params.Set("response_mode", "query")
+	h.logger.Debugf("Azure AD provider detected, added response_mode=query")
+
+	if h.shouldAddOfflineAccess(scopes) {
+		scopes = append(scopes, "offline_access")
+		h.logger.Debugf("Azure AD provider: Added offline_access scope (overrideScopes: %t, user scopes count: %d)",
+			h.overrideScopes, len(h.scopes))
+	} else {
+		h.logger.Debugf("Azure AD provider: User is overriding scopes (count: %d), offline_access not automatically added.",
+			len(h.scopes))
+	}
+	return scopes, params
+}
+
+// applyStandardProviderConfig applies configuration for standard OIDC providers
+func (h *Handler) applyStandardProviderConfig(scopes []string, params url.Values) ([]string, url.Values) {
+	if h.shouldAddOfflineAccess(scopes) {
+		scopes = append(scopes, "offline_access")
+		h.logger.Debugf("Standard provider: Added offline_access scope (overrideScopes: %t, user scopes count: %d)",
+			h.overrideScopes, len(h.scopes))
+	} else {
+		h.logger.Debugf("Standard provider: User is overriding scopes (count: %d), offline_access not automatically added.",
+			len(h.scopes))
+	}
+	return scopes, params
+}
+
+// shouldAddOfflineAccess determines if offline_access scope should be added
+func (h *Handler) shouldAddOfflineAccess(scopes []string) bool {
+	if h.overrideScopes && len(h.scopes) > 0 {
+		return false
+	}
+	for _, scope := range scopes {
+		if scope == "offline_access" {
+			return false
+		}
+	}
+	return true
+}
+
 // buildURLWithParams constructs a URL by combining a base URL with query parameters.
 // It handles both relative and absolute URLs, validates URL security,
 // and properly encodes query parameters.
-func (h *AuthHandler) buildURLWithParams(baseURL string, params url.Values) string {
+func (h *Handler) buildURLWithParams(baseURL string, params url.Values) string {
 	if baseURL != "" {
 		if strings.HasPrefix(baseURL, "http://") || strings.HasPrefix(baseURL, "https://") {
 			if err := h.validateURL(baseURL); err != nil {
@@ -252,7 +301,7 @@ func (h *AuthHandler) buildURLWithParams(baseURL string, params url.Values) stri
 
 // validateURL performs security validation on URLs to prevent SSRF attacks.
 // It checks for allowed schemes, validates hosts, and prevents access to private networks.
-func (h *AuthHandler) validateURL(urlStr string) error {
+func (h *Handler) validateURL(urlStr string) error {
 	if urlStr == "" {
 		return fmt.Errorf("empty URL")
 	}
@@ -267,7 +316,7 @@ func (h *AuthHandler) validateURL(urlStr string) error {
 
 // validateParsedURL validates a parsed URL structure for security.
 // It checks schemes, hosts, and paths to prevent malicious URLs.
-func (h *AuthHandler) validateParsedURL(u *url.URL) error {
+func (h *Handler) validateParsedURL(u *url.URL) error {
 	allowedSchemes := map[string]bool{
 		"https": true,
 		"http":  true,
@@ -298,7 +347,7 @@ func (h *AuthHandler) validateParsedURL(u *url.URL) error {
 
 // validateHost validates a hostname for security and reachability.
 // It prevents access to private networks and localhost addresses.
-func (h *AuthHandler) validateHost(host string) error {
+func (h *Handler) validateHost(host string) error {
 	if host == "" {
 		return fmt.Errorf("empty host")
 	}

auth/auth_handler_test.go

@@ -22,6 +22,28 @@ func (l *mockLogger) Errorf(format string, args ...interface{}) {
 	l.errorMessages = append(l.errorMessages, format)
 }
 
+// mockScopeFilter is a mock implementation of the ScopeFilter interface for testing
+type mockScopeFilter struct{}
+
+func (m *mockScopeFilter) FilterSupportedScopes(requestedScopes, supportedScopes []string, providerURL string) []string {
+	// For testing, just return requested scopes if no supported scopes provided
+	if len(supportedScopes) == 0 {
+		return requestedScopes
+	}
+	// Simple filter logic for tests
+	filtered := make([]string, 0, len(requestedScopes))
+	supportedMap := make(map[string]bool)
+	for _, s := range supportedScopes {
+		supportedMap[s] = true
+	}
+	for _, s := range requestedScopes {
+		if supportedMap[s] {
+			filtered = append(filtered, s)
+		}
+	}
+	return filtered
+}
+
 type mockSessionData struct {
 	authenticated bool
 	email         string
@@ -64,7 +86,7 @@ func TestAuthHandler_NewAuthHandler(t *testing.T) {
 
 	handler := NewAuthHandler(logger, true, isGoogleProv, isAzureProv,
 		"test-client-id", "https://example.com/auth", "https://example.com",
-		scopes, false)
+		scopes, false, nil, nil)
 
 	if handler == nil {
 		t.Fatal("Expected handler to be created, got nil")
@@ -103,7 +125,7 @@ func TestAuthHandler_NewAuthHandler(t *testing.T) {
 func TestAuthHandler_InitiateAuthentication_MaxRedirects(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
-		"test-client", "https://example.com/auth", "https://example.com", []string{}, false)
+		"test-client", "https://example.com/auth", "https://example.com", []string{}, false, nil, nil)
 
 	session := &mockSessionData{redirectCount: 5} // At the limit
 	req := httptest.NewRequest("GET", "/test", nil)
@@ -138,7 +160,7 @@ func TestAuthHandler_InitiateAuthentication_MaxRedirects(t *testing.T) {
 func TestAuthHandler_InitiateAuthentication_NonceGenerationError(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
-		"test-client", "https://example.com/auth", "https://example.com", []string{}, false)
+		"test-client", "https://example.com/auth", "https://example.com", []string{}, false, nil, nil)
 
 	session := &mockSessionData{}
 	req := httptest.NewRequest("GET", "/test", nil)
@@ -169,7 +191,7 @@ func TestAuthHandler_InitiateAuthentication_NonceGenerationError(t *testing.T) {
 func TestAuthHandler_InitiateAuthentication_PKCECodeVerifierError(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, true, func() bool { return false }, func() bool { return false },
-		"test-client", "https://example.com/auth", "https://example.com", []string{}, false)
+		"test-client", "https://example.com/auth", "https://example.com", []string{}, false, nil, nil)
 
 	session := &mockSessionData{}
 	req := httptest.NewRequest("GET", "/test", nil)
@@ -200,7 +222,7 @@ func TestAuthHandler_InitiateAuthentication_PKCECodeVerifierError(t *testing.T)
 func TestAuthHandler_InitiateAuthentication_PKCECodeChallengeError(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, true, func() bool { return false }, func() bool { return false },
-		"test-client", "https://example.com/auth", "https://example.com", []string{}, false)
+		"test-client", "https://example.com/auth", "https://example.com", []string{}, false, nil, nil)
 
 	session := &mockSessionData{}
 	req := httptest.NewRequest("GET", "/test", nil)
@@ -231,7 +253,7 @@ func TestAuthHandler_InitiateAuthentication_PKCECodeChallengeError(t *testing.T)
 func TestAuthHandler_InitiateAuthentication_SessionSaveError(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
-		"test-client", "https://example.com/auth", "https://example.com", []string{}, false)
+		"test-client", "https://example.com/auth", "https://example.com", []string{}, false, nil, nil)
 
 	session := &mockSessionData{saveError: &testError{"save failed"}}
 	req := httptest.NewRequest("GET", "/test?param=value", nil)
@@ -275,7 +297,7 @@ func TestAuthHandler_InitiateAuthentication_SessionSaveError(t *testing.T) {
 func TestAuthHandler_InitiateAuthentication_Success(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, true, func() bool { return false }, func() bool { return false },
-		"test-client", "https://example.com/auth", "https://example.com", []string{"openid", "email"}, false)
+		"test-client", "https://example.com/auth", "https://example.com", []string{"openid", "email"}, false, nil, nil)
 
 	session := &mockSessionData{}
 	req := httptest.NewRequest("GET", "/protected/resource", nil)
@@ -378,7 +400,7 @@ func TestAuthHandler_BuildAuthURL_GoogleProvider(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, false, func() bool { return true }, func() bool { return false },
 		"google-client", "https://accounts.google.com/oauth2/auth", "https://accounts.google.com",
-		[]string{"openid", "profile", "email"}, false)
+		[]string{"openid", "profile", "email"}, false, nil, nil)
 
 	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
 
@@ -418,7 +440,7 @@ func TestAuthHandler_BuildAuthURL_AzureProvider(t *testing.T) {
 	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return true },
 		"azure-client", "https://login.microsoftonline.com/tenant/oauth2/v2.0/authorize",
 		"https://login.microsoftonline.com/tenant/v2.0",
-		[]string{"openid", "profile", "email"}, false)
+		[]string{"openid", "profile", "email"}, false, nil, nil)
 
 	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
 
@@ -446,7 +468,7 @@ func TestAuthHandler_BuildAuthURL_PKCEEnabled(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, true, func() bool { return false }, func() bool { return false },
 		"pkce-client", "https://example.com/auth", "https://example.com",
-		[]string{"openid"}, false)
+		[]string{"openid"}, false, nil, nil)
 
 	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "test-challenge")
 
@@ -471,7 +493,7 @@ func TestAuthHandler_BuildAuthURL_PKCEDisabled(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
 		"no-pkce-client", "https://example.com/auth", "https://example.com",
-		[]string{"openid"}, false)
+		[]string{"openid"}, false, nil, nil)
 
 	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "test-challenge")
 
@@ -543,7 +565,7 @@ func TestAuthHandler_BuildAuthURL_ScopeHandling(t *testing.T) {
 			logger := &mockLogger{}
 			handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return tt.isAzure },
 				"test-client", "https://example.com/auth", "https://example.com",
-				tt.scopes, tt.overrideScopes)
+				tt.scopes, tt.overrideScopes, nil, nil)
 
 			authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
 
@@ -597,3 +619,550 @@ type testError struct {
 func (e *testError) Error() string {
 	return e.message
 }
+
+// SCOPE FILTERING INTEGRATION TESTS
+
+// TestAuthHandler_BuildAuthURL_WithScopeFiltering tests scope filtering when enabled
+func TestAuthHandler_BuildAuthURL_WithScopeFiltering(t *testing.T) {
+	logger := &mockLogger{}
+	scopeFilter := &mockScopeFilter{}
+
+	// Requested scopes include offline_access
+	scopes := []string{"openid", "profile", "email", "offline_access"}
+	// Provider only supports these
+	scopesSupported := []string{"openid", "profile", "email"}
+
+	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
+		"test-client", "https://example.com/auth", "https://example.com",
+		scopes, false, scopeFilter, scopesSupported)
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	actualScope := parsedURL.Query().Get("scope")
+	actualScopes := strings.Split(actualScope, " ")
+
+	// offline_access should have been filtered out in the first pass
+	// The standard provider logic then tries to add it back
+	// But the final filtering pass removes it again
+	for _, scope := range actualScopes {
+		if scope == "offline_access" {
+			t.Error("offline_access should have been filtered out when not in scopesSupported")
+		}
+	}
+
+	// Should contain the supported scopes
+	if !strings.Contains(actualScope, "openid") {
+		t.Error("Expected openid in final scope string")
+	}
+	if !strings.Contains(actualScope, "profile") {
+		t.Error("Expected profile in final scope string")
+	}
+	if !strings.Contains(actualScope, "email") {
+		t.Error("Expected email in final scope string")
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_WithoutScopeFiltering tests backward compatibility
+func TestAuthHandler_BuildAuthURL_WithoutScopeFiltering(t *testing.T) {
+	logger := &mockLogger{}
+
+	scopes := []string{"openid", "profile", "email"}
+	// No scopeFilter or scopesSupported (backward compatibility)
+
+	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
+		"test-client", "https://example.com/auth", "https://example.com",
+		scopes, false, nil, nil)
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	actualScope := parsedURL.Query().Get("scope")
+
+	// All scopes should be present, plus offline_access added by standard provider logic
+	if !strings.Contains(actualScope, "openid") {
+		t.Error("Expected openid in scope string")
+	}
+	if !strings.Contains(actualScope, "profile") {
+		t.Error("Expected profile in scope string")
+	}
+	if !strings.Contains(actualScope, "email") {
+		t.Error("Expected email in scope string")
+	}
+	if !strings.Contains(actualScope, "offline_access") {
+		t.Error("Expected offline_access added by standard provider logic")
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_GitLabFiltersOfflineAccess tests GitLab scenario
+func TestAuthHandler_BuildAuthURL_GitLabFiltersOfflineAccess(t *testing.T) {
+	logger := &mockLogger{}
+	scopeFilter := &mockScopeFilter{}
+
+	scopes := []string{"openid", "profile", "email", "offline_access"}
+	// GitLab discovery doc doesn't include offline_access
+	scopesSupported := []string{"openid", "profile", "email", "read_user", "read_api"}
+
+	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
+		"gitlab-client", "https://gitlab.example.com/oauth/authorize",
+		"https://gitlab.example.com",
+		scopes, false, scopeFilter, scopesSupported)
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	actualScope := parsedURL.Query().Get("scope")
+	actualScopes := strings.Split(actualScope, " ")
+
+	// offline_access should be filtered out
+	for _, scope := range actualScopes {
+		if scope == "offline_access" {
+			t.Error("GitLab scenario: offline_access should have been filtered out")
+		}
+	}
+
+	// Should contain standard scopes
+	if !strings.Contains(actualScope, "openid") {
+		t.Error("Expected openid in final scope string")
+	}
+	if !strings.Contains(actualScope, "profile") {
+		t.Error("Expected profile in final scope string")
+	}
+	if !strings.Contains(actualScope, "email") {
+		t.Error("Expected email in final scope string")
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_GoogleRemovesOfflineAccess tests Google provider
+func TestAuthHandler_BuildAuthURL_GoogleRemovesOfflineAccess(t *testing.T) {
+	logger := &mockLogger{}
+	scopeFilter := &mockScopeFilter{}
+
+	scopes := []string{"openid", "profile", "email", "offline_access"}
+	scopesSupported := []string{"openid", "profile", "email"}
+
+	handler := NewAuthHandler(logger, false, func() bool { return true }, func() bool { return false },
+		"google-client", "https://accounts.google.com/o/oauth2/v2/auth",
+		"https://accounts.google.com",
+		scopes, false, scopeFilter, scopesSupported)
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	query := parsedURL.Query()
+	actualScope := query.Get("scope")
+	actualScopes := strings.Split(actualScope, " ")
+
+	// Google removes offline_access and uses access_type=offline instead
+	for _, scope := range actualScopes {
+		if scope == "offline_access" {
+			t.Error("Google scenario: offline_access should have been removed by Google-specific logic")
+		}
+	}
+
+	// Google-specific parameters should be present
+	if query.Get("access_type") != "offline" {
+		t.Error("Expected access_type=offline for Google")
+	}
+	if query.Get("prompt") != "consent" {
+		t.Error("Expected prompt=consent for Google")
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_AzureAddsOfflineAccess tests Azure provider
+func TestAuthHandler_BuildAuthURL_AzureAddsOfflineAccess(t *testing.T) {
+	logger := &mockLogger{}
+	scopeFilter := &mockScopeFilter{}
+
+	scopes := []string{"openid", "profile", "email"}
+	// Azure supports offline_access
+	scopesSupported := []string{"openid", "profile", "email", "offline_access"}
+
+	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return true },
+		"azure-client", "https://login.microsoftonline.com/tenant/oauth2/v2.0/authorize",
+		"https://login.microsoftonline.com/tenant/v2.0",
+		scopes, false, scopeFilter, scopesSupported)
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	query := parsedURL.Query()
+	actualScope := query.Get("scope")
+
+	// Azure should add offline_access automatically and it should pass filtering
+	if !strings.Contains(actualScope, "offline_access") {
+		t.Error("Azure scenario: offline_access should be present")
+	}
+
+	// Azure-specific parameter
+	if query.Get("response_mode") != "query" {
+		t.Error("Expected response_mode=query for Azure")
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_GenericWithFiltering tests generic provider with discovery filtering
+func TestAuthHandler_BuildAuthURL_GenericWithFiltering(t *testing.T) {
+	logger := &mockLogger{}
+	scopeFilter := &mockScopeFilter{}
+
+	scopes := []string{"openid", "profile", "email", "custom_scope", "offline_access"}
+	scopesSupported := []string{"openid", "profile", "email", "custom_scope"}
+
+	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
+		"generic-client", "https://auth.provider.com/authorize",
+		"https://auth.provider.com",
+		scopes, false, scopeFilter, scopesSupported)
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	actualScope := parsedURL.Query().Get("scope")
+
+	// Should contain supported scopes including custom_scope
+	if !strings.Contains(actualScope, "openid") {
+		t.Error("Expected openid in scope string")
+	}
+	if !strings.Contains(actualScope, "custom_scope") {
+		t.Error("Expected custom_scope in scope string")
+	}
+
+	// offline_access should be filtered out (not in scopesSupported)
+	actualScopes := strings.Split(actualScope, " ")
+	for _, scope := range actualScopes {
+		if scope == "offline_access" {
+			t.Error("offline_access should have been filtered out when not supported")
+		}
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_OverrideScopesWithFiltering tests override scopes + filtering
+func TestAuthHandler_BuildAuthURL_OverrideScopesWithFiltering(t *testing.T) {
+	logger := &mockLogger{}
+	scopeFilter := &mockScopeFilter{}
+
+	// User explicitly overrides scopes
+	scopes := []string{"openid", "custom:read", "custom:write"}
+	scopesSupported := []string{"openid", "custom:read"}
+
+	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
+		"test-client", "https://example.com/auth", "https://example.com",
+		scopes, true, scopeFilter, scopesSupported)
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	actualScope := parsedURL.Query().Get("scope")
+	actualScopes := strings.Split(actualScope, " ")
+
+	// Should contain only supported scopes from override
+	if !strings.Contains(actualScope, "openid") {
+		t.Error("Expected openid in scope string")
+	}
+	if !strings.Contains(actualScope, "custom:read") {
+		t.Error("Expected custom:read in scope string")
+	}
+
+	// custom:write should be filtered out
+	for _, scope := range actualScopes {
+		if scope == "custom:write" {
+			t.Error("custom:write should have been filtered out (not supported)")
+		}
+	}
+
+	// offline_access should NOT be auto-added when overrideScopes=true
+	for _, scope := range actualScopes {
+		if scope == "offline_access" {
+			t.Error("offline_access should not be auto-added when user overrides scopes")
+		}
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_DoubleFiltering tests initial + final filtering passes
+func TestAuthHandler_BuildAuthURL_DoubleFiltering(t *testing.T) {
+	logger := &mockLogger{}
+	scopeFilter := &mockScopeFilter{}
+
+	scopes := []string{"openid", "profile", "email"}
+	// Provider supports offline_access
+	scopesSupported := []string{"openid", "profile", "email", "offline_access"}
+
+	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
+		"test-client", "https://example.com/auth", "https://example.com",
+		scopes, false, scopeFilter, scopesSupported)
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	actualScope := parsedURL.Query().Get("scope")
+
+	// Initial filtering: All requested scopes pass (all in scopesSupported)
+	// Provider-specific logic: Adds offline_access (standard provider)
+	// Final filtering: offline_access should still be present (it's in scopesSupported)
+	if !strings.Contains(actualScope, "offline_access") {
+		t.Error("offline_access should be present (supported by provider and added by logic)")
+	}
+
+	// Original scopes should be present
+	if !strings.Contains(actualScope, "openid") {
+		t.Error("Expected openid in scope string")
+	}
+	if !strings.Contains(actualScope, "profile") {
+		t.Error("Expected profile in scope string")
+	}
+	if !strings.Contains(actualScope, "email") {
+		t.Error("Expected email in scope string")
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_NoScopeFilterProvided tests when scopeFilter is nil
+func TestAuthHandler_BuildAuthURL_NoScopeFilterProvided(t *testing.T) {
+	logger := &mockLogger{}
+
+	scopes := []string{"openid", "profile", "email"}
+	scopesSupported := []string{"openid", "profile"} // Even with scopesSupported, no filter
+
+	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
+		"test-client", "https://example.com/auth", "https://example.com",
+		scopes, false, nil, scopesSupported) // scopeFilter is nil
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	actualScope := parsedURL.Query().Get("scope")
+
+	// Without scopeFilter, all scopes should be present (no filtering)
+	if !strings.Contains(actualScope, "openid") {
+		t.Error("Expected openid in scope string")
+	}
+	if !strings.Contains(actualScope, "profile") {
+		t.Error("Expected profile in scope string")
+	}
+	if !strings.Contains(actualScope, "email") {
+		t.Error("Expected email in scope string (no filtering without scopeFilter)")
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_EmptyScopesSupported tests empty scopesSupported list
+func TestAuthHandler_BuildAuthURL_EmptyScopesSupported(t *testing.T) {
+	logger := &mockLogger{}
+	scopeFilter := &mockScopeFilter{}
+
+	scopes := []string{"openid", "profile", "email"}
+	scopesSupported := []string{} // Empty - backward compatibility mode
+
+	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
+		"test-client", "https://example.com/auth", "https://example.com",
+		scopes, false, scopeFilter, scopesSupported)
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	actualScope := parsedURL.Query().Get("scope")
+
+	// With empty scopesSupported, mockScopeFilter returns requested scopes unchanged
+	if !strings.Contains(actualScope, "openid") {
+		t.Error("Expected openid in scope string")
+	}
+	if !strings.Contains(actualScope, "profile") {
+		t.Error("Expected profile in scope string")
+	}
+	if !strings.Contains(actualScope, "email") {
+		t.Error("Expected email in scope string")
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_FilteringWithPKCE tests scope filtering with PKCE enabled
+func TestAuthHandler_BuildAuthURL_FilteringWithPKCE(t *testing.T) {
+	logger := &mockLogger{}
+	scopeFilter := &mockScopeFilter{}
+
+	scopes := []string{"openid", "profile", "offline_access"}
+	scopesSupported := []string{"openid", "profile"}
+
+	handler := NewAuthHandler(logger, true, func() bool { return false }, func() bool { return false },
+		"test-client", "https://example.com/auth", "https://example.com",
+		scopes, false, scopeFilter, scopesSupported)
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "test-challenge")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	query := parsedURL.Query()
+
+	// PKCE parameters should be present
+	if query.Get("code_challenge") != "test-challenge" {
+		t.Error("Expected code_challenge parameter with PKCE enabled")
+	}
+	if query.Get("code_challenge_method") != "S256" {
+		t.Error("Expected code_challenge_method=S256 with PKCE enabled")
+	}
+
+	// Scope filtering should still work
+	actualScope := query.Get("scope")
+	actualScopes := strings.Split(actualScope, " ")
+
+	for _, scope := range actualScopes {
+		if scope == "offline_access" {
+			t.Error("offline_access should have been filtered out even with PKCE")
+		}
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_ComplexScenario tests realistic complex scenario
+func TestAuthHandler_BuildAuthURL_ComplexScenario(t *testing.T) {
+	logger := &mockLogger{}
+	scopeFilter := &mockScopeFilter{}
+
+	// User configures: openid, profile, email, custom:read, offline_access
+	scopes := []string{"openid", "profile", "email", "custom:read", "offline_access"}
+
+	// Provider discovery returns: openid, profile, email, custom:read, custom:write, admin:all
+	scopesSupported := []string{"openid", "profile", "email", "custom:read", "custom:write", "admin:all"}
+
+	handler := NewAuthHandler(logger, true, func() bool { return false }, func() bool { return false },
+		"complex-client", "https://auth.complex.com/authorize", "https://auth.complex.com",
+		scopes, false, scopeFilter, scopesSupported)
+
+	authURL := handler.BuildAuthURL("https://example.com/callback", "state-123", "nonce-456", "challenge-789")
+
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("Failed to parse auth URL: %v", err)
+	}
+
+	query := parsedURL.Query()
+
+	// Verify basic OAuth parameters
+	if query.Get("client_id") != "complex-client" {
+		t.Error("Expected correct client_id")
+	}
+	if query.Get("response_type") != "code" {
+		t.Error("Expected response_type=code")
+	}
+	if query.Get("state") != "state-123" {
+		t.Error("Expected correct state")
+	}
+	if query.Get("nonce") != "nonce-456" {
+		t.Error("Expected correct nonce")
+	}
+
+	// Verify PKCE parameters
+	if query.Get("code_challenge") != "challenge-789" {
+		t.Error("Expected correct code_challenge")
+	}
+
+	// Verify scope filtering
+	actualScope := query.Get("scope")
+
+	// Should contain: openid, profile, email, custom:read
+	if !strings.Contains(actualScope, "openid") {
+		t.Error("Expected openid in scope")
+	}
+	if !strings.Contains(actualScope, "profile") {
+		t.Error("Expected profile in scope")
+	}
+	if !strings.Contains(actualScope, "email") {
+		t.Error("Expected email in scope")
+	}
+	if !strings.Contains(actualScope, "custom:read") {
+		t.Error("Expected custom:read in scope")
+	}
+
+	// offline_access should be filtered (not in scopesSupported)
+	actualScopes := strings.Split(actualScope, " ")
+	for _, scope := range actualScopes {
+		if scope == "offline_access" {
+			t.Error("offline_access should have been filtered (not in scopesSupported)")
+		}
+	}
+}
+
+// TestAuthHandler_BuildAuthURL_LoggingVerification tests that logging occurs correctly
+func TestAuthHandler_BuildAuthURL_LoggingVerification(t *testing.T) {
+	logger := &mockLogger{}
+	scopeFilter := &mockScopeFilter{}
+
+	scopes := []string{"openid", "profile", "offline_access"}
+	scopesSupported := []string{"openid", "profile"}
+
+	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
+		"test-client", "https://example.com/auth", "https://example.com",
+		scopes, false, scopeFilter, scopesSupported)
+
+	handler.BuildAuthURL("https://example.com/callback", "test-state", "test-nonce", "")
+
+	// Should have logged debug messages about filtering
+	if len(logger.debugMessages) == 0 {
+		t.Error("Expected debug messages to be logged during scope filtering")
+	}
+
+	// Verify specific log messages were generated
+	hasDiscoveryFilterLog := false
+	hasFinalFilterLog := false
+	hasFinalScopeLog := false
+
+	for _, msg := range logger.debugMessages {
+		if strings.Contains(msg, "After discovery filtering") {
+			hasDiscoveryFilterLog = true
+		}
+		if strings.Contains(msg, "After final filtering") {
+			hasFinalFilterLog = true
+		}
+		if strings.Contains(msg, "Final scope string being sent") {
+			hasFinalScopeLog = true
+		}
+	}
+
+	if !hasDiscoveryFilterLog {
+		t.Error("Expected log message about discovery filtering")
+	}
+	if !hasFinalFilterLog {
+		t.Error("Expected log message about final filtering")
+	}
+	if !hasFinalScopeLog {
+		t.Error("Expected log message about final scope string")
+	}
+}

auth/url_validation_test.go

@@ -10,7 +10,7 @@ import (
 func TestAuthHandler_validateURL(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
-		"test-client", "https://example.com/auth", "https://example.com", []string{}, false)
+		"test-client", "https://example.com/auth", "https://example.com", []string{}, false, nil, nil)
 
 	tests := []struct {
 		name    string
@@ -185,7 +185,7 @@ func TestAuthHandler_validateURL(t *testing.T) {
 func TestAuthHandler_validateHost(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
-		"test-client", "https://example.com/auth", "https://example.com", []string{}, false)
+		"test-client", "https://example.com/auth", "https://example.com", []string{}, false, nil, nil)
 
 	tests := []struct {
 		name    string
@@ -334,7 +334,7 @@ func TestAuthHandler_validateHost(t *testing.T) {
 func TestAuthHandler_buildURLWithParams(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
-		"test-client", "https://example.com/auth", "https://example.com", []string{}, false)
+		"test-client", "https://example.com/auth", "https://example.com", []string{}, false, nil, nil)
 
 	tests := []struct {
 		name        string
@@ -438,7 +438,7 @@ func TestAuthHandler_buildURLWithParams(t *testing.T) {
 func TestAuthHandler_buildURLWithParams_ParameterEncoding(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
-		"test-client", "https://example.com/auth", "https://example.com", []string{}, false)
+		"test-client", "https://example.com/auth", "https://example.com", []string{}, false, nil, nil)
 
 	// Test special characters that need encoding
 	params := url.Values{
@@ -477,7 +477,7 @@ func TestAuthHandler_buildURLWithParams_ParameterEncoding(t *testing.T) {
 func TestAuthHandler_validateParsedURL(t *testing.T) {
 	logger := &mockLogger{}
 	handler := NewAuthHandler(logger, false, func() bool { return false }, func() bool { return false },
-		"test-client", "https://example.com/auth", "https://example.com", []string{}, false)
+		"test-client", "https://example.com/auth", "https://example.com", []string{}, false, nil, nil)
 
 	tests := []struct {
 		name    string

auth0_audience_test.go

@@ -0,0 +1,428 @@
+// Package traefikoidc provides OIDC authentication middleware for Traefik.
+// This file contains tests for Auth0-specific audience validation scenarios.
+package traefikoidc
+
+import (
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+// TestAuth0Scenario1WithCustomAudience tests Auth0 scenario 1:
+// - Custom audience configured in plugin
+// - Authorize endpoint called WITH audience parameter
+// - ID token: aud = client_id
+// - Access token: aud = [userinfo, custom_audience]
+// Expected: Both tokens validate correctly
+func TestAuth0Scenario1WithCustomAudience(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	customAudience := "https://my-api.example.com"
+	ts.tOidc.audience = customAudience
+
+	// Create ID token with aud = client_id (OIDC standard)
+	idToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss":   "https://test-issuer.com",
+		"aud":   "test-client-id",       // ID token always has client_id
+		"nonce": "test-nonce-scenario1", // ID tokens have nonce per OIDC spec
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Unix()),
+		"sub":   "test-user",
+		"email": "[email protected]",
+		"jti":   "id-token-jti",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create ID token: %v", err)
+	}
+
+	// Create access token with aud = [userinfo, custom_audience]
+	accessToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss": "https://test-issuer.com",
+		"aud": []interface{}{
+			"https://test-issuer.com/userinfo",
+			customAudience, // Custom API audience
+		},
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Unix()),
+		"sub":   "test-user",
+		"scope": "openid profile email read:data", // Access tokens have scope
+		"jti":   "access-token-jti",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create access token: %v", err)
+	}
+
+	// Verify ID token validates against client_id
+	cleanupReplayCache()
+	initReplayCache()
+	err = ts.tOidc.VerifyToken(idToken)
+	if err != nil {
+		t.Errorf("ID token validation failed (should validate against client_id): %v", err)
+	}
+
+	// Verify access token validates against custom audience
+	cleanupReplayCache()
+	initReplayCache()
+	err = ts.tOidc.VerifyToken(accessToken)
+	if err != nil {
+		t.Errorf("Access token validation failed (should validate against custom audience): %v", err)
+	}
+
+	// Verify buildAuthURL includes audience parameter (URL-encoded)
+	authURL := ts.tOidc.buildAuthURL("https://example.com/callback", "state", "nonce", "")
+	if !strings.Contains(authURL, "audience=") {
+		t.Errorf("Auth URL should contain audience parameter when custom audience is configured, got: %s", authURL)
+	}
+	// Verify the audience is properly URL-encoded (contains %3A for :, %2F for /)
+	if !strings.Contains(authURL, "audience=https%3A%2F%2Fmy-api.example.com") {
+		t.Errorf("Auth URL should contain URL-encoded custom audience, got: %s", authURL)
+	}
+}
+
+// TestAuth0Scenario2DefaultAudience tests Auth0 scenario 2:
+// - No custom audience configured (defaults to client_id)
+// - Authorize endpoint called WITHOUT audience parameter
+// - ID token: aud = client_id
+// - Access token: aud = [userinfo, default_audience] (no client_id)
+// Expected: ID token validates, access token falls back to ID token validation
+func TestAuth0Scenario2DefaultAudience(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// No custom audience - defaults to client_id
+	ts.tOidc.audience = ts.tOidc.clientID
+
+	// Create ID token with aud = client_id
+	idToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss":   "https://test-issuer.com",
+		"aud":   "test-client-id",
+		"nonce": "test-nonce-scenario2", // ID tokens have nonce per OIDC spec
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Unix()),
+		"sub":   "test-user",
+		"email": "[email protected]",
+		"jti":   "id-token-jti-2",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create ID token: %v", err)
+	}
+
+	// Create access token with aud = [userinfo, some_default_audience]
+	// This represents Auth0's default audience behavior
+	accessToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss": "https://test-issuer.com",
+		"aud": []interface{}{
+			"https://test-issuer.com/userinfo",
+			"https://test-issuer.com/api/v2/", // Default Auth0 Management API
+		},
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Unix()),
+		"sub":   "test-user",
+		"scope": "openid profile email",
+		"jti":   "access-token-jti-2",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create access token: %v", err)
+	}
+
+	// Verify ID token validates
+	cleanupReplayCache()
+	initReplayCache()
+	err = ts.tOidc.VerifyToken(idToken)
+	if err != nil {
+		t.Errorf("ID token validation failed: %v", err)
+	}
+
+	// Access token won't have client_id in aud, so it will fail validation
+	// This is expected for scenario 2 - the session validation relies on ID token
+	cleanupReplayCache()
+	initReplayCache()
+	err = ts.tOidc.VerifyToken(accessToken)
+	if err == nil {
+		t.Logf("Access token validation passed (unexpected but OK if client_id is in aud array)")
+	} else {
+		// Expected failure - access token doesn't have client_id in aud
+		t.Logf("Access token validation failed as expected (aud doesn't contain client_id): %v", err)
+	}
+
+	// Verify buildAuthURL does NOT include audience parameter (since audience == client_id)
+	authURL := ts.tOidc.buildAuthURL("https://example.com/callback", "state", "nonce", "")
+	if strings.Contains(authURL, "audience=") {
+		t.Errorf("Auth URL should NOT contain audience parameter when audience equals client_id, got: %s", authURL)
+	}
+}
+
+// TestAuth0Scenario3OpaqueAccessToken tests Auth0 scenario 3:
+// - No custom audience configured
+// - No default audience in Auth0
+// - ID token: aud = client_id
+// - Access token: opaque (not JWT)
+// Expected: ID token validates, opaque access token is accepted
+func TestAuth0Scenario3OpaqueAccessToken(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Enable opaque tokens for this scenario (Option C requirement)
+	ts.tOidc.allowOpaqueTokens = true
+
+	// No custom audience
+	ts.tOidc.audience = ts.tOidc.clientID
+
+	// Create ID token
+	idToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss":   "https://test-issuer.com",
+		"aud":   "test-client-id",
+		"nonce": "test-nonce-scenario3", // ID tokens have nonce per OIDC spec
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Unix()),
+		"sub":   "test-user",
+		"email": "[email protected]",
+		"jti":   "id-token-jti-3",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create ID token: %v", err)
+	}
+
+	// Opaque access token (not a JWT - just a random string)
+	opaqueAccessToken := "opaque_access_token_random_string_12345"
+
+	// Verify ID token validates
+	cleanupReplayCache()
+	initReplayCache()
+	err = ts.tOidc.VerifyToken(idToken)
+	if err != nil {
+		t.Errorf("ID token validation failed: %v", err)
+	}
+
+	// Opaque access token should fail JWT validation (expected)
+	err = ts.tOidc.VerifyToken(opaqueAccessToken)
+	if err == nil {
+		t.Error("Opaque access token should fail JWT validation")
+	} else {
+		t.Logf("Opaque access token correctly rejected by JWT validator: %v", err)
+	}
+
+	// Test that validateStandardTokens handles opaque tokens correctly
+	// by falling back to ID token validation
+	req := httptest.NewRequest("GET", "https://example.com/test", nil)
+
+	session, err := ts.tOidc.sessionManager.GetSession(req)
+	if err != nil {
+		t.Fatalf("Failed to get session: %v", err)
+	}
+
+	session.SetAuthenticated(true)
+	session.SetAccessToken(opaqueAccessToken)
+	session.SetIDToken(idToken)
+
+	authenticated, needsRefresh, expired := ts.tOidc.validateStandardTokens(session)
+	if !authenticated || needsRefresh || expired {
+		t.Errorf("Session with opaque access token and valid ID token should be authenticated. Got: auth=%v, refresh=%v, expired=%v",
+			authenticated, needsRefresh, expired)
+	}
+}
+
+// TestAuth0AudienceArrayValidation tests that audience validation
+// correctly handles array audiences (common in Auth0)
+func TestAuth0AudienceArrayValidation(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	customAudience := "https://my-api.example.com"
+	ts.tOidc.audience = customAudience
+
+	// Access token with audience as array containing our custom audience
+	accessToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss": "https://test-issuer.com",
+		"aud": []interface{}{
+			"https://test-issuer.com/userinfo",
+			customAudience,
+			"https://another-api.example.com",
+		},
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Unix()),
+		"sub":   "test-user",
+		"scope": "openid profile email read:data write:data",
+		"jti":   "array-aud-token-jti",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create access token: %v", err)
+	}
+
+	// Should validate successfully - custom audience is in the array
+	cleanupReplayCache()
+	initReplayCache()
+	err = ts.tOidc.VerifyToken(accessToken)
+	if err != nil {
+		t.Errorf("Access token with audience array should validate when custom audience is present: %v", err)
+	}
+}
+
+// TestAuth0MismatchedAudience tests that tokens with wrong audience fail validation
+func TestAuth0MismatchedAudience(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	customAudience := "https://my-api.example.com"
+	ts.tOidc.audience = customAudience
+
+	// Access token with WRONG audience
+	accessToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss": "https://test-issuer.com",
+		"aud": []interface{}{
+			"https://test-issuer.com/userinfo",
+			"https://different-api.example.com", // Wrong audience
+		},
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Unix()),
+		"sub":   "test-user",
+		"scope": "openid profile email",
+		"jti":   "wrong-aud-token-jti",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create access token: %v", err)
+	}
+
+	// Should fail validation - audience doesn't match
+	cleanupReplayCache()
+	initReplayCache()
+	err = ts.tOidc.VerifyToken(accessToken)
+	if err == nil {
+		t.Error("Access token with wrong audience should fail validation")
+	} else if !strings.Contains(err.Error(), "invalid audience") {
+		t.Errorf("Expected 'invalid audience' error, got: %v", err)
+	}
+}
+
+// TestAuth0Scenario2StrictMode tests strict audience validation mode:
+// - Scenario 2 (access token with wrong audience) should be REJECTED
+// - strictAudienceValidation=true prevents fallback to ID token
+// - This addresses Allan's security concerns about audience bypass
+func TestAuth0Scenario2StrictMode(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Enable strict mode to prevent Scenario 2 bypass (Option C)
+	ts.tOidc.strictAudienceValidation = true
+
+	// Configure custom audience
+	customAudience := "https://my-api.example.com"
+	ts.tOidc.audience = customAudience
+
+	// Create ID token with aud = client_id (valid)
+	idToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss":   "https://test-issuer.com",
+		"aud":   "test-client-id",
+		"nonce": "test-nonce-strict",
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Unix()),
+		"sub":   "test-user",
+		"email": "[email protected]",
+		"jti":   "id-token-strict-jti",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create ID token: %v", err)
+	}
+
+	// Create access token with WRONG audience (doesn't include custom audience)
+	accessToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss": "https://test-issuer.com",
+		"aud": []interface{}{
+			"https://test-issuer.com/userinfo",
+			"https://wrong-api.example.com", // Wrong audience - not our custom audience
+		},
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Unix()),
+		"sub":   "test-user",
+		"scope": "openid profile email",
+		"jti":   "access-token-strict-jti",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create access token: %v", err)
+	}
+
+	// Test session validation with wrong access token and valid ID token
+	req := httptest.NewRequest("GET", "https://example.com/test", nil)
+	session, err := ts.tOidc.sessionManager.GetSession(req)
+	if err != nil {
+		t.Fatalf("Failed to get session: %v", err)
+	}
+
+	session.SetAuthenticated(true)
+	session.SetAccessToken(accessToken)
+	session.SetIDToken(idToken)
+	session.SetRefreshToken("test-refresh-token") // Add refresh token so it can attempt refresh
+
+	// In strict mode, this should FAIL (no fallback to ID token)
+	authenticated, needsRefresh, expired := ts.tOidc.validateStandardTokens(session)
+	if authenticated {
+		t.Errorf("Strict mode: Session with wrong access token audience should be rejected, but got authenticated=true")
+	}
+	if !needsRefresh {
+		t.Errorf("Strict mode: Should signal refresh needed after rejection, got needsRefresh=%v", needsRefresh)
+	}
+	if expired {
+		t.Errorf("Strict mode: Should not mark as expired (should try refresh first), got expired=%v", expired)
+	}
+
+	t.Logf("✓ Strict mode correctly rejected Scenario 2 (access token audience mismatch)")
+}
+
+// TestIDTokenAlwaysValidatesAgainstClientID verifies that ID tokens
+// are ALWAYS validated against client_id, regardless of configured audience
+func TestIDTokenAlwaysValidatesAgainstClientID(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Configure a custom audience different from client_id
+	customAudience := "https://my-api.example.com"
+	ts.tOidc.audience = customAudience
+
+	// Create ID token with aud = client_id (per OIDC spec)
+	idToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss":   "https://test-issuer.com",
+		"aud":   "test-client-id", // ID token MUST have client_id
+		"nonce": "test-nonce-123", // ID tokens have nonce for replay protection
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Unix()),
+		"sub":   "test-user",
+		"email": "[email protected]",
+		"jti":   "id-token-client-id-jti",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create ID token: %v", err)
+	}
+
+	// Should validate successfully - ID tokens are checked against client_id
+	cleanupReplayCache()
+	initReplayCache()
+	err = ts.tOidc.VerifyToken(idToken)
+	if err != nil {
+		t.Errorf("ID token should validate against client_id even when custom audience is configured: %v", err)
+	}
+
+	// Create ID token with WRONG audience (should fail)
+	wrongIDToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
+		"iss":   "https://test-issuer.com",
+		"aud":   customAudience,         // WRONG - should be client_id
+		"nonce": "test-nonce-wrong-456", // ID token has nonce, so it will be detected as ID token
+		"exp":   float64(time.Now().Add(1 * time.Hour).Unix()),
+		"iat":   float64(time.Now().Unix()),
+		"sub":   "test-user",
+		"email": "[email protected]",
+		"jti":   "wrong-id-token-jti",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create wrong ID token: %v", err)
+	}
+
+	// Should fail - ID tokens must have client_id as audience
+	cleanupReplayCache()
+	initReplayCache()
+	err = ts.tOidc.VerifyToken(wrongIDToken)
+	if err == nil {
+		t.Error("ID token with custom audience (not client_id) should fail validation")
+	}
+}

auth_flow.go

@@ -47,7 +47,7 @@ func (t *TraefikOidc) generatePKCEParameters() (string, string, error) {
 // prepareSessionForAuthentication clears existing session data and sets new authentication state
 func (t *TraefikOidc) prepareSessionForAuthentication(session *SessionData, csrfToken, nonce, codeVerifier, incomingPath string) {
 	// Clear all existing session data
-	session.SetAuthenticated(false)
+	_ = session.SetAuthenticated(false) // Safe to ignore: clearing authentication state on new flow
 	session.SetEmail("")
 	session.SetAccessToken("")
 	session.SetRefreshToken("")
@@ -276,7 +276,7 @@ func (t *TraefikOidc) handleCallback(rw http.ResponseWriter, req *http.Request,
 //   - redirectURL: The callback URL to be used in the new authentication flow.
 func (t *TraefikOidc) handleExpiredToken(rw http.ResponseWriter, req *http.Request, session *SessionData, redirectURL string) {
 	t.logger.Debug("Handling expired token: Clearing session and initiating re-authentication.")
-	session.SetAuthenticated(false)
+	_ = session.SetAuthenticated(false) // Safe to ignore: clearing authentication on expired token
 	session.SetIDToken("")
 	session.SetAccessToken("")
 	session.SetRefreshToken("")

auth_flow_pkce_test.go

@@ -0,0 +1,101 @@
+package traefikoidc
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestGeneratePKCEParameters tests the generatePKCEParameters method
+func TestGeneratePKCEParameters(t *testing.T) {
+	t.Run("PKCE enabled - successful generation", func(t *testing.T) {
+		// Create a TraefikOidc instance with PKCE enabled
+		plugin := &TraefikOidc{
+			enablePKCE: true,
+			logger:     NewLogger("debug"),
+		}
+
+		verifier, challenge, err := plugin.generatePKCEParameters()
+
+		require.NoError(t, err)
+		assert.NotEmpty(t, verifier, "code verifier should not be empty when PKCE is enabled")
+		assert.NotEmpty(t, challenge, "code challenge should not be empty when PKCE is enabled")
+
+		// Verify the challenge is derived from the verifier
+		expectedChallenge := deriveCodeChallenge(verifier)
+		assert.Equal(t, expectedChallenge, challenge, "challenge should match derived challenge from verifier")
+	})
+
+	t.Run("PKCE disabled - returns empty strings", func(t *testing.T) {
+		// Create a TraefikOidc instance with PKCE disabled
+		plugin := &TraefikOidc{
+			enablePKCE: false,
+			logger:     NewLogger("debug"),
+		}
+
+		verifier, challenge, err := plugin.generatePKCEParameters()
+
+		require.NoError(t, err)
+		assert.Empty(t, verifier, "code verifier should be empty when PKCE is disabled")
+		assert.Empty(t, challenge, "code challenge should be empty when PKCE is disabled")
+	})
+
+	t.Run("PKCE enabled - generates different values each time", func(t *testing.T) {
+		plugin := &TraefikOidc{
+			enablePKCE: true,
+			logger:     NewLogger("debug"),
+		}
+
+		verifier1, challenge1, err1 := plugin.generatePKCEParameters()
+		require.NoError(t, err1)
+
+		verifier2, challenge2, err2 := plugin.generatePKCEParameters()
+		require.NoError(t, err2)
+
+		assert.NotEqual(t, verifier1, verifier2, "verifiers should be different")
+		assert.NotEqual(t, challenge1, challenge2, "challenges should be different")
+	})
+
+	t.Run("PKCE enabled - verifier and challenge relationship", func(t *testing.T) {
+		plugin := &TraefikOidc{
+			enablePKCE: true,
+			logger:     NewLogger("debug"),
+		}
+
+		verifier, challenge, err := plugin.generatePKCEParameters()
+		require.NoError(t, err)
+
+		// The challenge should always be derivable from the verifier
+		recalculatedChallenge := deriveCodeChallenge(verifier)
+		assert.Equal(t, challenge, recalculatedChallenge,
+			"challenge should always match the SHA256 hash of verifier")
+	})
+
+	t.Run("PKCE enabled - verifier meets RFC 7636 requirements", func(t *testing.T) {
+		plugin := &TraefikOidc{
+			enablePKCE: true,
+			logger:     NewLogger("debug"),
+		}
+
+		verifier, _, err := plugin.generatePKCEParameters()
+		require.NoError(t, err)
+
+		// RFC 7636 requires verifier to be 43-128 characters
+		assert.GreaterOrEqual(t, len(verifier), 43, "verifier should be at least 43 characters")
+		assert.LessOrEqual(t, len(verifier), 128, "verifier should be at most 128 characters")
+	})
+
+	t.Run("PKCE enabled - challenge meets RFC 7636 requirements", func(t *testing.T) {
+		plugin := &TraefikOidc{
+			enablePKCE: true,
+			logger:     NewLogger("debug"),
+		}
+
+		_, challenge, err := plugin.generatePKCEParameters()
+		require.NoError(t, err)
+
+		// SHA256 hash base64 encoded should be 43 characters
+		assert.Equal(t, 43, len(challenge), "S256 challenge should be exactly 43 characters")
+	})
+}

autocleanup.go

@@ -538,7 +538,7 @@ func (tr *TaskRegistry) CreateSingletonTask(name string, interval time.Duration,
 
 	// Start the task if not already running
 	if !rm.IsTaskRunning(name) {
-		rm.StartBackgroundTask(name)
+		_ = rm.StartBackgroundTask(name) // Safe to ignore: task registration succeeded, start is best-effort
 	}
 
 	// Get the task from resource manager's internal registry

azure_oidc_test.go

@@ -58,6 +58,7 @@ func TestAzureOIDCRegression(t *testing.T) {
 		tokenURL:              "https://login.microsoftonline.com/tenant-id/oauth2/v2.0/token",
 		jwksURL:               "https://login.microsoftonline.com/tenant-id/discovery/v2.0/keys",
 		clientID:              "test-client-id",
+		audience:              "test-client-id",
 		clientSecret:          "test-client-secret",
 		scopes:                []string{"openid", "profile", "email"},
 		refreshGracePeriod:    60 * time.Second,
@@ -78,7 +79,7 @@ func TestAzureOIDCRegression(t *testing.T) {
 	tOidc := &mockTraefikOidc{TraefikOidc: baseOidc}
 
 	// Initialize session manager
-	sessionManager, _ := NewSessionManager("test-encryption-key-32-bytes-long", false, "", mockLogger)
+	sessionManager, _ := NewSessionManager("test-encryption-key-32-bytes-long", false, "", "", 0, mockLogger)
 	tOidc.sessionManager = sessionManager
 
 	// Mock the JWT verification to avoid JWKS lookup issues

background_tasks_ultra_test.go

@@ -0,0 +1,536 @@
+package traefikoidc
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestMemoryMonitorComprehensive tests memory monitor edge cases
+func TestMemoryMonitorComprehensive(t *testing.T) {
+	t.Run("TriggerGC calls runtime GC", func(t *testing.T) {
+		thresholds := DefaultMemoryAlertThresholds()
+		monitor := NewMemoryMonitor(newNoOpLogger(), thresholds)
+
+		// Should not panic
+		assert.NotPanics(t, func() {
+			monitor.TriggerGC()
+		})
+	})
+
+	t.Run("GetMemoryPressure returns pressure level", func(t *testing.T) {
+		thresholds := DefaultMemoryAlertThresholds()
+		monitor := NewMemoryMonitor(newNoOpLogger(), thresholds)
+
+		// Initially should return None (no stats yet)
+		pressure := monitor.GetMemoryPressure()
+		assert.Equal(t, MemoryPressureNone, pressure)
+
+		// Collect stats to populate lastStats
+		monitor.GetCurrentStats()
+
+		// Now should return a valid pressure level
+		pressure = monitor.GetMemoryPressure()
+		assert.NotNil(t, pressure)
+	})
+
+	t.Run("StartMonitoring can be called", func(t *testing.T) {
+		ResetGlobalMemoryMonitor()
+		ResetGlobalTaskRegistry()
+		defer ResetGlobalMemoryMonitor()
+		defer ResetGlobalTaskRegistry()
+
+		thresholds := DefaultMemoryAlertThresholds()
+		monitor := NewMemoryMonitor(newNoOpLogger(), thresholds)
+
+		// Start monitoring should not panic
+		assert.NotPanics(t, func() {
+			ctx := context.Background()
+			monitor.StartMonitoring(ctx, 100*time.Millisecond)
+			time.Sleep(GetTestDuration(50 * time.Millisecond))
+		})
+
+		// Clean up
+		monitor.StopMonitoring()
+	})
+
+	t.Run("StopMonitoring can be called safely", func(t *testing.T) {
+		ResetGlobalMemoryMonitor()
+		defer ResetGlobalMemoryMonitor()
+
+		thresholds := DefaultMemoryAlertThresholds()
+		monitor := NewMemoryMonitor(newNoOpLogger(), thresholds)
+
+		// StopMonitoring should not panic even if not started
+		assert.NotPanics(t, func() {
+			monitor.StopMonitoring()
+		})
+
+		// Can be called multiple times safely
+		assert.NotPanics(t, func() {
+			monitor.StopMonitoring()
+			monitor.StopMonitoring()
+		})
+	})
+
+	t.Run("ResetGlobalMemoryMonitor resets singleton", func(t *testing.T) {
+		ResetGlobalMemoryMonitor()
+		defer ResetGlobalMemoryMonitor()
+
+		// Get initial instance
+		GetGlobalMemoryMonitor()
+
+		// Reset
+		ResetGlobalMemoryMonitor()
+
+		// Should be able to get a new instance
+		monitor := GetGlobalMemoryMonitor()
+		assert.NotNil(t, monitor)
+
+		// Clean up
+		monitor.StopMonitoring()
+		ResetGlobalMemoryMonitor()
+	})
+
+	t.Run("String method returns pressure name", func(t *testing.T) {
+		pressures := []struct {
+			level MemoryPressureLevel
+			name  string
+		}{
+			{MemoryPressureNone, "None"},
+			{MemoryPressureLow, "Low"},
+			{MemoryPressureModerate, "Moderate"},
+			{MemoryPressureHigh, "High"},
+			{MemoryPressureCritical, "Critical"},
+			{MemoryPressureLevel(999), "Unknown"},
+		}
+
+		for _, p := range pressures {
+			assert.Equal(t, p.name, p.level.String(), "pressure level %d should return %s", p.level, p.name)
+		}
+	})
+
+	t.Run("GetCurrentStats collects statistics", func(t *testing.T) {
+		thresholds := DefaultMemoryAlertThresholds()
+		monitor := NewMemoryMonitor(newNoOpLogger(), thresholds)
+
+		stats := monitor.GetCurrentStats()
+		assert.NotNil(t, stats)
+		assert.Greater(t, stats.HeapAllocBytes, uint64(0))
+		assert.Greater(t, stats.NumGoroutines, 0)
+		assert.NotZero(t, stats.Timestamp)
+	})
+}
+
+// TestBackgroundTaskRegistry tests background task registry edge cases
+func TestBackgroundTaskRegistry(t *testing.T) {
+	t.Run("GetGlobalTaskRegistry returns singleton", func(t *testing.T) {
+		registry1 := GetGlobalTaskRegistry()
+		registry2 := GetGlobalTaskRegistry()
+
+		assert.Equal(t, registry1, registry2, "should return same instance")
+	})
+
+	t.Run("RegisterTask adds task to registry", func(t *testing.T) {
+		ResetGlobalTaskRegistry()
+		registry := GetGlobalTaskRegistry()
+		defer ResetGlobalTaskRegistry()
+
+		taskName := "test-register-task"
+		task := NewBackgroundTask(
+			taskName,
+			100*time.Millisecond,
+			func() {},
+			newNoOpLogger(),
+		)
+
+		err := registry.RegisterTask(taskName, task)
+		assert.NoError(t, err)
+
+		// Verify task was registered
+		_, exists := registry.GetTask(taskName)
+		assert.True(t, exists, "task should be registered")
+
+		// Clean up
+		task.Stop()
+	})
+
+	t.Run("CreateSingletonTask is idempotent", func(t *testing.T) {
+		ResetGlobalTaskRegistry()
+		registry := GetGlobalTaskRegistry()
+		defer ResetGlobalTaskRegistry()
+
+		taskName := "test-singleton-idempotent"
+		callCount := 0
+		var mu sync.Mutex
+
+		taskFunc := func() {
+			mu.Lock()
+			callCount++
+			mu.Unlock()
+		}
+
+		// First creation should succeed
+		task1, err1 := registry.CreateSingletonTask(
+			taskName,
+			100*time.Millisecond,
+			taskFunc,
+			newNoOpLogger(),
+			nil,
+		)
+
+		assert.NoError(t, err1)
+		assert.NotNil(t, task1)
+
+		// Second creation should also succeed (idempotent)
+		// Returns same task without error
+		task2, err2 := registry.CreateSingletonTask(
+			taskName,
+			100*time.Millisecond,
+			taskFunc,
+			newNoOpLogger(),
+			nil,
+		)
+
+		assert.NoError(t, err2, "CreateSingletonTask should be idempotent")
+		assert.NotNil(t, task2)
+
+		// Clean up
+		if task1 != nil {
+			task1.Stop()
+		}
+	})
+
+	t.Run("GetTaskCount returns active task count", func(t *testing.T) {
+		ResetGlobalTaskRegistry()
+		registry := GetGlobalTaskRegistry()
+		defer ResetGlobalTaskRegistry()
+
+		// Initially should be 0 or small number
+		initialCount := registry.GetTaskCount()
+
+		// Create a task
+		task := NewBackgroundTask(
+			"count-test-task",
+			100*time.Millisecond,
+			func() {},
+			newNoOpLogger(),
+		)
+
+		err := registry.RegisterTask("count-test-task", task)
+		assert.NoError(t, err)
+
+		// Count should increase
+		newCount := registry.GetTaskCount()
+		assert.Equal(t, initialCount+1, newCount)
+
+		// Clean up
+		task.Stop()
+	})
+
+	t.Run("StopAllTasks stops all tasks", func(t *testing.T) {
+		ResetGlobalTaskRegistry()
+		registry := GetGlobalTaskRegistry()
+		defer ResetGlobalTaskRegistry()
+
+		// Create multiple tasks
+		for i := 0; i < 3; i++ {
+			taskName := "multi-task-" + string(rune(i+'0'))
+			task := NewBackgroundTask(
+				taskName,
+				100*time.Millisecond,
+				func() {},
+				newNoOpLogger(),
+			)
+			registry.RegisterTask(taskName, task)
+		}
+
+		// Verify tasks were created
+		assert.GreaterOrEqual(t, registry.GetTaskCount(), 3)
+
+		// Stop all tasks
+		registry.StopAllTasks()
+
+		// Verify all tasks are removed
+		taskCount := registry.GetTaskCount()
+		assert.Equal(t, 0, taskCount, "all tasks should be stopped")
+	})
+
+	t.Run("ResetGlobalTaskRegistry clears registry", func(t *testing.T) {
+		ResetGlobalTaskRegistry()
+		registry := GetGlobalTaskRegistry()
+
+		// Create a task
+		task := NewBackgroundTask(
+			"reset-test-task",
+			100*time.Millisecond,
+			func() {},
+			newNoOpLogger(),
+		)
+		registry.RegisterTask("reset-test-task", task)
+
+		// Reset
+		ResetGlobalTaskRegistry()
+
+		// Get new registry
+		newRegistry := GetGlobalTaskRegistry()
+		assert.Equal(t, 0, newRegistry.GetTaskCount(), "new registry should be empty")
+	})
+}
+
+// TestBackgroundTaskLifecycle tests background task lifecycle
+func TestBackgroundTaskLifecycle(t *testing.T) {
+	t.Run("Start begins task execution", func(t *testing.T) {
+		if testing.Short() {
+			t.Skip("Skipping background task test in short mode")
+		}
+
+		ResetGlobalTaskRegistry()
+		defer ResetGlobalTaskRegistry()
+
+		executed := false
+		var mu sync.Mutex
+
+		task := NewBackgroundTask(
+			"lifecycle-test",
+			50*time.Millisecond,
+			func() {
+				mu.Lock()
+				executed = true
+				mu.Unlock()
+			},
+			newNoOpLogger(),
+		)
+
+		// Start task
+		task.Start()
+
+		// Wait for execution
+		time.Sleep(GetTestDuration(100 * time.Millisecond))
+
+		// Stop task
+		task.Stop()
+
+		// Verify it executed
+		mu.Lock()
+		wasExecuted := executed
+		mu.Unlock()
+
+		assert.True(t, wasExecuted, "task should have executed")
+	})
+
+	t.Run("Stop halts task execution", func(t *testing.T) {
+		if testing.Short() {
+			t.Skip("Skipping background task test in short mode")
+		}
+
+		ResetGlobalTaskRegistry()
+		defer ResetGlobalTaskRegistry()
+
+		execCount := 0
+		var mu sync.Mutex
+
+		task := NewBackgroundTask(
+			"stop-test",
+			30*time.Millisecond,
+			func() {
+				mu.Lock()
+				execCount++
+				mu.Unlock()
+			},
+			newNoOpLogger(),
+		)
+
+		// Start task
+		task.Start()
+
+		// Let it run a few times
+		time.Sleep(GetTestDuration(100 * time.Millisecond))
+
+		// Stop task
+		task.Stop()
+
+		// Record count
+		mu.Lock()
+		countAfterStop := execCount
+		mu.Unlock()
+
+		// Wait more
+		time.Sleep(GetTestDuration(100 * time.Millisecond))
+
+		// Count should not increase
+		mu.Lock()
+		finalCount := execCount
+		mu.Unlock()
+
+		assert.Equal(t, countAfterStop, finalCount, "task should not execute after stop")
+	})
+
+	t.Run("Multiple Start calls are safe", func(t *testing.T) {
+		if testing.Short() {
+			t.Skip("Skipping background task test in short mode")
+		}
+
+		ResetGlobalTaskRegistry()
+		defer ResetGlobalTaskRegistry()
+
+		execCount := 0
+		var mu sync.Mutex
+
+		task := NewBackgroundTask(
+			"multi-start-test",
+			100*time.Millisecond,
+			func() {
+				mu.Lock()
+				execCount++
+				mu.Unlock()
+			},
+			newNoOpLogger(),
+		)
+
+		// Multiple starts should be safe
+		task.Start()
+		task.Start()
+		task.Start()
+
+		// Wait a bit
+		time.Sleep(GetTestDuration(50 * time.Millisecond))
+
+		// Stop task
+		task.Stop()
+
+		// Should have executed, but only one goroutine
+		mu.Lock()
+		count := execCount
+		mu.Unlock()
+
+		assert.GreaterOrEqual(t, count, 0, "task should have executed at least once")
+	})
+
+	t.Run("Multiple Stop calls are safe", func(t *testing.T) {
+		ResetGlobalTaskRegistry()
+		defer ResetGlobalTaskRegistry()
+
+		task := NewBackgroundTask(
+			"multi-stop-test",
+			100*time.Millisecond,
+			func() {},
+			newNoOpLogger(),
+		)
+
+		// Start and stop
+		task.Start()
+		time.Sleep(GetTestDuration(20 * time.Millisecond))
+
+		// Multiple stops should be safe
+		assert.NotPanics(t, func() {
+			task.Stop()
+			task.Stop()
+			task.Stop()
+		})
+	})
+}
+
+// TestMemoryMonitorIntegration tests memory monitor integration
+func TestMemoryMonitorIntegration(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping memory monitor integration test in short mode")
+	}
+
+	t.Run("monitoring updates stats", func(t *testing.T) {
+		ResetGlobalMemoryMonitor()
+		ResetGlobalTaskRegistry()
+		defer ResetGlobalMemoryMonitor()
+		defer ResetGlobalTaskRegistry()
+
+		thresholds := DefaultMemoryAlertThresholds()
+		monitor := NewMemoryMonitor(newNoOpLogger(), thresholds)
+		defer monitor.StopMonitoring()
+
+		// Start monitoring
+		ctx := context.Background()
+		monitor.StartMonitoring(ctx, 50*time.Millisecond)
+
+		// Wait for at least one check
+		time.Sleep(GetTestDuration(150 * time.Millisecond))
+
+		// Get pressure (should be a valid pressure level)
+		pressure := monitor.GetMemoryPressure()
+		assert.Contains(t, []MemoryPressureLevel{
+			MemoryPressureNone,
+			MemoryPressureLow,
+			MemoryPressureModerate,
+			MemoryPressureHigh,
+			MemoryPressureCritical,
+		}, pressure, "pressure should be a valid level")
+
+		// Stop monitoring
+		monitor.StopMonitoring()
+	})
+
+	t.Run("global memory monitor singleton", func(t *testing.T) {
+		ResetGlobalMemoryMonitor()
+		defer ResetGlobalMemoryMonitor()
+
+		monitor1 := GetGlobalMemoryMonitor()
+		monitor2 := GetGlobalMemoryMonitor()
+
+		assert.Equal(t, monitor1, monitor2, "should return same instance")
+	})
+}
+
+// TestMemoryStatsCollection tests memory statistics collection
+func TestMemoryStatsCollection(t *testing.T) {
+	t.Run("GetCurrentStats returns valid data", func(t *testing.T) {
+		thresholds := DefaultMemoryAlertThresholds()
+		monitor := NewMemoryMonitor(newNoOpLogger(), thresholds)
+
+		stats := monitor.GetCurrentStats()
+
+		assert.NotNil(t, stats)
+		assert.Greater(t, stats.HeapAllocBytes, uint64(0))
+		assert.Greater(t, stats.HeapSysBytes, uint64(0))
+		assert.Greater(t, stats.NumGoroutines, 0)
+		assert.False(t, stats.Timestamp.IsZero())
+	})
+
+	t.Run("Stats include memory pressure", func(t *testing.T) {
+		thresholds := DefaultMemoryAlertThresholds()
+		monitor := NewMemoryMonitor(newNoOpLogger(), thresholds)
+
+		stats := monitor.GetCurrentStats()
+
+		// Should calculate and include pressure level
+		assert.NotNil(t, stats.MemoryPressure)
+		assert.Contains(t, []MemoryPressureLevel{
+			MemoryPressureNone,
+			MemoryPressureLow,
+			MemoryPressureModerate,
+			MemoryPressureHigh,
+			MemoryPressureCritical,
+		}, stats.MemoryPressure)
+	})
+
+	t.Run("TriggerGC reduces memory", func(t *testing.T) {
+		thresholds := DefaultMemoryAlertThresholds()
+		monitor := NewMemoryMonitor(newNoOpLogger(), thresholds)
+
+		// Allocate some memory
+		_ = make([]byte, 1024*1024) // 1MB
+
+		// Get stats before GC
+		beforeStats := monitor.GetCurrentStats()
+
+		// Trigger GC
+		monitor.TriggerGC()
+
+		// Get stats after GC
+		afterStats := monitor.GetCurrentStats()
+
+		// After GC should have different stats
+		assert.NotEqual(t, beforeStats.LastGCTime, afterStats.LastGCTime)
+	})
+}

cache_manager.go

@@ -21,10 +21,37 @@ var (
 )
 
 // GetGlobalCacheManager returns a singleton CacheManager instance
+// Deprecated: Use GetGlobalCacheManagerWithConfig instead
 func GetGlobalCacheManager(wg *sync.WaitGroup) *CacheManager {
+	return GetGlobalCacheManagerWithConfig(wg, nil)
+}
+
+// GetGlobalCacheManagerWithConfig returns a singleton CacheManager instance with optional Redis configuration
+func GetGlobalCacheManagerWithConfig(wg *sync.WaitGroup, config *Config) *CacheManager {
 	cacheManagerInitOnce.Do(func() {
+		var redisConfig *RedisConfig
+		var logger *Logger
+
+		if config != nil {
+			logger = NewLogger(config.LogLevel)
+
+			// Initialize Redis config if not present
+			if config.Redis == nil {
+				config.Redis = &RedisConfig{}
+			}
+
+			// Apply environment variable fallbacks for fields not set in config
+			// This allows env vars to be used as optional overrides
+			config.Redis.ApplyEnvFallbacks()
+
+			// Apply defaults after env fallbacks
+			config.Redis.ApplyDefaults()
+
+			redisConfig = config.Redis
+		}
+
 		globalCacheManagerInstance = &CacheManager{
-			manager: GetUniversalCacheManager(nil),
+			manager: GetUniversalCacheManagerWithConfig(logger, redisConfig),
 		}
 	})
 	return globalCacheManagerInstance
@@ -61,6 +88,22 @@ func (cm *CacheManager) GetSharedJWKCache() JWKCacheInterface {
 	return &JWKCache{cache: cm.manager.GetJWKCache()}
 }
 
+// GetSharedIntrospectionCache returns the shared token introspection cache
+// for caching OAuth 2.0 Token Introspection (RFC 7662) results
+func (cm *CacheManager) GetSharedIntrospectionCache() CacheInterface {
+	cm.mu.RLock()
+	defer cm.mu.RUnlock()
+	return &CacheInterfaceWrapper{cache: cm.manager.GetIntrospectionCache()}
+}
+
+// GetSharedTokenTypeCache returns the shared token type cache
+// for caching token type detection results to improve performance
+func (cm *CacheManager) GetSharedTokenTypeCache() CacheInterface {
+	cm.mu.RLock()
+	defer cm.mu.RUnlock()
+	return &CacheInterfaceWrapper{cache: cm.manager.GetTokenTypeCache()}
+}
+
 // Close gracefully shuts down all cache components
 func (cm *CacheManager) Close() error {
 	cm.mu.Lock()
@@ -83,7 +126,7 @@ type CacheInterfaceWrapper struct {
 
 // Set stores a value
 func (c *CacheInterfaceWrapper) Set(key string, value interface{}, ttl time.Duration) {
-	c.cache.Set(key, value, ttl)
+	_ = c.cache.Set(key, value, ttl) // Safe to ignore: cache set failures are non-critical
 }
 
 // Get retrieves a value
@@ -110,7 +153,7 @@ func (c *CacheInterfaceWrapper) Cleanup() {
 func (c *CacheInterfaceWrapper) Close() {
 	// Close the underlying cache to stop goroutines
 	if c.cache != nil {
-		c.cache.Close()
+		_ = c.cache.Close() // Safe to ignore: closing cache is best-effort during shutdown
 	}
 }
 

config/compatibility.go

@@ -0,0 +1,258 @@
+// Package config provides backward compatibility for legacy configuration
+package config
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/lukaszraczylo/traefikoidc/internal/compat"
+	"github.com/lukaszraczylo/traefikoidc/internal/features"
+)
+
+// LegacyAdapter provides backward compatibility for old Config struct
+type LegacyAdapter struct {
+	unified *UnifiedConfig
+	adapter *compat.ConfigAdapter
+}
+
+// NewLegacyAdapter creates a new legacy adapter from unified config
+func NewLegacyAdapter(unified *UnifiedConfig) *LegacyAdapter {
+	adapter := compat.NewConfigAdapter(unified)
+
+	// Register getters for commonly used fields
+	adapter.RegisterGetter("ProviderURL", func() interface{} {
+		return unified.Provider.IssuerURL
+	})
+	adapter.RegisterGetter("ClientID", func() interface{} {
+		return unified.Provider.ClientID
+	})
+	adapter.RegisterGetter("ClientSecret", func() interface{} {
+		return unified.Provider.ClientSecret
+	})
+	adapter.RegisterGetter("CallbackURL", func() interface{} {
+		return unified.Provider.RedirectURL
+	})
+	adapter.RegisterGetter("LogoutURL", func() interface{} {
+		return unified.Provider.LogoutURL
+	})
+	adapter.RegisterGetter("PostLogoutRedirectURI", func() interface{} {
+		return unified.Provider.PostLogoutRedirectURI
+	})
+	adapter.RegisterGetter("SessionEncryptionKey", func() interface{} {
+		return unified.Session.EncryptionKey
+	})
+	adapter.RegisterGetter("ForceHTTPS", func() interface{} {
+		return unified.Security.ForceHTTPS
+	})
+	adapter.RegisterGetter("LogLevel", func() interface{} {
+		return unified.Logging.Level
+	})
+	adapter.RegisterGetter("Scopes", func() interface{} {
+		return unified.Provider.Scopes
+	})
+	adapter.RegisterGetter("OverrideScopes", func() interface{} {
+		return unified.Provider.OverrideScopes
+	})
+	adapter.RegisterGetter("AllowedUsers", func() interface{} {
+		return unified.Security.AllowedUsers
+	})
+	adapter.RegisterGetter("AllowedUserDomains", func() interface{} {
+		return unified.Security.AllowedUserDomains
+	})
+	adapter.RegisterGetter("AllowedRolesAndGroups", func() interface{} {
+		return unified.Security.AllowedRolesAndGroups
+	})
+	adapter.RegisterGetter("ExcludedURLs", func() interface{} {
+		return unified.Security.ExcludedURLs
+	})
+	adapter.RegisterGetter("EnablePKCE", func() interface{} {
+		return unified.Security.EnablePKCE
+	})
+	adapter.RegisterGetter("RateLimit", func() interface{} {
+		return unified.RateLimit.RequestsPerSecond
+	})
+	adapter.RegisterGetter("RefreshGracePeriodSeconds", func() interface{} {
+		return int(unified.Token.RefreshGracePeriod.Seconds())
+	})
+	adapter.RegisterGetter("CookieDomain", func() interface{} {
+		return unified.Session.Domain
+	})
+	adapter.RegisterGetter("SecurityHeaders", func() interface{} {
+		return unified.Security.Headers
+	})
+
+	return &LegacyAdapter{
+		unified: unified,
+		adapter: adapter,
+	}
+}
+
+// ToOldConfig converts unified config to old Config struct format
+func (la *LegacyAdapter) ToOldConfig() *Config {
+	// Use feature flags to determine behavior
+	if !features.IsUnifiedConfigEnabled() {
+		// Return existing Config if unified config not enabled
+		return CreateConfig()
+	}
+
+	cfg := &Config{
+		ProviderURL:               la.unified.Provider.IssuerURL,
+		ClientID:                  la.unified.Provider.ClientID,
+		ClientSecret:              la.unified.Provider.ClientSecret,
+		CallbackURL:               la.unified.Provider.RedirectURL,
+		LogoutURL:                 la.unified.Provider.LogoutURL,
+		PostLogoutRedirectURI:     la.unified.Provider.PostLogoutRedirectURI,
+		SessionEncryptionKey:      la.unified.Session.EncryptionKey,
+		ForceHTTPS:                la.unified.Security.ForceHTTPS,
+		LogLevel:                  la.unified.Logging.Level,
+		Scopes:                    la.unified.Provider.Scopes,
+		OverrideScopes:            la.unified.Provider.OverrideScopes,
+		AllowedUsers:              la.unified.Security.AllowedUsers,
+		AllowedUserDomains:        la.unified.Security.AllowedUserDomains,
+		AllowedRolesAndGroups:     la.unified.Security.AllowedRolesAndGroups,
+		ExcludedURLs:              la.unified.Security.ExcludedURLs,
+		EnablePKCE:                la.unified.Security.EnablePKCE,
+		RateLimit:                 la.unified.RateLimit.RequestsPerSecond,
+		RefreshGracePeriodSeconds: int(la.unified.Token.RefreshGracePeriod.Seconds()),
+		Headers:                   la.convertHeaders(),
+		CookieDomain:              la.unified.Session.Domain,
+		SecurityHeaders:           la.unified.Security.Headers,
+	}
+
+	return cfg
+}
+
+// convertHeaders converts unified header config to old format
+func (la *LegacyAdapter) convertHeaders() []HeaderConfig {
+	headers := make([]HeaderConfig, 0)
+
+	for name, value := range la.unified.Middleware.CustomHeaders {
+		headers = append(headers, HeaderConfig{
+			Name:  name,
+			Value: value,
+		})
+	}
+
+	return headers
+}
+
+// FromOldConfig creates unified config from old Config struct
+func FromOldConfig(old *Config) *UnifiedConfig {
+	unified := NewUnifiedConfig()
+
+	// Map provider settings
+	unified.Provider.IssuerURL = old.ProviderURL
+	unified.Provider.ClientID = old.ClientID
+	unified.Provider.ClientSecret = old.ClientSecret
+	unified.Provider.RedirectURL = old.CallbackURL
+	unified.Provider.LogoutURL = old.LogoutURL
+	unified.Provider.PostLogoutRedirectURI = old.PostLogoutRedirectURI
+	unified.Provider.Scopes = old.Scopes
+	unified.Provider.OverrideScopes = old.OverrideScopes
+
+	// Map session settings
+	unified.Session.EncryptionKey = old.SessionEncryptionKey
+	unified.Session.Domain = old.CookieDomain
+
+	// Map security settings
+	unified.Security.ForceHTTPS = old.ForceHTTPS
+	unified.Security.EnablePKCE = old.EnablePKCE
+	unified.Security.AllowedUsers = old.AllowedUsers
+	unified.Security.AllowedUserDomains = old.AllowedUserDomains
+	unified.Security.AllowedRolesAndGroups = old.AllowedRolesAndGroups
+	unified.Security.ExcludedURLs = old.ExcludedURLs
+	unified.Security.Headers = old.SecurityHeaders
+
+	// Map rate limiting
+	unified.RateLimit.RequestsPerSecond = old.RateLimit
+	unified.RateLimit.Enabled = old.RateLimit > 0
+
+	// Map token settings
+	unified.Token.RefreshGracePeriod = timeSecondsToDuration(old.RefreshGracePeriodSeconds)
+
+	// Map logging
+	unified.Logging.Level = old.LogLevel
+
+	// Map custom headers
+	if len(old.Headers) > 0 {
+		unified.Middleware.CustomHeaders = make(map[string]string)
+		for _, header := range old.Headers {
+			unified.Middleware.CustomHeaders[header.Name] = header.Value
+		}
+	}
+
+	// Store original config in legacy field for reference
+	unified.Legacy["original"] = old
+
+	return unified
+}
+
+// timeSecondsToDuration converts seconds to time.Duration
+func timeSecondsToDuration(seconds int) time.Duration {
+	return time.Duration(seconds) * time.Second
+}
+
+// GetConfigInterface returns appropriate config based on feature flag
+func GetConfigInterface() interface{} {
+	if features.IsUnifiedConfigEnabled() {
+		return NewUnifiedConfig()
+	}
+	return CreateConfig()
+}
+
+// ValidateConfig validates config based on feature flag
+func ValidateConfig(cfg interface{}) error {
+	if features.IsUnifiedConfigEnabled() {
+		if unified, ok := cfg.(*UnifiedConfig); ok {
+			return unified.Validate()
+		}
+	}
+
+	// Fall back to old validation if available
+	if old, ok := cfg.(*Config); ok {
+		return old.Validate()
+	}
+
+	return nil
+}
+
+// Add Validate method to old Config for compatibility
+func (c *Config) Validate() error {
+	var errors ValidationErrors
+
+	// Basic validation for old config
+	if c.ProviderURL == "" {
+		errors = append(errors, ValidationError{
+			Field:   "ProviderURL",
+			Message: "provider URL is required",
+		})
+	}
+
+	if c.ClientID == "" {
+		errors = append(errors, ValidationError{
+			Field:   "ClientID",
+			Message: "client ID is required",
+		})
+	}
+
+	if c.ClientSecret == "" && !c.EnablePKCE {
+		errors = append(errors, ValidationError{
+			Field:   "ClientSecret",
+			Message: "client secret is required (or enable PKCE)",
+		})
+	}
+
+	if c.SessionEncryptionKey != "" && len(c.SessionEncryptionKey) < minEncryptionKeyLength {
+		errors = append(errors, ValidationError{
+			Field:   "SessionEncryptionKey",
+			Message: fmt.Sprintf("encryption key must be at least %d characters", minEncryptionKeyLength),
+			Value:   len(c.SessionEncryptionKey),
+		})
+	}
+
+	if len(errors) > 0 {
+		return errors
+	}
+
+	return nil
+}

config/compatibility_test.go

@@ -0,0 +1,363 @@
+//go:build !yaegi
+
+package config
+
+import (
+	"testing"
+
+	"github.com/lukaszraczylo/traefikoidc/internal/features"
+)
+
+// NewLegacyAdapter Tests
+func TestNewLegacyAdapter(t *testing.T) {
+	unified := NewUnifiedConfig()
+	unified.Provider.IssuerURL = "https://provider.example.com"
+	unified.Provider.ClientID = "test-client"
+	unified.Provider.ClientSecret = "test-secret"
+
+	adapter := NewLegacyAdapter(unified)
+
+	if adapter == nil {
+		t.Fatal("Expected NewLegacyAdapter to return non-nil")
+	}
+
+	if adapter.unified != unified {
+		t.Error("Expected adapter to reference the unified config")
+	}
+
+	if adapter.adapter == nil {
+		t.Error("Expected internal adapter to be initialized")
+	}
+}
+
+// ToOldConfig Tests
+func TestLegacyAdapter_ToOldConfig(t *testing.T) {
+	unified := NewUnifiedConfig()
+	unified.Provider.IssuerURL = "https://issuer.example.com"
+	unified.Provider.ClientID = "client-123"
+	unified.Provider.ClientSecret = "secret-456"
+	unified.Provider.RedirectURL = "https://app.example.com/callback"
+	unified.Provider.LogoutURL = "/logout"
+	unified.Provider.PostLogoutRedirectURI = "https://app.example.com"
+	unified.Provider.Scopes = []string{"openid", "profile"}
+	unified.Provider.OverrideScopes = true
+	unified.Session.EncryptionKey = "test-encryption-key-32-chars!!"
+	unified.Session.Domain = "example.com"
+	unified.Security.ForceHTTPS = true
+	unified.Security.EnablePKCE = true
+	unified.Security.AllowedUsers = []string{"[email protected]"}
+	unified.Security.AllowedUserDomains = []string{"example.com"}
+	unified.Security.AllowedRolesAndGroups = []string{"admin"}
+	unified.Security.ExcludedURLs = []string{"/health"}
+	unified.RateLimit.RequestsPerSecond = 100
+	unified.Logging.Level = "debug"
+	unified.Middleware.CustomHeaders = map[string]string{
+		"X-Header-1": "value1",
+		"X-Header-2": "value2",
+	}
+
+	adapter := NewLegacyAdapter(unified)
+	oldConfig := adapter.ToOldConfig()
+
+	if oldConfig == nil {
+		t.Fatal("Expected ToOldConfig to return non-nil")
+	}
+
+	// ToOldConfig behavior depends on feature flag
+	if !features.IsUnifiedConfigEnabled() {
+		// When feature is disabled, returns default config
+		if oldConfig.ProviderURL == "" {
+			t.Log("Feature flag disabled - ToOldConfig returns default config")
+		}
+		return
+	}
+
+	// When feature is enabled, verify all fields were correctly mapped
+	if oldConfig.ProviderURL != unified.Provider.IssuerURL {
+		t.Errorf("Expected ProviderURL '%s', got '%s'", unified.Provider.IssuerURL, oldConfig.ProviderURL)
+	}
+
+	if oldConfig.ClientID != unified.Provider.ClientID {
+		t.Errorf("Expected ClientID '%s', got '%s'", unified.Provider.ClientID, oldConfig.ClientID)
+	}
+
+	if oldConfig.ClientSecret != unified.Provider.ClientSecret {
+		t.Errorf("Expected ClientSecret '%s', got '%s'", unified.Provider.ClientSecret, oldConfig.ClientSecret)
+	}
+
+	if oldConfig.CallbackURL != unified.Provider.RedirectURL {
+		t.Error("Expected CallbackURL to match RedirectURL")
+	}
+
+	if oldConfig.LogoutURL != unified.Provider.LogoutURL {
+		t.Error("Expected LogoutURL to match")
+	}
+
+	if oldConfig.ForceHTTPS != unified.Security.ForceHTTPS {
+		t.Error("Expected ForceHTTPS to match")
+	}
+
+	if oldConfig.EnablePKCE != unified.Security.EnablePKCE {
+		t.Error("Expected EnablePKCE to match")
+	}
+
+	if oldConfig.RateLimit != unified.RateLimit.RequestsPerSecond {
+		t.Errorf("Expected RateLimit %d, got %d", unified.RateLimit.RequestsPerSecond, oldConfig.RateLimit)
+	}
+
+	if len(oldConfig.Headers) != 2 {
+		t.Errorf("Expected 2 headers, got %d", len(oldConfig.Headers))
+	}
+}
+
+// convertHeaders Tests
+func TestLegacyAdapter_convertHeaders(t *testing.T) {
+	unified := NewUnifiedConfig()
+	unified.Middleware.CustomHeaders = map[string]string{
+		"X-Custom-Header-1": "value1",
+		"X-Custom-Header-2": "value2",
+		"X-Custom-Header-3": "value3",
+	}
+
+	adapter := NewLegacyAdapter(unified)
+	headers := adapter.convertHeaders()
+
+	if len(headers) != 3 {
+		t.Errorf("Expected 3 headers, got %d", len(headers))
+	}
+
+	// Check that headers were converted
+	headerMap := make(map[string]string)
+	for _, h := range headers {
+		headerMap[h.Name] = h.Value
+	}
+
+	if headerMap["X-Custom-Header-1"] != "value1" {
+		t.Error("Expected X-Custom-Header-1 to have value 'value1'")
+	}
+
+	if headerMap["X-Custom-Header-2"] != "value2" {
+		t.Error("Expected X-Custom-Header-2 to have value 'value2'")
+	}
+}
+
+func TestLegacyAdapter_convertHeaders_Empty(t *testing.T) {
+	unified := NewUnifiedConfig()
+	// No custom headers
+
+	adapter := NewLegacyAdapter(unified)
+	headers := adapter.convertHeaders()
+
+	if len(headers) != 0 {
+		t.Errorf("Expected 0 headers, got %d", len(headers))
+	}
+}
+
+// GetConfigInterface Tests
+func TestGetConfigInterface(t *testing.T) {
+	cfg := GetConfigInterface()
+
+	if cfg == nil {
+		t.Fatal("Expected GetConfigInterface to return non-nil")
+	}
+
+	// Should return either UnifiedConfig or Config depending on feature flag
+	_, isUnified := cfg.(*UnifiedConfig)
+	_, isOld := cfg.(*Config)
+
+	if !isUnified && !isOld {
+		t.Error("Expected either *UnifiedConfig or *Config")
+	}
+
+	// Verify consistency with feature flag
+	if features.IsUnifiedConfigEnabled() {
+		if !isUnified {
+			t.Error("Expected *UnifiedConfig when unified config is enabled")
+		}
+	} else {
+		if !isOld {
+			t.Error("Expected *Config when unified config is disabled")
+		}
+	}
+}
+
+// ValidateConfig Tests
+func TestValidateConfig_UnifiedConfig(t *testing.T) {
+	unified := NewUnifiedConfig()
+	unified.Provider.IssuerURL = "https://provider.example.com"
+	unified.Provider.ClientID = "client-id"
+	unified.Provider.ClientSecret = "client-secret"
+	unified.Session.EncryptionKey = "encryption-key-32-characters!!"
+
+	err := ValidateConfig(unified)
+	// Should succeed regardless of feature flag since we're passing the right type
+	if err != nil {
+		t.Errorf("Expected valid unified config to pass validation, got: %v", err)
+	}
+}
+
+func TestValidateConfig_OldConfig(t *testing.T) {
+	old := CreateConfig()
+	old.ProviderURL = "https://provider.example.com"
+	old.ClientID = "client-id"
+	old.ClientSecret = "client-secret"
+	old.SessionEncryptionKey = "encryption-key-32-characters!!"
+
+	err := ValidateConfig(old)
+	if err != nil {
+		t.Errorf("Expected valid old config to pass validation, got: %v", err)
+	}
+}
+
+func TestValidateConfig_InvalidType(t *testing.T) {
+	// Pass something that's not a config
+	err := ValidateConfig("not a config")
+	if err != nil {
+		t.Errorf("Expected nil for unknown type, got: %v", err)
+	}
+}
+
+// Config.Validate Tests
+func TestConfig_Validate_Valid(t *testing.T) {
+	cfg := CreateConfig()
+	cfg.ProviderURL = "https://provider.example.com"
+	cfg.ClientID = "client-id"
+	cfg.ClientSecret = "client-secret"
+	cfg.SessionEncryptionKey = "encryption-key-32-characters!!"
+
+	err := cfg.Validate()
+	if err != nil {
+		t.Errorf("Expected valid config to pass, got: %v", err)
+	}
+}
+
+func TestConfig_Validate_MissingProviderURL(t *testing.T) {
+	cfg := CreateConfig()
+	cfg.ClientID = "client-id"
+	cfg.ClientSecret = "client-secret"
+
+	err := cfg.Validate()
+	if err == nil {
+		t.Error("Expected error for missing ProviderURL")
+	}
+
+	// Check if it's a ValidationErrors type
+	if verrs, ok := err.(ValidationErrors); ok {
+		found := false
+		for _, verr := range verrs {
+			if verr.Field == "ProviderURL" {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Error("Expected ProviderURL validation error")
+		}
+	}
+}
+
+func TestConfig_Validate_MissingClientID(t *testing.T) {
+	cfg := CreateConfig()
+	cfg.ProviderURL = "https://provider.example.com"
+	cfg.ClientSecret = "client-secret"
+
+	err := cfg.Validate()
+	if err == nil {
+		t.Error("Expected error for missing ClientID")
+	}
+
+	if verrs, ok := err.(ValidationErrors); ok {
+		found := false
+		for _, verr := range verrs {
+			if verr.Field == "ClientID" {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Error("Expected ClientID validation error")
+		}
+	}
+}
+
+func TestConfig_Validate_MissingClientSecret_NoPKCE(t *testing.T) {
+	cfg := CreateConfig()
+	cfg.ProviderURL = "https://provider.example.com"
+	cfg.ClientID = "client-id"
+	cfg.EnablePKCE = false
+
+	err := cfg.Validate()
+	if err == nil {
+		t.Error("Expected error for missing ClientSecret without PKCE")
+	}
+
+	if verrs, ok := err.(ValidationErrors); ok {
+		found := false
+		for _, verr := range verrs {
+			if verr.Field == "ClientSecret" {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Error("Expected ClientSecret validation error")
+		}
+	}
+}
+
+func TestConfig_Validate_MissingClientSecret_WithPKCE(t *testing.T) {
+	cfg := CreateConfig()
+	cfg.ProviderURL = "https://provider.example.com"
+	cfg.ClientID = "client-id"
+	cfg.EnablePKCE = true // PKCE enabled, so ClientSecret not required
+
+	err := cfg.Validate()
+	if err != nil {
+		t.Errorf("Expected no error with PKCE enabled and no ClientSecret, got: %v", err)
+	}
+}
+
+func TestConfig_Validate_ShortEncryptionKey(t *testing.T) {
+	cfg := CreateConfig()
+	cfg.ProviderURL = "https://provider.example.com"
+	cfg.ClientID = "client-id"
+	cfg.ClientSecret = "client-secret"
+	cfg.SessionEncryptionKey = "short" // Too short
+
+	err := cfg.Validate()
+	if err == nil {
+		t.Error("Expected error for short encryption key")
+	}
+
+	if verrs, ok := err.(ValidationErrors); ok {
+		found := false
+		for _, verr := range verrs {
+			if verr.Field == "SessionEncryptionKey" {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Error("Expected SessionEncryptionKey validation error")
+		}
+	}
+}
+
+func TestConfig_Validate_MultipleErrors(t *testing.T) {
+	cfg := CreateConfig()
+	// Missing ProviderURL, ClientID, and ClientSecret
+
+	err := cfg.Validate()
+	if err == nil {
+		t.Fatal("Expected validation errors")
+	}
+
+	verrs, ok := err.(ValidationErrors)
+	if !ok {
+		t.Fatal("Expected ValidationErrors type")
+	}
+
+	if len(verrs) < 2 {
+		t.Errorf("Expected at least 2 validation errors, got %d", len(verrs))
+	}
+}

config/defaults.go

@@ -0,0 +1,276 @@
+// Package config provides default values and initialization for unified configuration
+package config
+
+import (
+	"time"
+)
+
+// NewUnifiedConfig creates a new unified configuration with sensible defaults
+func NewUnifiedConfig() *UnifiedConfig {
+	return &UnifiedConfig{
+		Provider:   DefaultProviderConfig(),
+		Session:    DefaultSessionConfig(),
+		Token:      DefaultTokenConfig(),
+		Redis:      *DefaultRedisConfig(), // Using existing DefaultRedisConfig
+		Security:   DefaultSecurityConfig(),
+		Middleware: DefaultMiddlewareConfig(),
+		Cache:      DefaultCacheConfig(),
+		RateLimit:  DefaultRateLimitConfig(),
+		Logging:    DefaultLoggingConfig(),
+		Metrics:    DefaultMetricsConfig(),
+		Health:     DefaultHealthConfig(),
+		Transport:  DefaultTransportConfig(),
+		Pool:       DefaultPoolConfig(),
+		Circuit:    DefaultCircuitConfig(),
+		Legacy:     make(map[string]interface{}),
+	}
+}
+
+// DefaultProviderConfig returns default provider configuration
+func DefaultProviderConfig() ProviderConfig {
+	return ProviderConfig{
+		Scopes:           []string{"openid", "profile", "email"},
+		OverrideScopes:   false,
+		CustomClaims:     make(map[string]string),
+		JWKCachePeriod:   24 * time.Hour,
+		MetadataCacheTTL: 24 * time.Hour,
+		Discovery:        true,
+	}
+}
+
+// DefaultSessionConfig returns default session configuration
+func DefaultSessionConfig() SessionConfig {
+	return SessionConfig{
+		Name:            "oidc_session",
+		MaxAge:          86400, // 24 hours
+		ChunkSize:       4000,  // Safe size for cookies
+		MaxChunks:       5,
+		Path:            "/",
+		Secure:          true,
+		HttpOnly:        true,
+		SameSite:        "Lax",
+		StorageType:     "cookie",
+		CleanupInterval: 1 * time.Hour,
+	}
+}
+
+// DefaultTokenConfig returns default token configuration
+func DefaultTokenConfig() TokenConfig {
+	return TokenConfig{
+		AccessTokenTTL:     1 * time.Hour,
+		RefreshTokenTTL:    24 * time.Hour,
+		RefreshGracePeriod: 60 * time.Second,
+		ValidationMode:     "jwt",
+		CacheEnabled:       true,
+		CacheTTL:           5 * time.Minute,
+		CacheNegativeTTL:   30 * time.Second,
+		ValidateSignature:  true,
+		ValidateExpiry:     true,
+		ValidateAudience:   true,
+		ValidateIssuer:     true,
+		RequiredClaims:     []string{"sub", "iat", "exp"},
+		ClockSkew:          5 * time.Minute,
+	}
+}
+
+// DefaultSecurityConfig returns default security configuration
+func DefaultSecurityConfig() SecurityConfig {
+	return SecurityConfig{
+		ForceHTTPS:            true,
+		EnablePKCE:            true,
+		AllowedUsers:          []string{},
+		AllowedUserDomains:    []string{},
+		AllowedRolesAndGroups: []string{},
+		ExcludedURLs: []string{
+			"/favicon.ico",
+			"/robots.txt",
+			"/health",
+			"/.well-known/",
+			"/metrics",
+			"/ping",
+			"/static/",
+			"/assets/",
+			"/js/",
+			"/css/",
+			"/images/",
+			"/fonts/",
+		},
+		Headers:          createDefaultSecurityConfig(),
+		CSRFProtection:   true,
+		CSRFTokenName:    "csrf_token",
+		CSRFTokenTTL:     1 * time.Hour,
+		MaxLoginAttempts: 5,
+		LockoutDuration:  15 * time.Minute,
+		RequireMFA:       false,
+	}
+}
+
+// DefaultMiddlewareConfig returns default middleware configuration
+func DefaultMiddlewareConfig() MiddlewareConfig {
+	return MiddlewareConfig{
+		Priority:        1000,
+		SkipPaths:       []string{},
+		RequirePaths:    []string{},
+		PassthroughMode: false,
+		MaxRequestSize:  10 * 1024 * 1024, // 10MB
+		RequestTimeout:  30 * time.Second,
+		IdleTimeout:     90 * time.Second,
+		CustomHeaders:   make(map[string]string),
+		RemoveHeaders:   []string{},
+	}
+}
+
+// DefaultCacheConfig returns default cache configuration
+func DefaultCacheConfig() CacheConfig {
+	return CacheConfig{
+		Enabled:         true,
+		Type:            "memory",
+		DefaultTTL:      5 * time.Minute,
+		MaxEntries:      10000,
+		MaxEntrySize:    1024 * 1024, // 1MB
+		EvictionPolicy:  "lru",
+		CleanupInterval: 10 * time.Minute,
+		Namespace:       "traefikoidc",
+		Compression:     false,
+		Serialization:   "json",
+	}
+}
+
+// DefaultRateLimitConfig returns default rate limiting configuration
+func DefaultRateLimitConfig() RateLimitConfig {
+	return RateLimitConfig{
+		Enabled:           false,
+		RequestsPerSecond: 10,
+		Burst:             20,
+		StorageType:       "memory",
+		WindowDuration:    1 * time.Minute,
+		KeyType:           "ip",
+		CustomKeyFunc:     "",
+		WhitelistIPs:      []string{},
+		WhitelistUsers:    []string{},
+	}
+}
+
+// DefaultLoggingConfig returns default logging configuration
+func DefaultLoggingConfig() LoggingConfig {
+	return LoggingConfig{
+		Level:           "info",
+		Format:          "json",
+		Output:          "stdout",
+		FilePath:        "",
+		FilterSensitive: true,
+		MaskFields: []string{
+			"password",
+			"secret",
+			"token",
+			"key",
+			"authorization",
+			"cookie",
+		},
+		BufferSize:    8192,
+		FlushInterval: 5 * time.Second,
+		AuditEnabled:  false,
+		AuditEvents: []string{
+			"login",
+			"logout",
+			"token_refresh",
+			"auth_failure",
+		},
+	}
+}
+
+// DefaultMetricsConfig returns default metrics configuration
+func DefaultMetricsConfig() MetricsConfig {
+	return MetricsConfig{
+		Enabled:         false,
+		Provider:        "prometheus",
+		Endpoint:        "/metrics",
+		Namespace:       "traefikoidc",
+		Subsystem:       "middleware",
+		CollectInterval: 10 * time.Second,
+		Histograms:      true,
+		Labels:          make(map[string]string),
+	}
+}
+
+// DefaultHealthConfig returns default health check configuration
+func DefaultHealthConfig() HealthConfig {
+	return HealthConfig{
+		Enabled:       true,
+		Path:          "/health",
+		CheckInterval: 30 * time.Second,
+		Timeout:       5 * time.Second,
+		CheckProvider: true,
+		CheckRedis:    true,
+		CheckCache:    true,
+		MaxLatency:    1 * time.Second,
+		MinMemory:     100 * 1024 * 1024, // 100MB
+	}
+}
+
+// DefaultTransportConfig returns default HTTP transport configuration
+func DefaultTransportConfig() TransportConfig {
+	return TransportConfig{
+		MaxIdleConns:          100,
+		MaxIdleConnsPerHost:   10,
+		MaxConnsPerHost:       0, // No limit
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+		ResponseHeaderTimeout: 10 * time.Second,
+		DisableKeepAlives:     false,
+		DisableCompression:    false,
+		TLSInsecureSkipVerify: false,
+		TLSMinVersion:         "TLS1.2",
+		TLSCipherSuites:       []string{},
+		ProxyURL:              "",
+		NoProxy:               []string{},
+	}
+}
+
+// DefaultPoolConfig returns default connection pool configuration
+func DefaultPoolConfig() PoolConfig {
+	return PoolConfig{
+		Enabled:             true,
+		Size:                10,
+		MinSize:             2,
+		MaxSize:             50,
+		MaxAge:              30 * time.Minute,
+		IdleTimeout:         5 * time.Minute,
+		WaitTimeout:         5 * time.Second,
+		HealthCheckInterval: 30 * time.Second,
+		MaxRetries:          3,
+	}
+}
+
+// DefaultCircuitConfig returns default circuit breaker configuration
+func DefaultCircuitConfig() CircuitConfig {
+	return CircuitConfig{
+		Enabled:             true,
+		MaxRequests:         100,
+		Interval:            10 * time.Second,
+		Timeout:             60 * time.Second,
+		ConsecutiveFailures: 5,
+		FailureRatio:        0.5,
+		OnOpen:              "reject",
+		OnHalfOpen:          "passthrough",
+		MetricsEnabled:      true,
+		LogStateChanges:     true,
+	}
+}
+
+// MergeWithDefaults merges a partial configuration with defaults
+func MergeWithDefaults(partial *UnifiedConfig) *UnifiedConfig {
+	if partial == nil {
+		return NewUnifiedConfig()
+	}
+
+	// Ensure Legacy field is initialized
+	if partial.Legacy == nil {
+		partial.Legacy = make(map[string]interface{})
+	}
+
+	// TODO: Implement deep merge logic with defaults
+	// For now, just return the partial config
+	return partial
+}

config/loader.go

@@ -0,0 +1,396 @@
+// Package config provides configuration loading and merging logic
+package config
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+
+	"github.com/lukaszraczylo/traefikoidc/internal/features"
+	"gopkg.in/yaml.v3"
+)
+
+// ConfigLoader handles loading configuration from various sources
+type ConfigLoader struct {
+	migrator    *ConfigMigrator
+	envPrefix   string
+	configPaths []string
+}
+
+// NewConfigLoader creates a new configuration loader
+func NewConfigLoader() *ConfigLoader {
+	return &ConfigLoader{
+		migrator:    NewConfigMigrator(),
+		envPrefix:   "TRAEFIKOIDC_",
+		configPaths: getDefaultConfigPaths(),
+	}
+}
+
+// getDefaultConfigPaths returns default configuration file paths to check
+func getDefaultConfigPaths() []string {
+	return []string{
+		"traefik-oidc.yaml",
+		"traefik-oidc.yml",
+		"traefik-oidc.json",
+		"config.yaml",
+		"config.yml",
+		"config.json",
+		"/etc/traefik-oidc/config.yaml",
+		"/etc/traefik-oidc/config.json",
+	}
+}
+
+// Load loads configuration from all available sources
+func (l *ConfigLoader) Load() (*UnifiedConfig, error) {
+	// Start with defaults
+	config := NewUnifiedConfig()
+
+	// Try to load from file
+	if fileConfig, err := l.LoadFromFile(); err == nil && fileConfig != nil {
+		config = l.mergeConfigs(config, fileConfig)
+	}
+
+	// Load from environment variables
+	l.LoadFromEnv(config)
+
+	// Validate the final configuration
+	if err := config.Validate(); err != nil {
+		return nil, fmt.Errorf("configuration validation failed: %w", err)
+	}
+
+	return config, nil
+}
+
+// LoadFromFile loads configuration from a file
+func (l *ConfigLoader) LoadFromFile(paths ...string) (*UnifiedConfig, error) {
+	// Use provided paths or default paths
+	searchPaths := paths
+	if len(searchPaths) == 0 {
+		searchPaths = l.configPaths
+	}
+
+	// Check for config file in environment variable
+	if envPath := os.Getenv(l.envPrefix + "CONFIG_FILE"); envPath != "" {
+		searchPaths = append([]string{envPath}, searchPaths...)
+	}
+
+	// Try each path
+	for _, path := range searchPaths {
+		if _, err := os.Stat(path); err == nil {
+			return l.loadFile(path)
+		}
+	}
+
+	// No config file found, not an error (use defaults)
+	return nil, nil
+}
+
+// loadFile loads a specific configuration file
+func (l *ConfigLoader) loadFile(path string) (*UnifiedConfig, error) {
+	// Clean and validate path to prevent traversal attacks
+	cleanPath := filepath.Clean(path)
+
+	// Check for path traversal attempts
+	if strings.Contains(cleanPath, "..") {
+		return nil, fmt.Errorf("invalid config path: potential path traversal detected in %s", path)
+	}
+
+	// Ensure the path is within expected directories (current dir or subdirs)
+	absPath, err := filepath.Abs(cleanPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve absolute path for %s: %w", path, err)
+	}
+
+	// Read the file with validated path
+	data, err := os.ReadFile(absPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read config file %s: %w", absPath, err)
+	}
+
+	// Check if unified config is enabled
+	if features.IsUnifiedConfigEnabled() {
+		// Use migrator to handle any version
+		config, warnings, err := l.migrator.Migrate(data)
+		if err != nil {
+			return nil, fmt.Errorf("failed to migrate config from %s: %w", path, err)
+		}
+
+		// Log warnings
+		for _, warning := range warnings {
+			// In production, use proper logging
+			fmt.Printf("Config Warning (%s): %s\n", path, warning)
+		}
+
+		return config, nil
+	}
+
+	// Legacy path: load old config and convert
+	ext := strings.ToLower(filepath.Ext(path))
+	var oldConfig Config
+
+	switch ext {
+	case ".json":
+		if err := json.Unmarshal(data, &oldConfig); err != nil {
+			return nil, fmt.Errorf("failed to parse JSON config: %w", err)
+		}
+	case ".yaml", ".yml":
+		if err := yaml.Unmarshal(data, &oldConfig); err != nil {
+			return nil, fmt.Errorf("failed to parse YAML config: %w", err)
+		}
+	default:
+		return nil, fmt.Errorf("unsupported config file extension: %s", ext)
+	}
+
+	return FromOldConfig(&oldConfig), nil
+}
+
+// LoadFromEnv loads configuration from environment variables
+func (l *ConfigLoader) LoadFromEnv(config *UnifiedConfig) {
+	// Provider configuration
+	l.loadEnvString(&config.Provider.IssuerURL, "PROVIDER_ISSUER_URL", "PROVIDER_URL")
+	l.loadEnvString(&config.Provider.ClientID, "PROVIDER_CLIENT_ID", "CLIENT_ID")
+	l.loadEnvString(&config.Provider.ClientSecret, "PROVIDER_CLIENT_SECRET", "CLIENT_SECRET")
+	l.loadEnvString(&config.Provider.RedirectURL, "PROVIDER_REDIRECT_URL", "CALLBACK_URL")
+	l.loadEnvString(&config.Provider.LogoutURL, "PROVIDER_LOGOUT_URL", "LOGOUT_URL")
+	l.loadEnvString(&config.Provider.PostLogoutRedirectURI, "PROVIDER_POST_LOGOUT_URI", "POST_LOGOUT_REDIRECT_URI")
+	l.loadEnvStringSlice(&config.Provider.Scopes, "PROVIDER_SCOPES", "SCOPES")
+	l.loadEnvBool(&config.Provider.OverrideScopes, "PROVIDER_OVERRIDE_SCOPES", "OVERRIDE_SCOPES")
+
+	// Session configuration
+	l.loadEnvString(&config.Session.Name, "SESSION_NAME")
+	l.loadEnvInt(&config.Session.MaxAge, "SESSION_MAX_AGE")
+	l.loadEnvString(&config.Session.Secret, "SESSION_SECRET")
+	l.loadEnvString(&config.Session.EncryptionKey, "SESSION_ENCRYPTION_KEY")
+	l.loadEnvString(&config.Session.Domain, "SESSION_DOMAIN", "COOKIE_DOMAIN")
+	l.loadEnvBool(&config.Session.Secure, "SESSION_SECURE")
+	l.loadEnvBool(&config.Session.HttpOnly, "SESSION_HTTP_ONLY")
+	l.loadEnvString(&config.Session.SameSite, "SESSION_SAME_SITE")
+
+	// Security configuration
+	l.loadEnvBool(&config.Security.ForceHTTPS, "SECURITY_FORCE_HTTPS", "FORCE_HTTPS")
+	l.loadEnvBool(&config.Security.EnablePKCE, "SECURITY_ENABLE_PKCE", "ENABLE_PKCE")
+	l.loadEnvStringSlice(&config.Security.AllowedUsers, "SECURITY_ALLOWED_USERS", "ALLOWED_USERS")
+	l.loadEnvStringSlice(&config.Security.AllowedUserDomains, "SECURITY_ALLOWED_DOMAINS", "ALLOWED_USER_DOMAINS")
+	l.loadEnvStringSlice(&config.Security.AllowedRolesAndGroups, "SECURITY_ALLOWED_ROLES", "ALLOWED_ROLES_AND_GROUPS")
+	l.loadEnvStringSlice(&config.Security.ExcludedURLs, "SECURITY_EXCLUDED_URLS", "EXCLUDED_URLS")
+
+	// Cache configuration
+	l.loadEnvBool(&config.Cache.Enabled, "CACHE_ENABLED")
+	l.loadEnvString(&config.Cache.Type, "CACHE_TYPE")
+	l.loadEnvInt(&config.Cache.MaxEntries, "CACHE_MAX_ENTRIES")
+	// MaxEntrySize is int64, skip for now
+
+	// Rate limiting
+	l.loadEnvBool(&config.RateLimit.Enabled, "RATELIMIT_ENABLED")
+	l.loadEnvInt(&config.RateLimit.RequestsPerSecond, "RATELIMIT_RPS", "RATE_LIMIT")
+	l.loadEnvInt(&config.RateLimit.Burst, "RATELIMIT_BURST")
+
+	// Logging
+	l.loadEnvString(&config.Logging.Level, "LOGGING_LEVEL", "LOG_LEVEL")
+	l.loadEnvString(&config.Logging.Format, "LOGGING_FORMAT")
+	l.loadEnvString(&config.Logging.Output, "LOGGING_OUTPUT")
+
+	// Redis configuration (already handled by its own LoadFromEnv)
+	config.Redis.LoadFromEnv()
+
+	// Feature flags
+	features.GetManager().LoadFromEnv()
+}
+
+// Helper methods for environment variable loading
+
+func (l *ConfigLoader) loadEnvString(target *string, keys ...string) {
+	for _, key := range keys {
+		if value := os.Getenv(l.envPrefix + key); value != "" {
+			*target = value
+			return
+		}
+		// Try without prefix
+		if value := os.Getenv(key); value != "" {
+			*target = value
+			return
+		}
+	}
+}
+
+func (l *ConfigLoader) loadEnvBool(target *bool, keys ...string) {
+	for _, key := range keys {
+		if value := os.Getenv(l.envPrefix + key); value != "" {
+			*target = strings.ToLower(value) == "true" || value == "1"
+			return
+		}
+		// Try without prefix
+		if value := os.Getenv(key); value != "" {
+			*target = strings.ToLower(value) == "true" || value == "1"
+			return
+		}
+	}
+}
+
+func (l *ConfigLoader) loadEnvInt(target *int, keys ...string) {
+	for _, key := range keys {
+		if value := os.Getenv(l.envPrefix + key); value != "" {
+			var i int
+			if _, err := fmt.Sscanf(value, "%d", &i); err == nil {
+				*target = i
+				return
+			}
+		}
+		// Try without prefix
+		if value := os.Getenv(key); value != "" {
+			var i int
+			if _, err := fmt.Sscanf(value, "%d", &i); err == nil {
+				*target = i
+				return
+			}
+		}
+	}
+}
+
+func (l *ConfigLoader) loadEnvStringSlice(target *[]string, keys ...string) {
+	for _, key := range keys {
+		if value := os.Getenv(l.envPrefix + key); value != "" {
+			*target = splitAndTrim(value)
+			return
+		}
+		// Try without prefix
+		if value := os.Getenv(key); value != "" {
+			*target = splitAndTrim(value)
+			return
+		}
+	}
+}
+
+func splitAndTrim(s string) []string {
+	parts := strings.Split(s, ",")
+	result := make([]string, 0, len(parts))
+	for _, part := range parts {
+		if trimmed := strings.TrimSpace(part); trimmed != "" {
+			result = append(result, trimmed)
+		}
+	}
+	return result
+}
+
+// mergeConfigs merges two configurations, with source overriding target
+func (l *ConfigLoader) mergeConfigs(target, source *UnifiedConfig) *UnifiedConfig {
+	if source == nil {
+		return target
+	}
+	if target == nil {
+		return source
+	}
+
+	// Use reflection for deep merge
+	l.mergeStructs(reflect.ValueOf(target).Elem(), reflect.ValueOf(source).Elem())
+
+	return target
+}
+
+// mergeStructs recursively merges two structs
+func (l *ConfigLoader) mergeStructs(target, source reflect.Value) {
+	for i := 0; i < source.NumField(); i++ {
+		sourceField := source.Field(i)
+		targetField := target.Field(i)
+
+		// Skip if source field is zero value
+		if isZeroValue(sourceField) {
+			continue
+		}
+
+		switch sourceField.Kind() {
+		case reflect.Struct:
+			// Recursively merge structs
+			l.mergeStructs(targetField, sourceField)
+		case reflect.Slice:
+			// Replace slice if source has values
+			if sourceField.Len() > 0 {
+				targetField.Set(sourceField)
+			}
+		case reflect.Map:
+			// Merge maps
+			if !sourceField.IsNil() {
+				if targetField.IsNil() {
+					targetField.Set(reflect.MakeMap(sourceField.Type()))
+				}
+				for _, key := range sourceField.MapKeys() {
+					targetField.SetMapIndex(key, sourceField.MapIndex(key))
+				}
+			}
+		default:
+			// Replace value
+			targetField.Set(sourceField)
+		}
+	}
+}
+
+// isZeroValue checks if a reflect.Value is a zero value
+func isZeroValue(v reflect.Value) bool {
+	switch v.Kind() {
+	case reflect.Ptr, reflect.Interface:
+		return v.IsNil()
+	case reflect.Slice, reflect.Map:
+		return v.IsNil() || v.Len() == 0
+	case reflect.Struct:
+		// Check if all fields are zero
+		for i := 0; i < v.NumField(); i++ {
+			if !isZeroValue(v.Field(i)) {
+				return false
+			}
+		}
+		return true
+	default:
+		zero := reflect.Zero(v.Type())
+		return reflect.DeepEqual(v.Interface(), zero.Interface())
+	}
+}
+
+// SaveToFile saves the configuration to a file
+func (l *ConfigLoader) SaveToFile(config *UnifiedConfig, path string) error {
+	// Clean and validate path to prevent traversal attacks
+	cleanPath := filepath.Clean(path)
+
+	// Check for path traversal attempts
+	if strings.Contains(cleanPath, "..") {
+		return fmt.Errorf("invalid config path: potential path traversal detected in %s", path)
+	}
+
+	// Ensure the path is within expected directories
+	absPath, err := filepath.Abs(cleanPath)
+	if err != nil {
+		return fmt.Errorf("failed to resolve absolute path for %s: %w", path, err)
+	}
+
+	ext := strings.ToLower(filepath.Ext(absPath))
+
+	var data []byte
+
+	switch ext {
+	case ".json":
+		data, err = json.MarshalIndent(config, "", "  ")
+	case ".yaml", ".yml":
+		data, err = yaml.Marshal(config)
+	default:
+		return fmt.Errorf("unsupported file extension: %s", ext)
+	}
+
+	if err != nil {
+		return fmt.Errorf("failed to marshal config: %w", err)
+	}
+
+	// Create directory if it doesn't exist with secure permissions
+	dir := filepath.Dir(absPath)
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		return fmt.Errorf("failed to create directory %s: %w", dir, err)
+	}
+
+	// Write file with secure permissions (owner read/write only)
+	if err := os.WriteFile(absPath, data, 0600); err != nil {
+		return fmt.Errorf("failed to write config file %s: %w", absPath, err)
+	}
+
+	return nil
+}

config/loader_test.go

@@ -0,0 +1,832 @@
+//go:build !yaegi
+
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+// TestConfigLoader tests the config loader functionality
+func TestConfigLoader(t *testing.T) {
+	loader := NewConfigLoader()
+
+	if loader == nil {
+		t.Fatal("NewConfigLoader should not return nil")
+	}
+
+	if loader.migrator == nil {
+		t.Error("ConfigLoader should have a migrator")
+	}
+
+	if loader.envPrefix != "TRAEFIKOIDC_" {
+		t.Errorf("Expected envPrefix to be 'TRAEFIKOIDC_', got %s", loader.envPrefix)
+	}
+
+	if len(loader.configPaths) == 0 {
+		t.Error("ConfigLoader should have default config paths")
+	}
+}
+
+// TestLoadFromEnv tests loading configuration from environment variables
+func TestLoadFromEnv(t *testing.T) {
+	// Set up test environment variables
+	testEnvVars := map[string]string{
+		"TRAEFIKOIDC_PROVIDER_ISSUER_URL":    "https://test.example.com",
+		"TRAEFIKOIDC_PROVIDER_CLIENT_ID":     "test-client-id",
+		"TRAEFIKOIDC_PROVIDER_CLIENT_SECRET": "test-secret",
+		"TRAEFIKOIDC_SESSION_ENCRYPTION_KEY": "32-character-encryption-key-12345",
+		"TRAEFIKOIDC_SESSION_CHUNKED":        "true",
+		"TRAEFIKOIDC_REDIS_ENABLED":          "true",
+		"TRAEFIKOIDC_REDIS_ADDR":             "redis.example.com:6379",
+		"TRAEFIKOIDC_SECURITY_FORCE_HTTPS":   "true",
+		"TRAEFIKOIDC_CACHE_ENABLED":          "true",
+		"TRAEFIKOIDC_CACHE_TYPE":             "redis",
+		"TRAEFIKOIDC_RATELIMIT_ENABLED":      "true",
+		"TRAEFIKOIDC_RATELIMIT_RPS":          "100",
+	}
+
+	// Set environment variables
+	for key, value := range testEnvVars {
+		os.Setenv(key, value)
+		defer os.Unsetenv(key)
+	}
+
+	loader := NewConfigLoader()
+	config := &UnifiedConfig{}
+	loader.LoadFromEnv(config)
+
+	// Verify values were loaded
+	if config.Provider.IssuerURL != "https://test.example.com" {
+		t.Errorf("Expected IssuerURL to be 'https://test.example.com', got %s", config.Provider.IssuerURL)
+	}
+	if config.Provider.ClientID != "test-client-id" {
+		t.Errorf("Expected ClientID to be 'test-client-id', got %s", config.Provider.ClientID)
+	}
+	if config.Provider.ClientSecret != "test-secret" {
+		t.Errorf("Expected ClientSecret to be 'test-secret', got %s", config.Provider.ClientSecret)
+	}
+	if config.Session.EncryptionKey != "32-character-encryption-key-12345" {
+		t.Errorf("Expected EncryptionKey to be set, got %s", config.Session.EncryptionKey)
+	}
+	if !config.Security.ForceHTTPS {
+		t.Error("Expected ForceHTTPS to be true")
+	}
+	if !config.Cache.Enabled {
+		t.Error("Expected Cache to be enabled")
+	}
+	if config.Cache.Type != "redis" {
+		t.Errorf("Expected Cache.Type to be 'redis', got %s", config.Cache.Type)
+	}
+	if !config.RateLimit.Enabled {
+		t.Error("Expected RateLimit to be enabled")
+	}
+	if config.RateLimit.RequestsPerSecond != 100 {
+		t.Errorf("Expected RequestsPerSecond to be 100, got %d", config.RateLimit.RequestsPerSecond)
+	}
+}
+
+// TestSaveToFile tests saving configuration to files
+func TestSaveToFile(t *testing.T) {
+	// Create a temporary directory for test files
+	tmpDir, err := os.MkdirTemp("", "config-test-*")
+	if err != nil {
+		t.Fatalf("Failed to create temp directory: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	loader := NewConfigLoader()
+	config := &UnifiedConfig{
+		Provider: ProviderConfig{
+			IssuerURL:    "https://auth.example.com",
+			ClientID:     "test-client",
+			ClientSecret: "secret",
+		},
+		Session: SessionConfig{
+			EncryptionKey: "32-character-encryption-key-12345",
+		},
+	}
+
+	tests := []struct {
+		name     string
+		filename string
+		wantErr  bool
+	}{
+		{
+			name:     "save as JSON",
+			filename: "config.json",
+			wantErr:  false,
+		},
+		{
+			name:     "save as YAML",
+			filename: "config.yaml",
+			wantErr:  false,
+		},
+		{
+			name:     "save as YML",
+			filename: "config.yml",
+			wantErr:  false,
+		},
+		{
+			name:     "unsupported extension",
+			filename: "config.txt",
+			wantErr:  true,
+		},
+		{
+			name:     "path traversal attempt",
+			filename: "../../../etc/config.json",
+			wantErr:  true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			filePath := filepath.Join(tmpDir, tt.filename)
+			err := loader.SaveToFile(config, filePath)
+
+			if tt.wantErr {
+				if err == nil {
+					t.Error("Expected error but got none")
+				}
+				return
+			}
+
+			if err != nil {
+				t.Errorf("Unexpected error: %v", err)
+				return
+			}
+
+			// Verify file was created with correct permissions
+			info, err := os.Stat(filePath)
+			if err != nil {
+				t.Errorf("Failed to stat saved file: %v", err)
+				return
+			}
+
+			// Check file permissions (should be 0600)
+			mode := info.Mode().Perm()
+			if mode != 0600 {
+				t.Errorf("Expected file permissions 0600, got %o", mode)
+			}
+
+			// Verify content can be read back
+			data, err := os.ReadFile(filePath)
+			if err != nil {
+				t.Errorf("Failed to read saved file: %v", err)
+				return
+			}
+
+			// Verify secrets are redacted
+			content := string(data)
+			if strings.Contains(content, "secret") && !strings.Contains(content, "[REDACTED]") {
+				t.Error("Secrets should be redacted in saved file")
+			}
+		})
+	}
+}
+
+// TestLoadFile tests loading configuration from files
+func TestLoadFile(t *testing.T) {
+	// Create a temporary directory for test files
+	tmpDir, err := os.MkdirTemp("", "config-test-*")
+	if err != nil {
+		t.Fatalf("Failed to create temp directory: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	// Test data - using old config format since unified config is not enabled by default
+	jsonConfig := `{
+		"providerURL": "https://auth.example.com",
+		"clientID": "test-client",
+		"clientSecret": "secret",
+		"sessionEncryptionKey": "32-character-encryption-key-12345"
+	}`
+
+	yamlConfig := `
+providerurl: https://auth.example.com
+clientid: test-client
+clientsecret: secret
+sessionencryptionkey: 32-character-encryption-key-12345
+`
+
+	tests := []struct {
+		name     string
+		filename string
+		content  string
+		wantErr  bool
+	}{
+		{
+			name:     "load JSON config",
+			filename: "config.json",
+			content:  jsonConfig,
+			wantErr:  false,
+		},
+		{
+			name:     "load YAML config",
+			filename: "config.yaml",
+			content:  yamlConfig,
+			wantErr:  false,
+		},
+		{
+			name:     "path traversal attempt",
+			filename: "../../../etc/passwd",
+			content:  "",
+			wantErr:  true,
+		},
+		{
+			name:     "non-existent file",
+			filename: "does-not-exist.json",
+			content:  "",
+			wantErr:  true,
+		},
+	}
+
+	loader := NewConfigLoader()
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var filePath string
+			if tt.content != "" {
+				filePath = filepath.Join(tmpDir, tt.filename)
+				err := os.WriteFile(filePath, []byte(tt.content), 0600)
+				if err != nil {
+					t.Fatalf("Failed to write test file: %v", err)
+					return
+				}
+			} else {
+				filePath = tt.filename
+			}
+
+			config, err := loader.loadFile(filePath)
+
+			if tt.wantErr {
+				if err == nil {
+					t.Error("Expected error but got none")
+				}
+				return
+			}
+
+			if err != nil {
+				if !os.IsNotExist(err) && !strings.Contains(err.Error(), "no such file") {
+					t.Errorf("Unexpected error: %v", err)
+				}
+				return
+			}
+
+			// Verify loaded config
+			if config == nil {
+				t.Error("Expected config to be loaded")
+				return
+			}
+
+			if config.Provider.IssuerURL != "https://auth.example.com" {
+				t.Errorf("Expected IssuerURL to be 'https://auth.example.com', got %s", config.Provider.IssuerURL)
+			}
+			if config.Provider.ClientID != "test-client" {
+				t.Errorf("Expected ClientID to be 'test-client', got %s", config.Provider.ClientID)
+			}
+		})
+	}
+}
+
+// ====================================================================================
+// Tests for untested functions (0% coverage)
+// ====================================================================================
+
+// TestConfigLoader_Load tests the full Load pipeline
+func TestConfigLoader_Load(t *testing.T) {
+	tmpDir, err := os.MkdirTemp("", "config-load-test-*")
+	if err != nil {
+		t.Fatalf("Failed to create temp directory: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	// Create a test config file
+	configPath := filepath.Join(tmpDir, "traefik-oidc.json")
+	configData := `{
+		"providerURL": "https://auth.example.com",
+		"clientID": "test-client",
+		"clientSecret": "test-secret",
+		"sessionEncryptionKey": "32-character-encryption-key-12345"
+	}`
+	err = os.WriteFile(configPath, []byte(configData), 0600)
+	if err != nil {
+		t.Fatalf("Failed to write test config file: %v", err)
+	}
+
+	// Change to temp directory so loader can find the config
+	oldDir, _ := os.Getwd()
+	os.Chdir(tmpDir)
+	defer os.Chdir(oldDir)
+
+	// Set some environment variables to test merging
+	os.Setenv("TRAEFIKOIDC_SECURITY_FORCE_HTTPS", "true")
+	defer os.Unsetenv("TRAEFIKOIDC_SECURITY_FORCE_HTTPS")
+
+	loader := NewConfigLoader()
+	config, err := loader.Load()
+
+	if err != nil {
+		t.Fatalf("Load() failed: %v", err)
+	}
+
+	if config == nil {
+		t.Fatal("Load() returned nil config")
+	}
+
+	// Verify file was loaded
+	if config.Provider.IssuerURL != "https://auth.example.com" {
+		t.Errorf("Expected IssuerURL from file, got %s", config.Provider.IssuerURL)
+	}
+
+	// Verify env vars were loaded
+	if !config.Security.ForceHTTPS {
+		t.Error("Expected ForceHTTPS from env var to be true")
+	}
+}
+
+// TestConfigLoader_LoadFromFile tests the LoadFromFile function
+func TestConfigLoader_LoadFromFile(t *testing.T) {
+	t.Run("NoConfigFile", func(t *testing.T) {
+		tmpDir, err := os.MkdirTemp("", "config-nofile-test-*")
+		if err != nil {
+			t.Fatalf("Failed to create temp directory: %v", err)
+		}
+		defer os.RemoveAll(tmpDir)
+
+		oldDir, _ := os.Getwd()
+		os.Chdir(tmpDir)
+		defer os.Chdir(oldDir)
+
+		loader := NewConfigLoader()
+		config, err := loader.LoadFromFile()
+
+		// Should not error when no config file found
+		if err != nil {
+			t.Errorf("LoadFromFile() should not error when no file found: %v", err)
+		}
+
+		// Should return nil config
+		if config != nil {
+			t.Error("LoadFromFile() should return nil config when no file found")
+		}
+	})
+
+	t.Run("LoadFromEnvPath", func(t *testing.T) {
+		tmpDir, err := os.MkdirTemp("", "config-envpath-test-*")
+		if err != nil {
+			t.Fatalf("Failed to create temp directory: %v", err)
+		}
+		defer os.RemoveAll(tmpDir)
+
+		// Create config file
+		configPath := filepath.Join(tmpDir, "custom-config.json")
+		configData := `{
+			"providerURL": "https://custom.example.com",
+			"clientID": "custom-client"
+		}`
+		err = os.WriteFile(configPath, []byte(configData), 0600)
+		if err != nil {
+			t.Fatalf("Failed to write test config: %v", err)
+		}
+
+		// Set env variable pointing to config
+		os.Setenv("TRAEFIKOIDC_CONFIG_FILE", configPath)
+		defer os.Unsetenv("TRAEFIKOIDC_CONFIG_FILE")
+
+		loader := NewConfigLoader()
+		config, err := loader.LoadFromFile()
+
+		if err != nil {
+			t.Fatalf("LoadFromFile() failed: %v", err)
+		}
+
+		if config == nil {
+			t.Fatal("LoadFromFile() returned nil config")
+		}
+
+		if config.Provider.IssuerURL != "https://custom.example.com" {
+			t.Errorf("Expected IssuerURL 'https://custom.example.com', got %s", config.Provider.IssuerURL)
+		}
+	})
+
+	t.Run("LoadWithProvidedPaths", func(t *testing.T) {
+		tmpDir, err := os.MkdirTemp("", "config-provided-test-*")
+		if err != nil {
+			t.Fatalf("Failed to create temp directory: %v", err)
+		}
+		defer os.RemoveAll(tmpDir)
+
+		// Create config file
+		configPath := filepath.Join(tmpDir, "specific.json")
+		configData := `{
+			"providerURL": "https://specific.example.com",
+			"clientID": "specific-client"
+		}`
+		err = os.WriteFile(configPath, []byte(configData), 0600)
+		if err != nil {
+			t.Fatalf("Failed to write test config: %v", err)
+		}
+
+		loader := NewConfigLoader()
+		config, err := loader.LoadFromFile(configPath)
+
+		if err != nil {
+			t.Fatalf("LoadFromFile() with path failed: %v", err)
+		}
+
+		if config == nil {
+			t.Fatal("LoadFromFile() returned nil config")
+		}
+
+		if config.Provider.IssuerURL != "https://specific.example.com" {
+			t.Errorf("Expected IssuerURL 'https://specific.example.com', got %s", config.Provider.IssuerURL)
+		}
+	})
+}
+
+// TestSplitAndTrim tests the splitAndTrim helper function
+func TestSplitAndTrim(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected []string
+	}{
+		{
+			name:     "Simple comma-separated",
+			input:    "a,b,c",
+			expected: []string{"a", "b", "c"},
+		},
+		{
+			name:     "With spaces",
+			input:    "a, b , c",
+			expected: []string{"a", "b", "c"},
+		},
+		{
+			name:     "Empty strings filtered out",
+			input:    "a,,b, ,c",
+			expected: []string{"a", "b", "c"},
+		},
+		{
+			name:     "Leading and trailing spaces",
+			input:    "  a  ,  b  ,  c  ",
+			expected: []string{"a", "b", "c"},
+		},
+		{
+			name:     "Single value",
+			input:    "single",
+			expected: []string{"single"},
+		},
+		{
+			name:     "Empty string",
+			input:    "",
+			expected: []string{},
+		},
+		{
+			name:     "Only commas and spaces",
+			input:    " , , , ",
+			expected: []string{},
+		},
+		{
+			name:     "Complex real-world example",
+			input:    "openid, profile, email, groups",
+			expected: []string{"openid", "profile", "email", "groups"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := splitAndTrim(tt.input)
+
+			if len(result) != len(tt.expected) {
+				t.Errorf("Expected %d items, got %d: %v", len(tt.expected), len(result), result)
+				return
+			}
+
+			for i, expected := range tt.expected {
+				if result[i] != expected {
+					t.Errorf("At index %d: expected %q, got %q", i, expected, result[i])
+				}
+			}
+		})
+	}
+}
+
+// TestConfigLoader_MergeConfigs tests the mergeConfigs function
+func TestConfigLoader_MergeConfigs(t *testing.T) {
+	loader := NewConfigLoader()
+
+	t.Run("MergeNilSource", func(t *testing.T) {
+		target := &UnifiedConfig{
+			Provider: ProviderConfig{
+				IssuerURL: "https://target.example.com",
+			},
+		}
+
+		result := loader.mergeConfigs(target, nil)
+
+		if result != target {
+			t.Error("mergeConfigs should return target when source is nil")
+		}
+	})
+
+	t.Run("MergeNilTarget", func(t *testing.T) {
+		source := &UnifiedConfig{
+			Provider: ProviderConfig{
+				IssuerURL: "https://source.example.com",
+			},
+		}
+
+		result := loader.mergeConfigs(nil, source)
+
+		if result != source {
+			t.Error("mergeConfigs should return source when target is nil")
+		}
+	})
+
+	t.Run("MergeSimpleFields", func(t *testing.T) {
+		target := &UnifiedConfig{
+			Provider: ProviderConfig{
+				IssuerURL: "https://target.example.com",
+				ClientID:  "",
+			},
+		}
+
+		source := &UnifiedConfig{
+			Provider: ProviderConfig{
+				IssuerURL: "https://source.example.com",
+				ClientID:  "source-client",
+			},
+		}
+
+		result := loader.mergeConfigs(target, source)
+
+		if result.Provider.IssuerURL != "https://source.example.com" {
+			t.Errorf("Expected IssuerURL to be overridden, got %s", result.Provider.IssuerURL)
+		}
+
+		if result.Provider.ClientID != "source-client" {
+			t.Errorf("Expected ClientID to be set, got %s", result.Provider.ClientID)
+		}
+	})
+
+	t.Run("MergeSlices", func(t *testing.T) {
+		target := &UnifiedConfig{
+			Provider: ProviderConfig{
+				Scopes: []string{"openid", "profile"},
+			},
+		}
+
+		source := &UnifiedConfig{
+			Provider: ProviderConfig{
+				Scopes: []string{"email", "groups"},
+			},
+		}
+
+		result := loader.mergeConfigs(target, source)
+
+		// Source slice should replace target slice
+		if len(result.Provider.Scopes) != 2 {
+			t.Errorf("Expected 2 scopes, got %d", len(result.Provider.Scopes))
+		}
+
+		if result.Provider.Scopes[0] != "email" {
+			t.Errorf("Expected first scope 'email', got %s", result.Provider.Scopes[0])
+		}
+	})
+
+	t.Run("MergeMaps", func(t *testing.T) {
+		target := &UnifiedConfig{
+			Middleware: MiddlewareConfig{
+				CustomHeaders: map[string]string{
+					"X-Target-Header": "target-value",
+				},
+			},
+		}
+
+		source := &UnifiedConfig{
+			Middleware: MiddlewareConfig{
+				CustomHeaders: map[string]string{
+					"X-Source-Header": "source-value",
+					"X-Target-Header": "overridden-value",
+				},
+			},
+		}
+
+		result := loader.mergeConfigs(target, source)
+
+		if len(result.Middleware.CustomHeaders) != 2 {
+			t.Errorf("Expected 2 headers, got %d", len(result.Middleware.CustomHeaders))
+		}
+
+		if result.Middleware.CustomHeaders["X-Target-Header"] != "overridden-value" {
+			t.Errorf("Expected X-Target-Header to be overridden")
+		}
+
+		if result.Middleware.CustomHeaders["X-Source-Header"] != "source-value" {
+			t.Errorf("Expected X-Source-Header to be added")
+		}
+	})
+}
+
+// TestConfigLoader_MergeStructs tests the mergeStructs function indirectly
+func TestConfigLoader_MergeStructs(t *testing.T) {
+	loader := NewConfigLoader()
+
+	t.Run("NestedStructMerge", func(t *testing.T) {
+		target := &UnifiedConfig{
+			Provider: ProviderConfig{
+				IssuerURL: "https://target.example.com",
+				ClientID:  "target-client",
+			},
+			Session: SessionConfig{
+				Name:   "target-session",
+				MaxAge: 3600,
+			},
+		}
+
+		source := &UnifiedConfig{
+			Provider: ProviderConfig{
+				ClientID:     "source-client",
+				ClientSecret: "source-secret",
+			},
+			Session: SessionConfig{
+				MaxAge: 7200,
+			},
+		}
+
+		result := loader.mergeConfigs(target, source)
+
+		// Provider.IssuerURL should remain (zero value in source)
+		if result.Provider.IssuerURL != "https://target.example.com" {
+			t.Errorf("Expected IssuerURL to remain, got %s", result.Provider.IssuerURL)
+		}
+
+		// Provider.ClientID should be overridden
+		if result.Provider.ClientID != "source-client" {
+			t.Errorf("Expected ClientID to be overridden, got %s", result.Provider.ClientID)
+		}
+
+		// Provider.ClientSecret should be added
+		if result.Provider.ClientSecret != "source-secret" {
+			t.Errorf("Expected ClientSecret to be added, got %s", result.Provider.ClientSecret)
+		}
+
+		// Session.Name should remain (zero value in source)
+		if result.Session.Name != "target-session" {
+			t.Errorf("Expected Session.Name to remain, got %s", result.Session.Name)
+		}
+
+		// Session.MaxAge should be overridden
+		if result.Session.MaxAge != 7200 {
+			t.Errorf("Expected Session.MaxAge to be overridden, got %d", result.Session.MaxAge)
+		}
+	})
+}
+
+// TestIsZeroValue tests the isZeroValue helper function
+func TestIsZeroValue(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    interface{}
+		expected bool
+	}{
+		{
+			name:     "Zero string",
+			value:    "",
+			expected: true,
+		},
+		{
+			name:     "Non-zero string",
+			value:    "hello",
+			expected: false,
+		},
+		{
+			name:     "Zero int",
+			value:    0,
+			expected: true,
+		},
+		{
+			name:     "Non-zero int",
+			value:    42,
+			expected: false,
+		},
+		{
+			name:     "Zero bool",
+			value:    false,
+			expected: true,
+		},
+		{
+			name:     "Non-zero bool",
+			value:    true,
+			expected: false,
+		},
+		{
+			name:     "Nil pointer",
+			value:    (*string)(nil),
+			expected: true,
+		},
+		{
+			name:     "Non-nil pointer",
+			value:    stringPtr("test"),
+			expected: false,
+		},
+		{
+			name:     "Nil slice",
+			value:    ([]string)(nil),
+			expected: true,
+		},
+		{
+			name:     "Empty slice",
+			value:    []string{},
+			expected: true,
+		},
+		{
+			name:     "Non-empty slice",
+			value:    []string{"a"},
+			expected: false,
+		},
+		{
+			name:     "Nil map",
+			value:    (map[string]string)(nil),
+			expected: true,
+		},
+		{
+			name:     "Empty map",
+			value:    map[string]string{},
+			expected: true,
+		},
+		{
+			name:     "Non-empty map",
+			value:    map[string]string{"key": "value"},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			v := reflect.ValueOf(tt.value)
+			result := isZeroValue(v)
+
+			if result != tt.expected {
+				t.Errorf("Expected isZeroValue to be %v, got %v", tt.expected, result)
+			}
+		})
+	}
+}
+
+// TestIsZeroValue_Struct tests isZeroValue with struct types
+func TestIsZeroValue_Struct(t *testing.T) {
+	type TestStruct struct {
+		Field1 string
+		Field2 int
+	}
+
+	t.Run("Zero struct", func(t *testing.T) {
+		s := TestStruct{}
+		v := reflect.ValueOf(s)
+		result := isZeroValue(v)
+
+		if !result {
+			t.Error("Expected zero struct to return true")
+		}
+	})
+
+	t.Run("Non-zero struct - Field1 set", func(t *testing.T) {
+		s := TestStruct{Field1: "test"}
+		v := reflect.ValueOf(s)
+		result := isZeroValue(v)
+
+		if result {
+			t.Error("Expected non-zero struct to return false")
+		}
+	})
+
+	t.Run("Non-zero struct - Field2 set", func(t *testing.T) {
+		s := TestStruct{Field2: 42}
+		v := reflect.ValueOf(s)
+		result := isZeroValue(v)
+
+		if result {
+			t.Error("Expected non-zero struct to return false")
+		}
+	})
+
+	t.Run("Non-zero struct - Both fields set", func(t *testing.T) {
+		s := TestStruct{Field1: "test", Field2: 42}
+		v := reflect.ValueOf(s)
+		result := isZeroValue(v)
+
+		if result {
+			t.Error("Expected non-zero struct to return false")
+		}
+	})
+}
+
+// Helper function for pointer tests
+func stringPtr(s string) *string {
+	return &s
+}

config/marshalling.go

@@ -0,0 +1,169 @@
+// Package config provides unified configuration management for the OIDC middleware
+package config
+
+import (
+	"encoding/json"
+)
+
+// REDACTED is the placeholder value for sensitive information
+const REDACTED = "[REDACTED]"
+
+// MarshalJSON implements custom JSON marshalling to redact sensitive fields
+func (c UnifiedConfig) MarshalJSON() ([]byte, error) {
+	// Create an alias to avoid recursion
+	type Alias UnifiedConfig
+
+	// Create a copy with redacted sensitive fields
+	copy := (Alias)(c)
+
+	// Redact provider secrets
+	if copy.Provider.ClientSecret != "" {
+		copy.Provider.ClientSecret = REDACTED
+	}
+
+	// Redact session secrets
+	if copy.Session.Secret != "" {
+		copy.Session.Secret = REDACTED
+	}
+	if copy.Session.EncryptionKey != "" {
+		copy.Session.EncryptionKey = REDACTED
+	}
+	if copy.Session.SigningKey != "" {
+		copy.Session.SigningKey = REDACTED
+	}
+
+	// Redact Redis passwords
+	if copy.Redis.Password != "" {
+		copy.Redis.Password = REDACTED
+	}
+	if copy.Redis.SentinelPassword != "" {
+		copy.Redis.SentinelPassword = REDACTED
+	}
+
+	return json.Marshal(copy)
+}
+
+// MarshalJSON for ProviderConfig to redact sensitive fields
+func (p ProviderConfig) MarshalJSON() ([]byte, error) {
+	type Alias ProviderConfig
+	copy := (Alias)(p)
+
+	if copy.ClientSecret != "" {
+		copy.ClientSecret = REDACTED
+	}
+
+	return json.Marshal(copy)
+}
+
+// MarshalJSON for SessionConfig to redact sensitive fields
+func (s SessionConfig) MarshalJSON() ([]byte, error) {
+	type Alias SessionConfig
+	copy := (Alias)(s)
+
+	if copy.Secret != "" {
+		copy.Secret = REDACTED
+	}
+	if copy.EncryptionKey != "" {
+		copy.EncryptionKey = REDACTED
+	}
+	if copy.SigningKey != "" {
+		copy.SigningKey = REDACTED
+	}
+
+	return json.Marshal(copy)
+}
+
+// MarshalJSON for RedisConfig to redact sensitive fields
+func (r RedisConfig) MarshalJSON() ([]byte, error) {
+	type Alias RedisConfig
+	copy := (Alias)(r)
+
+	if copy.Password != "" {
+		copy.Password = REDACTED
+	}
+	if copy.SentinelPassword != "" {
+		copy.SentinelPassword = REDACTED
+	}
+
+	return json.Marshal(copy)
+}
+
+// MarshalYAML implements custom YAML marshalling to redact sensitive fields
+func (c UnifiedConfig) MarshalYAML() (interface{}, error) {
+	// Create an alias to avoid recursion
+	type Alias UnifiedConfig
+
+	// Create a copy with redacted sensitive fields
+	copy := (Alias)(c)
+
+	// Redact provider secrets
+	if copy.Provider.ClientSecret != "" {
+		copy.Provider.ClientSecret = REDACTED
+	}
+
+	// Redact session secrets
+	if copy.Session.Secret != "" {
+		copy.Session.Secret = REDACTED
+	}
+	if copy.Session.EncryptionKey != "" {
+		copy.Session.EncryptionKey = REDACTED
+	}
+	if copy.Session.SigningKey != "" {
+		copy.Session.SigningKey = REDACTED
+	}
+
+	// Redact Redis passwords
+	if copy.Redis.Password != "" {
+		copy.Redis.Password = REDACTED
+	}
+	if copy.Redis.SentinelPassword != "" {
+		copy.Redis.SentinelPassword = REDACTED
+	}
+
+	return copy, nil
+}
+
+// MarshalYAML for ProviderConfig to redact sensitive fields
+func (p ProviderConfig) MarshalYAML() (interface{}, error) {
+	type Alias ProviderConfig
+	copy := (Alias)(p)
+
+	if copy.ClientSecret != "" {
+		copy.ClientSecret = REDACTED
+	}
+
+	return copy, nil
+}
+
+// MarshalYAML for SessionConfig to redact sensitive fields
+func (s SessionConfig) MarshalYAML() (interface{}, error) {
+	type Alias SessionConfig
+	copy := (Alias)(s)
+
+	if copy.Secret != "" {
+		copy.Secret = REDACTED
+	}
+	if copy.EncryptionKey != "" {
+		copy.EncryptionKey = REDACTED
+	}
+	if copy.SigningKey != "" {
+		copy.SigningKey = REDACTED
+	}
+
+	return copy, nil
+}
+
+// MarshalYAML for RedisConfig to redact sensitive fields
+func (r RedisConfig) MarshalYAML() (interface{}, error) {
+	type Alias RedisConfig
+	copy := (Alias)(r)
+
+	if copy.Password != "" {
+		copy.Password = REDACTED
+	}
+	if copy.SentinelPassword != "" {
+		copy.SentinelPassword = REDACTED
+	}
+
+	return copy, nil
+}

config/migration.go

@@ -0,0 +1,407 @@
+// Package config provides configuration migration from old to new format
+package config
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/lukaszraczylo/traefikoidc/internal/compat"
+	"github.com/lukaszraczylo/traefikoidc/internal/features"
+	"gopkg.in/yaml.v3"
+)
+
+// ConfigVersion represents the version of a configuration format
+type ConfigVersion string
+
+const (
+	// VersionLegacy represents the original config format
+	VersionLegacy ConfigVersion = "legacy"
+
+	// VersionUnified represents the new unified config format
+	VersionUnified ConfigVersion = "unified"
+
+	// CurrentVersion is the current config version
+	CurrentVersion ConfigVersion = VersionUnified
+)
+
+// ConfigMigrator handles migration between config versions
+type ConfigMigrator struct {
+	compatLayer *compat.CompatibilityLayer
+	migrations  map[ConfigVersion]MigrationFunc
+}
+
+// MigrationFunc defines a function that migrates configuration
+type MigrationFunc func(data map[string]interface{}) (*UnifiedConfig, error)
+
+// NewConfigMigrator creates a new configuration migrator
+func NewConfigMigrator() *ConfigMigrator {
+	m := &ConfigMigrator{
+		compatLayer: compat.GetLayer(),
+		migrations:  make(map[ConfigVersion]MigrationFunc),
+	}
+
+	// Register migration functions
+	m.migrations[VersionLegacy] = m.migrateLegacyToUnified
+
+	return m
+}
+
+// DetectVersion detects the version of a configuration
+func (m *ConfigMigrator) DetectVersion(data []byte) ConfigVersion {
+	var testMap map[string]interface{}
+
+	// Try JSON first
+	if err := json.Unmarshal(data, &testMap); err != nil {
+		// Try YAML
+		if err := yaml.Unmarshal(data, &testMap); err != nil {
+			return VersionLegacy // Default to legacy if can't parse
+		}
+	}
+
+	// Check for unified config markers
+	if _, hasProvider := testMap["provider"]; hasProvider {
+		if _, hasSession := testMap["session"]; hasSession {
+			return VersionUnified
+		}
+	}
+
+	// Check for legacy config markers
+	if _, hasProviderURL := testMap["providerUrl"]; hasProviderURL {
+		return VersionLegacy
+	}
+	if _, hasProviderURL := testMap["ProviderURL"]; hasProviderURL {
+		return VersionLegacy
+	}
+
+	return VersionLegacy
+}
+
+// Migrate migrates configuration data to the current version
+func (m *ConfigMigrator) Migrate(data []byte) (*UnifiedConfig, []string, error) {
+	warnings := []string{}
+
+	// Detect version
+	version := m.DetectVersion(data)
+
+	// If already current version, just unmarshal
+	if version == CurrentVersion {
+		var config UnifiedConfig
+		if err := json.Unmarshal(data, &config); err != nil {
+			// Try YAML
+			if err := yaml.Unmarshal(data, &config); err != nil {
+				return nil, warnings, fmt.Errorf("failed to unmarshal unified config: %w", err)
+			}
+		}
+		return &config, warnings, nil
+	}
+
+	// Parse to generic map
+	var configMap map[string]interface{}
+	if err := json.Unmarshal(data, &configMap); err != nil {
+		// Try YAML
+		if err := yaml.Unmarshal(data, &configMap); err != nil {
+			return nil, warnings, fmt.Errorf("failed to unmarshal config: %w", err)
+		}
+	}
+
+	// Apply migration
+	migrationFunc, exists := m.migrations[version]
+	if !exists {
+		return nil, warnings, fmt.Errorf("no migration path from version %s", version)
+	}
+
+	config, err := migrationFunc(configMap)
+	if err != nil {
+		return nil, warnings, fmt.Errorf("migration failed: %w", err)
+	}
+
+	// Collect any deprecation warnings
+	for key := range configMap {
+		if warning, deprecated := m.compatLayer.CheckDeprecation(key); deprecated {
+			warnings = append(warnings, warning)
+		}
+	}
+
+	return config, warnings, nil
+}
+
+// migrateLegacyToUnified migrates legacy config to unified format
+func (m *ConfigMigrator) migrateLegacyToUnified(data map[string]interface{}) (*UnifiedConfig, error) {
+	config := NewUnifiedConfig()
+
+	// Use compatibility layer for field mapping
+	migratedMap, warnings := m.compatLayer.MigrateMap(data)
+
+	// Log warnings
+	for _, warning := range warnings {
+		// In production, these would be logged
+		_ = warning
+	}
+
+	// Map provider configuration
+	if provider, ok := getNestedMap(migratedMap, "Provider"); ok {
+		_ = mapToStruct(provider, &config.Provider)
+	} else {
+		// Direct field mapping for legacy format
+		config.Provider.IssuerURL = getStringValue(data, "providerUrl", "ProviderURL")
+		config.Provider.ClientID = getStringValue(data, "clientId", "ClientID")
+		config.Provider.ClientSecret = getStringValue(data, "clientSecret", "ClientSecret")
+		config.Provider.RedirectURL = getStringValue(data, "callbackUrl", "CallbackURL")
+		config.Provider.LogoutURL = getStringValue(data, "logoutUrl", "LogoutURL")
+		config.Provider.PostLogoutRedirectURI = getStringValue(data, "postLogoutRedirectUri", "PostLogoutRedirectURI")
+
+		if scopes := getArrayValue(data, "scopes", "Scopes"); scopes != nil {
+			config.Provider.Scopes = scopes
+		}
+		config.Provider.OverrideScopes = getBoolValue(data, "overrideScopes", "OverrideScopes")
+	}
+
+	// Map session configuration
+	if session, ok := getNestedMap(migratedMap, "Session"); ok {
+		_ = mapToStruct(session, &config.Session)
+	} else {
+		config.Session.EncryptionKey = getStringValue(data, "sessionEncryptionKey", "SessionEncryptionKey")
+		config.Session.Domain = getStringValue(data, "cookieDomain", "CookieDomain")
+	}
+
+	// Map security configuration
+	if security, ok := getNestedMap(migratedMap, "Security"); ok {
+		_ = mapToStruct(security, &config.Security)
+	} else {
+		config.Security.ForceHTTPS = getBoolValue(data, "forceHttps", "ForceHTTPS")
+		config.Security.EnablePKCE = getBoolValue(data, "enablePkce", "EnablePKCE")
+
+		if users := getArrayValue(data, "allowedUsers", "AllowedUsers"); users != nil {
+			config.Security.AllowedUsers = users
+		}
+		if domains := getArrayValue(data, "allowedUserDomains", "AllowedUserDomains"); domains != nil {
+			config.Security.AllowedUserDomains = domains
+		}
+		if roles := getArrayValue(data, "allowedRolesAndGroups", "AllowedRolesAndGroups"); roles != nil {
+			config.Security.AllowedRolesAndGroups = roles
+		}
+		if excluded := getArrayValue(data, "excludedUrls", "ExcludedURLs"); excluded != nil {
+			config.Security.ExcludedURLs = excluded
+		}
+
+		// Handle security headers
+		if headers := data["securityHeaders"]; headers != nil {
+			// Security headers might be in old format
+			_ = mapToStruct(headers, &config.Security.Headers)
+		}
+	}
+
+	// Map rate limiting
+	if rateLimit := getIntValue(data, "rateLimit", "RateLimit"); rateLimit > 0 {
+		config.RateLimit.Enabled = true
+		config.RateLimit.RequestsPerSecond = rateLimit
+		config.RateLimit.Burst = rateLimit * 2 // Default burst to 2x rate
+	}
+
+	// Map token configuration
+	if refreshGrace := getIntValue(data, "refreshGracePeriodSeconds", "RefreshGracePeriodSeconds"); refreshGrace > 0 {
+		config.Token.RefreshGracePeriod = time.Duration(refreshGrace) * time.Second
+	}
+
+	// Map logging
+	config.Logging.Level = strings.ToLower(getStringValue(data, "logLevel", "LogLevel"))
+	if config.Logging.Level == "" {
+		config.Logging.Level = "info"
+	}
+
+	// Map custom headers
+	if headers := data["headers"]; headers != nil {
+		if headerList, ok := headers.([]interface{}); ok {
+			config.Middleware.CustomHeaders = make(map[string]string)
+			for _, h := range headerList {
+				if headerMap, ok := h.(map[string]interface{}); ok {
+					name := getStringFromInterface(headerMap["name"])
+					value := getStringFromInterface(headerMap["value"])
+					if name != "" {
+						config.Middleware.CustomHeaders[name] = value
+					}
+				}
+			}
+		}
+	}
+
+	// Store original data for reference
+	config.Legacy = data
+
+	return config, nil
+}
+
+// MigrateFile migrates a configuration file
+func (m *ConfigMigrator) MigrateFile(filePath string) (*UnifiedConfig, error) {
+	// Clean and validate path to prevent traversal attacks
+	cleanPath := filepath.Clean(filePath)
+
+	// Check for path traversal attempts
+	if strings.Contains(cleanPath, "..") {
+		return nil, fmt.Errorf("invalid config path: potential path traversal detected in %s", filePath)
+	}
+
+	// Ensure the path is within expected directories
+	absPath, err := filepath.Abs(cleanPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve absolute path for %s: %w", filePath, err)
+	}
+
+	// Read the file with validated path
+	data, err := os.ReadFile(absPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read config file: %w", err)
+	}
+
+	config, warnings, err := m.Migrate(data)
+	if err != nil {
+		return nil, err
+	}
+
+	// Log warnings
+	for _, warning := range warnings {
+		fmt.Printf("Migration Warning: %s\n", warning)
+	}
+
+	return config, nil
+}
+
+// AutoMigrate automatically migrates config based on feature flags
+func AutoMigrate(data interface{}) (*UnifiedConfig, error) {
+	if !features.IsUnifiedConfigEnabled() {
+		// Feature not enabled, return nil
+		return nil, nil
+	}
+
+	migrator := NewConfigMigrator()
+
+	// Handle different input types
+	switch v := data.(type) {
+	case []byte:
+		config, _, err := migrator.Migrate(v)
+		return config, err
+	case string:
+		config, _, err := migrator.Migrate([]byte(v))
+		return config, err
+	case *Config:
+		// Convert old config to unified
+		return FromOldConfig(v), nil
+	case *UnifiedConfig:
+		// Already unified
+		return v, nil
+	case map[string]interface{}:
+		// Convert map to JSON then migrate
+		jsonData, err := json.Marshal(v)
+		if err != nil {
+			return nil, err
+		}
+		config, _, err := migrator.Migrate(jsonData)
+		return config, err
+	default:
+		return nil, fmt.Errorf("unsupported config type: %T", v)
+	}
+}
+
+// Helper functions
+
+func getNestedMap(m map[string]interface{}, key string) (map[string]interface{}, bool) {
+	if val, exists := m[key]; exists {
+		if mapped, ok := val.(map[string]interface{}); ok {
+			return mapped, true
+		}
+	}
+	return nil, false
+}
+
+func getStringValue(m map[string]interface{}, keys ...string) string {
+	for _, key := range keys {
+		if val, exists := m[key]; exists {
+			return getStringFromInterface(val)
+		}
+	}
+	return ""
+}
+
+func getStringFromInterface(val interface{}) string {
+	if val == nil {
+		return ""
+	}
+	switch v := val.(type) {
+	case string:
+		return v
+	case []byte:
+		return string(v)
+	default:
+		return fmt.Sprintf("%v", v)
+	}
+}
+
+func getBoolValue(m map[string]interface{}, keys ...string) bool {
+	for _, key := range keys {
+		if val, exists := m[key]; exists {
+			if b, ok := val.(bool); ok {
+				return b
+			}
+			// Try string conversion
+			if s, ok := val.(string); ok {
+				return strings.ToLower(s) == "true"
+			}
+		}
+	}
+	return false
+}
+
+func getIntValue(m map[string]interface{}, keys ...string) int {
+	for _, key := range keys {
+		if val, exists := m[key]; exists {
+			switch v := val.(type) {
+			case int:
+				return v
+			case int64:
+				return int(v)
+			case float64:
+				return int(v)
+			case string:
+				// Try to parse
+				var i int
+				if _, err := fmt.Sscanf(v, "%d", &i); err != nil {
+					// If parsing fails, return default
+					return 0
+				}
+				return i
+			}
+		}
+	}
+	return 0
+}
+
+func getArrayValue(m map[string]interface{}, keys ...string) []string {
+	for _, key := range keys {
+		if val, exists := m[key]; exists {
+			if arr, ok := val.([]interface{}); ok {
+				result := make([]string, 0, len(arr))
+				for _, item := range arr {
+					result = append(result, getStringFromInterface(item))
+				}
+				return result
+			}
+			if strArr, ok := val.([]string); ok {
+				return strArr
+			}
+		}
+	}
+	return nil
+}
+
+func mapToStruct(m interface{}, target interface{}) error {
+	// Simple mapping using JSON as intermediate
+	data, err := json.Marshal(m)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(data, target)
+}

config/redis_config.go

@@ -0,0 +1,297 @@
+// Package config provides configuration structures for the Traefik OIDC plugin.
+package config
+
+import (
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// RedisMode represents the Redis deployment mode
+type RedisMode string
+
+const (
+	// RedisModeStandalone represents a single Redis instance
+	RedisModeStandalone RedisMode = "standalone"
+
+	// RedisModeCluster represents Redis cluster mode
+	RedisModeCluster RedisMode = "cluster"
+
+	// RedisModeSentinel represents Redis sentinel mode
+	RedisModeSentinel RedisMode = "sentinel"
+)
+
+// RedisConfig holds Redis cache backend configuration
+type RedisConfig struct {
+	// Enabled indicates if Redis backend should be used
+	Enabled bool `json:"enabled,omitempty" yaml:"enabled,omitempty"`
+
+	// Mode specifies the Redis deployment mode
+	Mode RedisMode `json:"mode,omitempty" yaml:"mode,omitempty"`
+
+	// === Standalone Configuration ===
+	// Addr is the Redis server address (host:port)
+	Addr string `json:"addr,omitempty" yaml:"addr,omitempty"`
+
+	// Password for Redis authentication
+	Password string `json:"password,omitempty" yaml:"password,omitempty"`
+
+	// DB is the database number (0-15)
+	DB int `json:"db,omitempty" yaml:"db,omitempty"`
+
+	// === Cluster Configuration ===
+	// ClusterAddrs is the list of cluster node addresses
+	ClusterAddrs []string `json:"clusterAddrs,omitempty" yaml:"clusterAddrs,omitempty"`
+
+	// === Sentinel Configuration ===
+	// MasterName is the name of the master instance
+	MasterName string `json:"masterName,omitempty" yaml:"masterName,omitempty"`
+
+	// SentinelAddrs is the list of sentinel addresses
+	SentinelAddrs []string `json:"sentinelAddrs,omitempty" yaml:"sentinelAddrs,omitempty"`
+
+	// SentinelPassword is the password for sentinel authentication
+	SentinelPassword string `json:"sentinelPassword,omitempty" yaml:"sentinelPassword,omitempty"`
+
+	// === Connection Pool Settings ===
+	// PoolSize is the maximum number of socket connections
+	PoolSize int `json:"poolSize,omitempty" yaml:"poolSize,omitempty"`
+
+	// MinIdleConns is the minimum number of idle connections
+	MinIdleConns int `json:"minIdleConns,omitempty" yaml:"minIdleConns,omitempty"`
+
+	// MaxRetries is the maximum number of retries before giving up
+	MaxRetries int `json:"maxRetries,omitempty" yaml:"maxRetries,omitempty"`
+
+	// === Timeouts ===
+	// DialTimeout is the timeout for establishing new connections
+	DialTimeout time.Duration `json:"dialTimeout,omitempty" yaml:"dialTimeout,omitempty"`
+
+	// ReadTimeout is the timeout for socket reads
+	ReadTimeout time.Duration `json:"readTimeout,omitempty" yaml:"readTimeout,omitempty"`
+
+	// WriteTimeout is the timeout for socket writes
+	WriteTimeout time.Duration `json:"writeTimeout,omitempty" yaml:"writeTimeout,omitempty"`
+
+	// PoolTimeout is the timeout for connection pool
+	PoolTimeout time.Duration `json:"poolTimeout,omitempty" yaml:"poolTimeout,omitempty"`
+
+	// ConnMaxIdleTime is the maximum amount of time a connection may be idle
+	ConnMaxIdleTime time.Duration `json:"connMaxIdleTime,omitempty" yaml:"connMaxIdleTime,omitempty"`
+
+	// ConnMaxLifetime is the maximum lifetime of a connection
+	ConnMaxLifetime time.Duration `json:"connMaxLifetime,omitempty" yaml:"connMaxLifetime,omitempty"`
+
+	// === Key Management ===
+	// KeyPrefix is the prefix for all Redis keys
+	KeyPrefix string `json:"keyPrefix,omitempty" yaml:"keyPrefix,omitempty"`
+
+	// === TLS Configuration ===
+	// TLSEnabled enables TLS for Redis connections
+	TLSEnabled bool `json:"tlsEnabled,omitempty" yaml:"tlsEnabled,omitempty"`
+
+	// TLSInsecureSkipVerify skips TLS certificate verification
+	TLSInsecureSkipVerify bool `json:"tlsInsecureSkipVerify,omitempty" yaml:"tlsInsecureSkipVerify,omitempty"`
+
+	// === Resilience Settings ===
+	// EnableCircuitBreaker enables circuit breaker for Redis operations
+	EnableCircuitBreaker bool `json:"enableCircuitBreaker,omitempty" yaml:"enableCircuitBreaker,omitempty"`
+
+	// CircuitBreakerMaxFailures is the number of failures before opening circuit
+	CircuitBreakerMaxFailures int `json:"circuitBreakerMaxFailures,omitempty" yaml:"circuitBreakerMaxFailures,omitempty"`
+
+	// CircuitBreakerTimeout is how long the circuit stays open
+	CircuitBreakerTimeout time.Duration `json:"circuitBreakerTimeout,omitempty" yaml:"circuitBreakerTimeout,omitempty"`
+
+	// EnableHealthCheck enables periodic health checks
+	EnableHealthCheck bool `json:"enableHealthCheck,omitempty" yaml:"enableHealthCheck,omitempty"`
+
+	// HealthCheckInterval is how often to check Redis health
+	HealthCheckInterval time.Duration `json:"healthCheckInterval,omitempty" yaml:"healthCheckInterval,omitempty"`
+}
+
+// DefaultRedisConfig returns default Redis configuration
+func DefaultRedisConfig() *RedisConfig {
+	return &RedisConfig{
+		Enabled:                   false,
+		Mode:                      RedisModeStandalone,
+		Addr:                      "localhost:6379",
+		DB:                        0,
+		PoolSize:                  10,
+		MinIdleConns:              2,
+		MaxRetries:                3,
+		DialTimeout:               5 * time.Second,
+		ReadTimeout:               3 * time.Second,
+		WriteTimeout:              3 * time.Second,
+		PoolTimeout:               4 * time.Second,
+		ConnMaxIdleTime:           5 * time.Minute,
+		ConnMaxLifetime:           30 * time.Minute,
+		KeyPrefix:                 "traefikoidc:",
+		TLSEnabled:                false,
+		TLSInsecureSkipVerify:     false,
+		EnableCircuitBreaker:      true,
+		CircuitBreakerMaxFailures: 5,
+		CircuitBreakerTimeout:     30 * time.Second,
+		EnableHealthCheck:         true,
+		HealthCheckInterval:       30 * time.Second,
+	}
+}
+
+// LoadFromEnv loads Redis configuration from environment variables
+func (c *RedisConfig) LoadFromEnv() {
+	// Enable Redis if environment variable is set
+	if enabled := os.Getenv("REDIS_ENABLED"); enabled != "" {
+		c.Enabled = strings.ToLower(enabled) == "true"
+	}
+
+	// Mode
+	if mode := os.Getenv("REDIS_MODE"); mode != "" {
+		c.Mode = RedisMode(strings.ToLower(mode))
+	}
+
+	// Standalone configuration
+	if addr := os.Getenv("REDIS_ADDR"); addr != "" {
+		c.Addr = addr
+	}
+	if password := os.Getenv("REDIS_PASSWORD"); password != "" {
+		c.Password = password
+	}
+	if db := os.Getenv("REDIS_DB"); db != "" {
+		if dbNum, err := strconv.Atoi(db); err == nil {
+			c.DB = dbNum
+		}
+	}
+
+	// Cluster configuration
+	if clusterAddrs := os.Getenv("REDIS_CLUSTER_ADDRS"); clusterAddrs != "" {
+		c.ClusterAddrs = strings.Split(clusterAddrs, ",")
+		for i := range c.ClusterAddrs {
+			c.ClusterAddrs[i] = strings.TrimSpace(c.ClusterAddrs[i])
+		}
+	}
+
+	// Sentinel configuration
+	if masterName := os.Getenv("REDIS_MASTER_NAME"); masterName != "" {
+		c.MasterName = masterName
+	}
+	if sentinelAddrs := os.Getenv("REDIS_SENTINEL_ADDRS"); sentinelAddrs != "" {
+		c.SentinelAddrs = strings.Split(sentinelAddrs, ",")
+		for i := range c.SentinelAddrs {
+			c.SentinelAddrs[i] = strings.TrimSpace(c.SentinelAddrs[i])
+		}
+	}
+	if sentinelPassword := os.Getenv("REDIS_SENTINEL_PASSWORD"); sentinelPassword != "" {
+		c.SentinelPassword = sentinelPassword
+	}
+
+	// Connection pool settings
+	if poolSize := os.Getenv("REDIS_POOL_SIZE"); poolSize != "" {
+		if size, err := strconv.Atoi(poolSize); err == nil {
+			c.PoolSize = size
+		}
+	}
+	if minIdleConns := os.Getenv("REDIS_MIN_IDLE_CONNS"); minIdleConns != "" {
+		if conns, err := strconv.Atoi(minIdleConns); err == nil {
+			c.MinIdleConns = conns
+		}
+	}
+	if maxRetries := os.Getenv("REDIS_MAX_RETRIES"); maxRetries != "" {
+		if retries, err := strconv.Atoi(maxRetries); err == nil {
+			c.MaxRetries = retries
+		}
+	}
+
+	// Timeouts
+	if dialTimeout := os.Getenv("REDIS_DIAL_TIMEOUT"); dialTimeout != "" {
+		if timeout, err := time.ParseDuration(dialTimeout); err == nil {
+			c.DialTimeout = timeout
+		}
+	}
+	if readTimeout := os.Getenv("REDIS_READ_TIMEOUT"); readTimeout != "" {
+		if timeout, err := time.ParseDuration(readTimeout); err == nil {
+			c.ReadTimeout = timeout
+		}
+	}
+	if writeTimeout := os.Getenv("REDIS_WRITE_TIMEOUT"); writeTimeout != "" {
+		if timeout, err := time.ParseDuration(writeTimeout); err == nil {
+			c.WriteTimeout = timeout
+		}
+	}
+
+	// Key prefix
+	if keyPrefix := os.Getenv("REDIS_KEY_PREFIX"); keyPrefix != "" {
+		c.KeyPrefix = keyPrefix
+	}
+
+	// TLS settings
+	if tlsEnabled := os.Getenv("REDIS_TLS_ENABLED"); tlsEnabled != "" {
+		c.TLSEnabled = strings.ToLower(tlsEnabled) == "true"
+	}
+	if tlsInsecure := os.Getenv("REDIS_TLS_INSECURE_SKIP_VERIFY"); tlsInsecure != "" {
+		c.TLSInsecureSkipVerify = strings.ToLower(tlsInsecure) == "true"
+	}
+
+	// Resilience settings
+	if enableCB := os.Getenv("REDIS_ENABLE_CIRCUIT_BREAKER"); enableCB != "" {
+		c.EnableCircuitBreaker = strings.ToLower(enableCB) == "true"
+	}
+	if cbMaxFailures := os.Getenv("REDIS_CIRCUIT_BREAKER_MAX_FAILURES"); cbMaxFailures != "" {
+		if failures, err := strconv.Atoi(cbMaxFailures); err == nil {
+			c.CircuitBreakerMaxFailures = failures
+		}
+	}
+	if cbTimeout := os.Getenv("REDIS_CIRCUIT_BREAKER_TIMEOUT"); cbTimeout != "" {
+		if timeout, err := time.ParseDuration(cbTimeout); err == nil {
+			c.CircuitBreakerTimeout = timeout
+		}
+	}
+	if enableHC := os.Getenv("REDIS_ENABLE_HEALTH_CHECK"); enableHC != "" {
+		c.EnableHealthCheck = strings.ToLower(enableHC) == "true"
+	}
+	if hcInterval := os.Getenv("REDIS_HEALTH_CHECK_INTERVAL"); hcInterval != "" {
+		if interval, err := time.ParseDuration(hcInterval); err == nil {
+			c.HealthCheckInterval = interval
+		}
+	}
+}
+
+// Validate checks if the configuration is valid
+func (c *RedisConfig) Validate() error {
+	if !c.Enabled {
+		return nil
+	}
+
+	switch c.Mode {
+	case RedisModeStandalone:
+		if c.Addr == "" {
+			return &ConfigError{Field: "addr", Message: "Redis address is required for standalone mode"}
+		}
+	case RedisModeCluster:
+		if len(c.ClusterAddrs) == 0 {
+			return &ConfigError{Field: "clusterAddrs", Message: "At least one cluster address is required"}
+		}
+	case RedisModeSentinel:
+		if c.MasterName == "" {
+			return &ConfigError{Field: "masterName", Message: "Master name is required for sentinel mode"}
+		}
+		if len(c.SentinelAddrs) == 0 {
+			return &ConfigError{Field: "sentinelAddrs", Message: "At least one sentinel address is required"}
+		}
+	default:
+		return &ConfigError{Field: "mode", Message: "Invalid Redis mode"}
+	}
+
+	return nil
+}
+
+// ConfigError represents a configuration validation error
+type ConfigError struct {
+	Field   string
+	Message string
+}
+
+// Error implements the error interface
+func (e *ConfigError) Error() string {
+	return "redis config error: " + e.Field + ": " + e.Message
+}

config/unified_config.go

@@ -0,0 +1,287 @@
+// Package config provides unified configuration management for the OIDC middleware
+package config
+
+import (
+	"time"
+)
+
+// UnifiedConfig is the master configuration structure consolidating all config aspects
+// This replaces 45 duplicate config structs across the codebase
+type UnifiedConfig struct {
+	// Core Configuration
+	Provider ProviderConfig `json:"provider" yaml:"provider"`
+	Session  SessionConfig  `json:"session" yaml:"session"`
+	Token    TokenConfig    `json:"token" yaml:"token"`
+	Redis    RedisConfig    `json:"redis" yaml:"redis"`
+	Security SecurityConfig `json:"security" yaml:"security"`
+
+	// Middleware Configuration
+	Middleware MiddlewareConfig `json:"middleware" yaml:"middleware"`
+	Cache      CacheConfig      `json:"cache" yaml:"cache"`
+	RateLimit  RateLimitConfig  `json:"rateLimit" yaml:"rateLimit"`
+
+	// Operational Configuration
+	Logging LoggingConfig `json:"logging" yaml:"logging"`
+	Metrics MetricsConfig `json:"metrics" yaml:"metrics"`
+	Health  HealthConfig  `json:"health" yaml:"health"`
+
+	// Advanced Configuration
+	Transport TransportConfig `json:"transport" yaml:"transport"`
+	Pool      PoolConfig      `json:"pool" yaml:"pool"`
+	Circuit   CircuitConfig   `json:"circuit" yaml:"circuit"`
+
+	// Compatibility field for migration
+	Legacy map[string]interface{} `json:"-" yaml:"-"`
+}
+
+// ProviderConfig contains OIDC provider settings
+type ProviderConfig struct {
+	IssuerURL             string            `json:"issuerURL" yaml:"issuerURL"`
+	ClientID              string            `json:"clientID" yaml:"clientID"`
+	ClientSecret          string            `json:"clientSecret" yaml:"clientSecret"`
+	RedirectURL           string            `json:"redirectURL" yaml:"redirectURL"`
+	LogoutURL             string            `json:"logoutURL" yaml:"logoutURL"`
+	PostLogoutRedirectURI string            `json:"postLogoutRedirectURI" yaml:"postLogoutRedirectURI"`
+	Scopes                []string          `json:"scopes" yaml:"scopes"`
+	OverrideScopes        bool              `json:"overrideScopes" yaml:"overrideScopes"`
+	CustomClaims          map[string]string `json:"customClaims" yaml:"customClaims"`
+	JWKCachePeriod        time.Duration     `json:"jwkCachePeriod" yaml:"jwkCachePeriod"`
+	MetadataCacheTTL      time.Duration     `json:"metadataCacheTTL" yaml:"metadataCacheTTL"`
+	Discovery             bool              `json:"discovery" yaml:"discovery"`
+
+	// Provider-specific endpoints
+	AuthorizationEndpoint string `json:"authorizationEndpoint,omitempty" yaml:"authorizationEndpoint,omitempty"`
+	TokenEndpoint         string `json:"tokenEndpoint,omitempty" yaml:"tokenEndpoint,omitempty"`
+	UserInfoEndpoint      string `json:"userInfoEndpoint,omitempty" yaml:"userInfoEndpoint,omitempty"`
+	JWKSEndpoint          string `json:"jwksEndpoint,omitempty" yaml:"jwksEndpoint,omitempty"`
+	IntrospectEndpoint    string `json:"introspectEndpoint,omitempty" yaml:"introspectEndpoint,omitempty"`
+	RevocationEndpoint    string `json:"revocationEndpoint,omitempty" yaml:"revocationEndpoint,omitempty"`
+}
+
+// SessionConfig contains session management settings
+type SessionConfig struct {
+	Name          string `json:"name" yaml:"name"`
+	MaxAge        int    `json:"maxAge" yaml:"maxAge"`
+	Secret        string `json:"secret" yaml:"secret"`
+	EncryptionKey string `json:"encryptionKey" yaml:"encryptionKey"`
+	SigningKey    string `json:"signingKey" yaml:"signingKey"`
+	ChunkSize     int    `json:"chunkSize" yaml:"chunkSize"`
+	MaxChunks     int    `json:"maxChunks" yaml:"maxChunks"`
+
+	// Cookie settings
+	Domain       string `json:"domain" yaml:"domain"`
+	Path         string `json:"path" yaml:"path"`
+	Secure       bool   `json:"secure" yaml:"secure"`
+	HttpOnly     bool   `json:"httpOnly" yaml:"httpOnly"`
+	SameSite     string `json:"sameSite" yaml:"sameSite"`
+	CookiePrefix string `json:"cookiePrefix" yaml:"cookiePrefix"` // Prefix for cookie names (e.g., "_oidc_myapp_")
+
+	// Storage settings
+	StorageType     string        `json:"storageType" yaml:"storageType"` // "memory", "redis", "cookie"
+	CleanupInterval time.Duration `json:"cleanupInterval" yaml:"cleanupInterval"`
+}
+
+// TokenConfig contains token handling settings
+type TokenConfig struct {
+	AccessTokenTTL     time.Duration `json:"accessTokenTTL" yaml:"accessTokenTTL"`
+	RefreshTokenTTL    time.Duration `json:"refreshTokenTTL" yaml:"refreshTokenTTL"`
+	RefreshGracePeriod time.Duration `json:"refreshGracePeriod" yaml:"refreshGracePeriod"`
+	ValidationMode     string        `json:"validationMode" yaml:"validationMode"` // "jwt", "introspect", "hybrid"
+	IntrospectURL      string        `json:"introspectURL" yaml:"introspectURL"`
+
+	// Token caching
+	CacheEnabled     bool          `json:"cacheEnabled" yaml:"cacheEnabled"`
+	CacheTTL         time.Duration `json:"cacheTTL" yaml:"cacheTTL"`
+	CacheNegativeTTL time.Duration `json:"cacheNegativeTTL" yaml:"cacheNegativeTTL"`
+
+	// Token validation
+	ValidateSignature bool          `json:"validateSignature" yaml:"validateSignature"`
+	ValidateExpiry    bool          `json:"validateExpiry" yaml:"validateExpiry"`
+	ValidateAudience  bool          `json:"validateAudience" yaml:"validateAudience"`
+	ValidateIssuer    bool          `json:"validateIssuer" yaml:"validateIssuer"`
+	RequiredClaims    []string      `json:"requiredClaims" yaml:"requiredClaims"`
+	ClockSkew         time.Duration `json:"clockSkew" yaml:"clockSkew"`
+}
+
+// SecurityConfig contains security-related settings
+type SecurityConfig struct {
+	ForceHTTPS            bool                   `json:"forceHTTPS" yaml:"forceHTTPS"`
+	EnablePKCE            bool                   `json:"enablePKCE" yaml:"enablePKCE"`
+	AllowedUsers          []string               `json:"allowedUsers" yaml:"allowedUsers"`
+	AllowedUserDomains    []string               `json:"allowedUserDomains" yaml:"allowedUserDomains"`
+	AllowedRolesAndGroups []string               `json:"allowedRolesAndGroups" yaml:"allowedRolesAndGroups"`
+	ExcludedURLs          []string               `json:"excludedURLs" yaml:"excludedURLs"`
+	Headers               *SecurityHeadersConfig `json:"headers" yaml:"headers"`
+
+	// CSRF protection
+	CSRFProtection bool          `json:"csrfProtection" yaml:"csrfProtection"`
+	CSRFTokenName  string        `json:"csrfTokenName" yaml:"csrfTokenName"`
+	CSRFTokenTTL   time.Duration `json:"csrfTokenTTL" yaml:"csrfTokenTTL"`
+
+	// Additional security
+	MaxLoginAttempts int           `json:"maxLoginAttempts" yaml:"maxLoginAttempts"`
+	LockoutDuration  time.Duration `json:"lockoutDuration" yaml:"lockoutDuration"`
+	RequireMFA       bool          `json:"requireMFA" yaml:"requireMFA"`
+}
+
+// MiddlewareConfig contains middleware-specific settings
+type MiddlewareConfig struct {
+	Priority        int      `json:"priority" yaml:"priority"`
+	SkipPaths       []string `json:"skipPaths" yaml:"skipPaths"`
+	RequirePaths    []string `json:"requirePaths" yaml:"requirePaths"`
+	PassthroughMode bool     `json:"passthroughMode" yaml:"passthroughMode"`
+
+	// Request handling
+	MaxRequestSize int64         `json:"maxRequestSize" yaml:"maxRequestSize"`
+	RequestTimeout time.Duration `json:"requestTimeout" yaml:"requestTimeout"`
+	IdleTimeout    time.Duration `json:"idleTimeout" yaml:"idleTimeout"`
+
+	// Response handling
+	CustomHeaders map[string]string `json:"customHeaders" yaml:"customHeaders"`
+	RemoveHeaders []string          `json:"removeHeaders" yaml:"removeHeaders"`
+}
+
+// CacheConfig contains cache configuration
+type CacheConfig struct {
+	Enabled        bool          `json:"enabled" yaml:"enabled"`
+	Type           string        `json:"type" yaml:"type"` // "memory", "redis", "hybrid"
+	DefaultTTL     time.Duration `json:"defaultTTL" yaml:"defaultTTL"`
+	MaxEntries     int           `json:"maxEntries" yaml:"maxEntries"`
+	MaxEntrySize   int64         `json:"maxEntrySize" yaml:"maxEntrySize"`
+	EvictionPolicy string        `json:"evictionPolicy" yaml:"evictionPolicy"` // "lru", "lfu", "fifo"
+
+	// Memory cache settings
+	CleanupInterval time.Duration `json:"cleanupInterval" yaml:"cleanupInterval"`
+
+	// Distributed cache settings
+	Namespace     string `json:"namespace" yaml:"namespace"`
+	Compression   bool   `json:"compression" yaml:"compression"`
+	Serialization string `json:"serialization" yaml:"serialization"` // "json", "msgpack", "protobuf"
+}
+
+// RateLimitConfig contains rate limiting configuration
+type RateLimitConfig struct {
+	Enabled           bool `json:"enabled" yaml:"enabled"`
+	RequestsPerSecond int  `json:"requestsPerSecond" yaml:"requestsPerSecond"`
+	Burst             int  `json:"burst" yaml:"burst"`
+
+	// Rate limit storage
+	StorageType    string        `json:"storageType" yaml:"storageType"` // "memory", "redis"
+	WindowDuration time.Duration `json:"windowDuration" yaml:"windowDuration"`
+
+	// Rate limit keys
+	KeyType       string `json:"keyType" yaml:"keyType"` // "ip", "user", "token", "custom"
+	CustomKeyFunc string `json:"customKeyFunc" yaml:"customKeyFunc"`
+
+	// Whitelisting
+	WhitelistIPs   []string `json:"whitelistIPs" yaml:"whitelistIPs"`
+	WhitelistUsers []string `json:"whitelistUsers" yaml:"whitelistUsers"`
+}
+
+// LoggingConfig contains logging configuration
+type LoggingConfig struct {
+	Level    string `json:"level" yaml:"level"`   // "debug", "info", "warn", "error"
+	Format   string `json:"format" yaml:"format"` // "json", "text", "structured"
+	Output   string `json:"output" yaml:"output"` // "stdout", "stderr", "file"
+	FilePath string `json:"filePath" yaml:"filePath"`
+
+	// Log filtering
+	FilterSensitive bool     `json:"filterSensitive" yaml:"filterSensitive"`
+	MaskFields      []string `json:"maskFields" yaml:"maskFields"`
+
+	// Performance
+	BufferSize    int           `json:"bufferSize" yaml:"bufferSize"`
+	FlushInterval time.Duration `json:"flushInterval" yaml:"flushInterval"`
+
+	// Audit logging
+	AuditEnabled bool     `json:"auditEnabled" yaml:"auditEnabled"`
+	AuditEvents  []string `json:"auditEvents" yaml:"auditEvents"`
+}
+
+// MetricsConfig contains metrics collection configuration
+type MetricsConfig struct {
+	Enabled   bool   `json:"enabled" yaml:"enabled"`
+	Provider  string `json:"provider" yaml:"provider"` // "prometheus", "statsd", "otlp"
+	Endpoint  string `json:"endpoint" yaml:"endpoint"`
+	Namespace string `json:"namespace" yaml:"namespace"`
+	Subsystem string `json:"subsystem" yaml:"subsystem"`
+
+	// Collection settings
+	CollectInterval time.Duration `json:"collectInterval" yaml:"collectInterval"`
+	Histograms      bool          `json:"histograms" yaml:"histograms"`
+
+	// Custom labels
+	Labels map[string]string `json:"labels" yaml:"labels"`
+}
+
+// HealthConfig contains health check configuration
+type HealthConfig struct {
+	Enabled       bool          `json:"enabled" yaml:"enabled"`
+	Path          string        `json:"path" yaml:"path"`
+	CheckInterval time.Duration `json:"checkInterval" yaml:"checkInterval"`
+	Timeout       time.Duration `json:"timeout" yaml:"timeout"`
+
+	// Checks to perform
+	CheckProvider bool `json:"checkProvider" yaml:"checkProvider"`
+	CheckRedis    bool `json:"checkRedis" yaml:"checkRedis"`
+	CheckCache    bool `json:"checkCache" yaml:"checkCache"`
+
+	// Thresholds
+	MaxLatency time.Duration `json:"maxLatency" yaml:"maxLatency"`
+	MinMemory  int64         `json:"minMemory" yaml:"minMemory"`
+}
+
+// TransportConfig contains HTTP transport configuration
+type TransportConfig struct {
+	MaxIdleConns          int           `json:"maxIdleConns" yaml:"maxIdleConns"`
+	MaxIdleConnsPerHost   int           `json:"maxIdleConnsPerHost" yaml:"maxIdleConnsPerHost"`
+	MaxConnsPerHost       int           `json:"maxConnsPerHost" yaml:"maxConnsPerHost"`
+	IdleConnTimeout       time.Duration `json:"idleConnTimeout" yaml:"idleConnTimeout"`
+	TLSHandshakeTimeout   time.Duration `json:"tlsHandshakeTimeout" yaml:"tlsHandshakeTimeout"`
+	ExpectContinueTimeout time.Duration `json:"expectContinueTimeout" yaml:"expectContinueTimeout"`
+	ResponseHeaderTimeout time.Duration `json:"responseHeaderTimeout" yaml:"responseHeaderTimeout"`
+	DisableKeepAlives     bool          `json:"disableKeepAlives" yaml:"disableKeepAlives"`
+	DisableCompression    bool          `json:"disableCompression" yaml:"disableCompression"`
+
+	// TLS configuration
+	TLSInsecureSkipVerify bool     `json:"tlsInsecureSkipVerify" yaml:"tlsInsecureSkipVerify"`
+	TLSMinVersion         string   `json:"tlsMinVersion" yaml:"tlsMinVersion"`
+	TLSCipherSuites       []string `json:"tlsCipherSuites" yaml:"tlsCipherSuites"`
+
+	// Proxy settings
+	ProxyURL string   `json:"proxyURL" yaml:"proxyURL"`
+	NoProxy  []string `json:"noProxy" yaml:"noProxy"`
+}
+
+// PoolConfig contains connection pool configuration
+type PoolConfig struct {
+	Enabled     bool          `json:"enabled" yaml:"enabled"`
+	Size        int           `json:"size" yaml:"size"`
+	MinSize     int           `json:"minSize" yaml:"minSize"`
+	MaxSize     int           `json:"maxSize" yaml:"maxSize"`
+	MaxAge      time.Duration `json:"maxAge" yaml:"maxAge"`
+	IdleTimeout time.Duration `json:"idleTimeout" yaml:"idleTimeout"`
+	WaitTimeout time.Duration `json:"waitTimeout" yaml:"waitTimeout"`
+
+	// Health checking
+	HealthCheckInterval time.Duration `json:"healthCheckInterval" yaml:"healthCheckInterval"`
+	MaxRetries          int           `json:"maxRetries" yaml:"maxRetries"`
+}
+
+// CircuitConfig contains circuit breaker configuration
+type CircuitConfig struct {
+	Enabled             bool          `json:"enabled" yaml:"enabled"`
+	MaxRequests         uint32        `json:"maxRequests" yaml:"maxRequests"`
+	Interval            time.Duration `json:"interval" yaml:"interval"`
+	Timeout             time.Duration `json:"timeout" yaml:"timeout"`
+	ConsecutiveFailures uint32        `json:"consecutiveFailures" yaml:"consecutiveFailures"`
+	FailureRatio        float64       `json:"failureRatio" yaml:"failureRatio"`
+
+	// Circuit states
+	OnOpen     string `json:"onOpen" yaml:"onOpen"` // "reject", "fallback", "passthrough"
+	OnHalfOpen string `json:"onHalfOpen" yaml:"onHalfOpen"`
+
+	// Monitoring
+	MetricsEnabled  bool `json:"metricsEnabled" yaml:"metricsEnabled"`
+	LogStateChanges bool `json:"logStateChanges" yaml:"logStateChanges"`
+}

config/unified_config_test.go

@@ -0,0 +1,263 @@
+//go:build !yaegi
+
+package config
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"gopkg.in/yaml.v3"
+)
+
+// TestUnifiedConfigJSONMarshalling tests JSON marshalling with secret redaction
+func TestUnifiedConfigJSONMarshalling(t *testing.T) {
+	config := &UnifiedConfig{
+		Provider: ProviderConfig{
+			IssuerURL:    "https://auth.example.com",
+			ClientID:     "test-client",
+			ClientSecret: "super-secret-value",
+		},
+		Session: SessionConfig{
+			Secret:        "session-secret",
+			EncryptionKey: "32-character-encryption-key-here",
+			SigningKey:    "signing-key-secret",
+		},
+		Redis: RedisConfig{
+			Password:         "redis-password",
+			SentinelPassword: "sentinel-password",
+		},
+	}
+
+	// Marshal to JSON
+	jsonBytes, err := json.Marshal(config)
+	if err != nil {
+		t.Fatalf("Failed to marshal config to JSON: %v", err)
+	}
+
+	jsonStr := string(jsonBytes)
+
+	// Verify secrets are redacted
+	if !contains(jsonStr, `"clientSecret":"[REDACTED]"`) {
+		t.Error("ClientSecret should be redacted in JSON output")
+	}
+	if !contains(jsonStr, `"secret":"[REDACTED]"`) {
+		t.Error("Session.Secret should be redacted in JSON output")
+	}
+	if !contains(jsonStr, `"encryptionKey":"[REDACTED]"`) {
+		t.Error("Session.EncryptionKey should be redacted in JSON output")
+	}
+	if !contains(jsonStr, `"signingKey":"[REDACTED]"`) {
+		t.Error("Session.SigningKey should be redacted in JSON output")
+	}
+	if !contains(jsonStr, `"password":"[REDACTED]"`) {
+		t.Error("Redis.Password should be redacted in JSON output")
+	}
+	if !contains(jsonStr, `"sentinelPassword":"[REDACTED]"`) {
+		t.Error("Redis.SentinelPassword should be redacted in JSON output")
+	}
+
+	// Verify non-secret fields are preserved
+	if !contains(jsonStr, `"issuerURL":"https://auth.example.com"`) {
+		t.Error("IssuerURL should be preserved in JSON output")
+	}
+	if !contains(jsonStr, `"clientID":"test-client"`) {
+		t.Error("ClientID should be preserved in JSON output")
+	}
+}
+
+// TestUnifiedConfigYAMLMarshalling tests YAML marshalling with secret redaction
+func TestUnifiedConfigYAMLMarshalling(t *testing.T) {
+	config := &UnifiedConfig{
+		Provider: ProviderConfig{
+			IssuerURL:    "https://auth.example.com",
+			ClientID:     "test-client",
+			ClientSecret: "super-secret-value",
+		},
+		Session: SessionConfig{
+			Secret:        "session-secret",
+			EncryptionKey: "32-character-encryption-key-here",
+			SigningKey:    "signing-key-secret",
+		},
+		Redis: RedisConfig{
+			Password:         "redis-password",
+			SentinelPassword: "sentinel-password",
+		},
+	}
+
+	// Marshal to YAML
+	yamlBytes, err := yaml.Marshal(config)
+	if err != nil {
+		t.Fatalf("Failed to marshal config to YAML: %v", err)
+	}
+
+	yamlStr := string(yamlBytes)
+
+	// Verify secrets are redacted
+	if !contains(yamlStr, "clientSecret: '[REDACTED]'") {
+		t.Error("ClientSecret should be redacted in YAML output")
+	}
+	if !contains(yamlStr, "secret: '[REDACTED]'") {
+		t.Error("Session.Secret should be redacted in YAML output")
+	}
+	if !contains(yamlStr, "encryptionKey: '[REDACTED]'") {
+		t.Error("Session.EncryptionKey should be redacted in YAML output")
+	}
+	if !contains(yamlStr, "signingKey: '[REDACTED]'") {
+		t.Error("Session.SigningKey should be redacted in YAML output")
+	}
+	if !contains(yamlStr, "password: '[REDACTED]'") {
+		t.Error("Redis.Password should be redacted in YAML output")
+	}
+	if !contains(yamlStr, "sentinelPassword: '[REDACTED]'") {
+		t.Error("Redis.SentinelPassword should be redacted in YAML output")
+	}
+
+	// Verify non-secret fields are preserved
+	if !contains(yamlStr, "issuerURL: https://auth.example.com") {
+		t.Error("IssuerURL should be preserved in YAML output")
+	}
+	if !contains(yamlStr, "clientID: test-client") {
+		t.Error("ClientID should be preserved in YAML output")
+	}
+}
+
+// TestProviderConfigMarshalling tests individual struct marshalling
+func TestProviderConfigMarshalling(t *testing.T) {
+	provider := ProviderConfig{
+		IssuerURL:    "https://auth.example.com",
+		ClientID:     "test-client",
+		ClientSecret: "super-secret-value",
+	}
+
+	// Test JSON marshalling
+	jsonBytes, err := json.Marshal(provider)
+	if err != nil {
+		t.Fatalf("Failed to marshal ProviderConfig to JSON: %v", err)
+	}
+
+	jsonStr := string(jsonBytes)
+	if !contains(jsonStr, `"clientSecret":"[REDACTED]"`) {
+		t.Error("ClientSecret should be redacted in JSON output")
+	}
+	if !contains(jsonStr, `"clientID":"test-client"`) {
+		t.Error("ClientID should be preserved in JSON output")
+	}
+
+	// Test YAML marshalling
+	yamlBytes, err := yaml.Marshal(provider)
+	if err != nil {
+		t.Fatalf("Failed to marshal ProviderConfig to YAML: %v", err)
+	}
+
+	yamlStr := string(yamlBytes)
+	if !contains(yamlStr, "clientSecret: '[REDACTED]'") {
+		t.Error("ClientSecret should be redacted in YAML output")
+	}
+	if !contains(yamlStr, "clientID: test-client") {
+		t.Error("ClientID should be preserved in YAML output")
+	}
+}
+
+// TestSessionConfigMarshalling tests session config marshalling
+func TestSessionConfigMarshalling(t *testing.T) {
+	session := SessionConfig{
+		Name:          "session-cookie",
+		Secret:        "session-secret",
+		EncryptionKey: "32-character-encryption-key-here",
+		SigningKey:    "signing-key-secret",
+		Domain:        "example.com",
+		Secure:        true,
+	}
+
+	// Test JSON marshalling
+	jsonBytes, err := json.Marshal(session)
+	if err != nil {
+		t.Fatalf("Failed to marshal SessionConfig to JSON: %v", err)
+	}
+
+	jsonStr := string(jsonBytes)
+	if !contains(jsonStr, `"secret":"[REDACTED]"`) {
+		t.Error("Secret should be redacted in JSON output")
+	}
+	if !contains(jsonStr, `"encryptionKey":"[REDACTED]"`) {
+		t.Error("EncryptionKey should be redacted in JSON output")
+	}
+	if !contains(jsonStr, `"signingKey":"[REDACTED]"`) {
+		t.Error("SigningKey should be redacted in JSON output")
+	}
+	if !contains(jsonStr, `"name":"session-cookie"`) {
+		t.Error("Name should be preserved in JSON output")
+	}
+	if !contains(jsonStr, `"domain":"example.com"`) {
+		t.Error("Domain should be preserved in JSON output")
+	}
+}
+
+// TestRedisConfigMarshalling tests Redis config marshalling
+func TestRedisConfigMarshalling(t *testing.T) {
+	redis := RedisConfig{
+		Enabled:          true,
+		Mode:             RedisModeCluster,
+		Password:         "redis-password",
+		SentinelPassword: "sentinel-password",
+		Addr:             "localhost:6379",
+		DB:               1,
+	}
+
+	// Test JSON marshalling
+	jsonBytes, err := json.Marshal(redis)
+	if err != nil {
+		t.Fatalf("Failed to marshal RedisConfig to JSON: %v", err)
+	}
+
+	jsonStr := string(jsonBytes)
+	if !contains(jsonStr, `"password":"[REDACTED]"`) {
+		t.Error("Password should be redacted in JSON output")
+	}
+	if !contains(jsonStr, `"sentinelPassword":"[REDACTED]"`) {
+		t.Error("SentinelPassword should be redacted in JSON output")
+	}
+	if !contains(jsonStr, `"addr":"localhost:6379"`) {
+		t.Error("Addr should be preserved in JSON output")
+	}
+	if !contains(jsonStr, `"db":1`) {
+		t.Error("DB should be preserved in JSON output")
+	}
+}
+
+// TestEmptySecretsNotRedacted tests that empty secrets are not shown as redacted
+func TestEmptySecretsNotRedacted(t *testing.T) {
+	config := &UnifiedConfig{
+		Provider: ProviderConfig{
+			IssuerURL:    "https://auth.example.com",
+			ClientID:     "test-client",
+			ClientSecret: "", // Empty secret
+		},
+		Session: SessionConfig{
+			Secret:        "", // Empty secret
+			EncryptionKey: "", // Empty secret
+		},
+		Redis: RedisConfig{
+			Password: "", // Empty secret
+		},
+	}
+
+	// Marshal to JSON
+	jsonBytes, err := json.Marshal(config)
+	if err != nil {
+		t.Fatalf("Failed to marshal config to JSON: %v", err)
+	}
+
+	jsonStr := string(jsonBytes)
+
+	// Verify empty secrets are not shown as redacted
+	if contains(jsonStr, "[REDACTED]") {
+		t.Error("Empty secrets should not be shown as [REDACTED]")
+	}
+}
+
+// Helper function to check if string contains substring
+func contains(s, substr string) bool {
+	return strings.Contains(s, substr)
+}

config/validator.go

@@ -0,0 +1,652 @@
+// Package config provides validation for unified configuration
+package config
+
+import (
+	"fmt"
+	"net/url"
+	"regexp"
+	"strings"
+	"time"
+)
+
+// ValidationError represents a configuration validation error
+type ValidationError struct {
+	Field   string
+	Message string
+	Value   interface{}
+}
+
+// Error implements the error interface
+func (e *ValidationError) Error() string {
+	if e.Value != nil {
+		return fmt.Sprintf("config validation error: %s: %s (value: %v)", e.Field, e.Message, e.Value)
+	}
+	return fmt.Sprintf("config validation error: %s: %s", e.Field, e.Message)
+}
+
+// ValidationErrors represents multiple validation errors
+type ValidationErrors []ValidationError
+
+// Error implements the error interface
+func (e ValidationErrors) Error() string {
+	if len(e) == 0 {
+		return ""
+	}
+
+	var messages []string
+	for _, err := range e {
+		messages = append(messages, err.Error())
+	}
+	return strings.Join(messages, "; ")
+}
+
+// Validate performs comprehensive validation on the unified configuration
+func (c *UnifiedConfig) Validate() error {
+	var errors ValidationErrors
+
+	// Validate Provider configuration
+	if err := c.validateProvider(); err != nil {
+		errors = append(errors, err...)
+	}
+
+	// Validate Session configuration
+	if err := c.validateSession(); err != nil {
+		errors = append(errors, err...)
+	}
+
+	// Validate Token configuration
+	if err := c.validateToken(); err != nil {
+		errors = append(errors, err...)
+	}
+
+	// Validate Redis configuration (uses existing validation)
+	if err := c.Redis.Validate(); err != nil {
+		errors = append(errors, ValidationError{
+			Field:   "Redis",
+			Message: err.Error(),
+		})
+	}
+
+	// Validate Security configuration
+	if err := c.validateSecurity(); err != nil {
+		errors = append(errors, err...)
+	}
+
+	// Validate Middleware configuration
+	if err := c.validateMiddleware(); err != nil {
+		errors = append(errors, err...)
+	}
+
+	// Validate Cache configuration
+	if err := c.validateCache(); err != nil {
+		errors = append(errors, err...)
+	}
+
+	// Validate RateLimit configuration
+	if err := c.validateRateLimit(); err != nil {
+		errors = append(errors, err...)
+	}
+
+	// Validate Logging configuration
+	if err := c.validateLogging(); err != nil {
+		errors = append(errors, err...)
+	}
+
+	// Validate Metrics configuration
+	if err := c.validateMetrics(); err != nil {
+		errors = append(errors, err...)
+	}
+
+	// Validate Transport configuration
+	if err := c.validateTransport(); err != nil {
+		errors = append(errors, err...)
+	}
+
+	// Validate Circuit configuration
+	if err := c.validateCircuit(); err != nil {
+		errors = append(errors, err...)
+	}
+
+	if len(errors) > 0 {
+		return errors
+	}
+
+	return nil
+}
+
+// validateProvider validates provider configuration
+func (c *UnifiedConfig) validateProvider() ValidationErrors {
+	var errors ValidationErrors
+
+	// IssuerURL is required and must be a valid URL
+	if c.Provider.IssuerURL == "" {
+		errors = append(errors, ValidationError{
+			Field:   "Provider.IssuerURL",
+			Message: "issuer URL is required",
+		})
+	} else if _, err := url.Parse(c.Provider.IssuerURL); err != nil {
+		errors = append(errors, ValidationError{
+			Field:   "Provider.IssuerURL",
+			Message: "invalid issuer URL",
+			Value:   c.Provider.IssuerURL,
+		})
+	}
+
+	// ClientID is required
+	if c.Provider.ClientID == "" {
+		errors = append(errors, ValidationError{
+			Field:   "Provider.ClientID",
+			Message: "client ID is required",
+		})
+	}
+
+	// ClientSecret is required (except for public clients with PKCE)
+	if c.Provider.ClientSecret == "" && !c.Security.EnablePKCE {
+		errors = append(errors, ValidationError{
+			Field:   "Provider.ClientSecret",
+			Message: "client secret is required (or enable PKCE for public clients)",
+		})
+	}
+
+	// RedirectURL must be valid if provided
+	if c.Provider.RedirectURL != "" {
+		if _, err := url.Parse(c.Provider.RedirectURL); err != nil {
+			errors = append(errors, ValidationError{
+				Field:   "Provider.RedirectURL",
+				Message: "invalid redirect URL",
+				Value:   c.Provider.RedirectURL,
+			})
+		}
+	}
+
+	// Scopes must include 'openid' for OIDC
+	hasOpenID := false
+	for _, scope := range c.Provider.Scopes {
+		if scope == "openid" {
+			hasOpenID = true
+			break
+		}
+	}
+	if !hasOpenID && !c.Provider.OverrideScopes {
+		errors = append(errors, ValidationError{
+			Field:   "Provider.Scopes",
+			Message: "scopes must include 'openid' for OIDC",
+			Value:   c.Provider.Scopes,
+		})
+	}
+
+	// JWK cache period must be positive
+	if c.Provider.JWKCachePeriod < 0 {
+		errors = append(errors, ValidationError{
+			Field:   "Provider.JWKCachePeriod",
+			Message: "JWK cache period must be positive",
+			Value:   c.Provider.JWKCachePeriod,
+		})
+	}
+
+	return errors
+}
+
+// validateSession validates session configuration
+func (c *UnifiedConfig) validateSession() ValidationErrors {
+	var errors ValidationErrors
+
+	// Session name must not be empty
+	if c.Session.Name == "" {
+		errors = append(errors, ValidationError{
+			Field:   "Session.Name",
+			Message: "session name is required",
+		})
+	}
+
+	// Session secret or encryption key is required
+	if c.Session.Secret == "" && c.Session.EncryptionKey == "" {
+		errors = append(errors, ValidationError{
+			Field:   "Session",
+			Message: "either session secret or encryption key is required",
+		})
+	}
+
+	// Encryption key must be at least 32 bytes for security
+	if c.Session.EncryptionKey != "" && len(c.Session.EncryptionKey) < 32 {
+		errors = append(errors, ValidationError{
+			Field:   "Session.EncryptionKey",
+			Message: "encryption key must be at least 32 characters for proper security",
+			Value:   len(c.Session.EncryptionKey),
+		})
+	}
+
+	// ChunkSize must be reasonable (between 1KB and 10KB)
+	if c.Session.ChunkSize < 1000 || c.Session.ChunkSize > 10000 {
+		errors = append(errors, ValidationError{
+			Field:   "Session.ChunkSize",
+			Message: "chunk size must be between 1000 and 10000 bytes",
+			Value:   c.Session.ChunkSize,
+		})
+	}
+
+	// MaxChunks must be reasonable (between 1 and 100)
+	if c.Session.MaxChunks < 1 || c.Session.MaxChunks > 100 {
+		errors = append(errors, ValidationError{
+			Field:   "Session.MaxChunks",
+			Message: "max chunks must be between 1 and 100",
+			Value:   c.Session.MaxChunks,
+		})
+	}
+
+	// SameSite must be valid
+	validSameSite := map[string]bool{
+		"":       true,
+		"Lax":    true,
+		"Strict": true,
+		"None":   true,
+	}
+	if !validSameSite[c.Session.SameSite] {
+		errors = append(errors, ValidationError{
+			Field:   "Session.SameSite",
+			Message: "invalid SameSite value (must be Lax, Strict, or None)",
+			Value:   c.Session.SameSite,
+		})
+	}
+
+	// StorageType must be valid
+	validStorage := map[string]bool{
+		"memory": true,
+		"redis":  true,
+		"cookie": true,
+	}
+	if !validStorage[c.Session.StorageType] {
+		errors = append(errors, ValidationError{
+			Field:   "Session.StorageType",
+			Message: "invalid storage type (must be memory, redis, or cookie)",
+			Value:   c.Session.StorageType,
+		})
+	}
+
+	return errors
+}
+
+// validateToken validates token configuration
+func (c *UnifiedConfig) validateToken() ValidationErrors {
+	var errors ValidationErrors
+
+	// Token TTLs must be positive
+	if c.Token.AccessTokenTTL <= 0 {
+		errors = append(errors, ValidationError{
+			Field:   "Token.AccessTokenTTL",
+			Message: "access token TTL must be positive",
+			Value:   c.Token.AccessTokenTTL,
+		})
+	}
+
+	if c.Token.RefreshTokenTTL <= 0 {
+		errors = append(errors, ValidationError{
+			Field:   "Token.RefreshTokenTTL",
+			Message: "refresh token TTL must be positive",
+			Value:   c.Token.RefreshTokenTTL,
+		})
+	}
+
+	// Validation mode must be valid
+	validModes := map[string]bool{
+		"jwt":        true,
+		"introspect": true,
+		"hybrid":     true,
+	}
+	if !validModes[c.Token.ValidationMode] {
+		errors = append(errors, ValidationError{
+			Field:   "Token.ValidationMode",
+			Message: "invalid validation mode (must be jwt, introspect, or hybrid)",
+			Value:   c.Token.ValidationMode,
+		})
+	}
+
+	// Introspect URL required for introspect or hybrid mode
+	if (c.Token.ValidationMode == "introspect" || c.Token.ValidationMode == "hybrid") && c.Token.IntrospectURL == "" {
+		errors = append(errors, ValidationError{
+			Field:   "Token.IntrospectURL",
+			Message: "introspect URL is required for introspect or hybrid validation mode",
+		})
+	}
+
+	// Clock skew must be reasonable (0 to 10 minutes)
+	if c.Token.ClockSkew < 0 || c.Token.ClockSkew > 10*time.Minute {
+		errors = append(errors, ValidationError{
+			Field:   "Token.ClockSkew",
+			Message: "clock skew must be between 0 and 10 minutes",
+			Value:   c.Token.ClockSkew,
+		})
+	}
+
+	return errors
+}
+
+// validateSecurity validates security configuration
+func (c *UnifiedConfig) validateSecurity() ValidationErrors {
+	var errors ValidationErrors
+
+	// Validate allowed user domains are valid domains
+	domainRegex := regexp.MustCompile(`^([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+\.[a-zA-Z]{2,}$`)
+	for _, domain := range c.Security.AllowedUserDomains {
+		if !domainRegex.MatchString(domain) {
+			errors = append(errors, ValidationError{
+				Field:   "Security.AllowedUserDomains",
+				Message: "invalid domain format",
+				Value:   domain,
+			})
+		}
+	}
+
+	// Max login attempts must be reasonable
+	if c.Security.MaxLoginAttempts < 0 || c.Security.MaxLoginAttempts > 100 {
+		errors = append(errors, ValidationError{
+			Field:   "Security.MaxLoginAttempts",
+			Message: "max login attempts must be between 0 and 100",
+			Value:   c.Security.MaxLoginAttempts,
+		})
+	}
+
+	// Lockout duration must be reasonable
+	if c.Security.LockoutDuration < 0 || c.Security.LockoutDuration > 24*time.Hour {
+		errors = append(errors, ValidationError{
+			Field:   "Security.LockoutDuration",
+			Message: "lockout duration must be between 0 and 24 hours",
+			Value:   c.Security.LockoutDuration,
+		})
+	}
+
+	return errors
+}
+
+// validateMiddleware validates middleware configuration
+func (c *UnifiedConfig) validateMiddleware() ValidationErrors {
+	var errors ValidationErrors
+
+	// Max request size must be reasonable (1KB to 100MB)
+	if c.Middleware.MaxRequestSize < 1024 || c.Middleware.MaxRequestSize > 100*1024*1024 {
+		errors = append(errors, ValidationError{
+			Field:   "Middleware.MaxRequestSize",
+			Message: "max request size must be between 1KB and 100MB",
+			Value:   c.Middleware.MaxRequestSize,
+		})
+	}
+
+	// Request timeout must be reasonable
+	if c.Middleware.RequestTimeout < time.Second || c.Middleware.RequestTimeout > 5*time.Minute {
+		errors = append(errors, ValidationError{
+			Field:   "Middleware.RequestTimeout",
+			Message: "request timeout must be between 1 second and 5 minutes",
+			Value:   c.Middleware.RequestTimeout,
+		})
+	}
+
+	return errors
+}
+
+// validateCache validates cache configuration
+func (c *UnifiedConfig) validateCache() ValidationErrors {
+	var errors ValidationErrors
+
+	if !c.Cache.Enabled {
+		return errors
+	}
+
+	// Cache type must be valid
+	validTypes := map[string]bool{
+		"memory": true,
+		"redis":  true,
+		"hybrid": true,
+	}
+	if !validTypes[c.Cache.Type] {
+		errors = append(errors, ValidationError{
+			Field:   "Cache.Type",
+			Message: "invalid cache type (must be memory, redis, or hybrid)",
+			Value:   c.Cache.Type,
+		})
+	}
+
+	// Max entries must be reasonable
+	if c.Cache.MaxEntries < 10 || c.Cache.MaxEntries > 1000000 {
+		errors = append(errors, ValidationError{
+			Field:   "Cache.MaxEntries",
+			Message: "max entries must be between 10 and 1000000",
+			Value:   c.Cache.MaxEntries,
+		})
+	}
+
+	// Eviction policy must be valid
+	validEviction := map[string]bool{
+		"lru":  true,
+		"lfu":  true,
+		"fifo": true,
+	}
+	if !validEviction[c.Cache.EvictionPolicy] {
+		errors = append(errors, ValidationError{
+			Field:   "Cache.EvictionPolicy",
+			Message: "invalid eviction policy (must be lru, lfu, or fifo)",
+			Value:   c.Cache.EvictionPolicy,
+		})
+	}
+
+	return errors
+}
+
+// validateRateLimit validates rate limiting configuration
+func (c *UnifiedConfig) validateRateLimit() ValidationErrors {
+	var errors ValidationErrors
+
+	if !c.RateLimit.Enabled {
+		return errors
+	}
+
+	// Requests per second must be reasonable
+	if c.RateLimit.RequestsPerSecond < 1 || c.RateLimit.RequestsPerSecond > 10000 {
+		errors = append(errors, ValidationError{
+			Field:   "RateLimit.RequestsPerSecond",
+			Message: "requests per second must be between 1 and 10000",
+			Value:   c.RateLimit.RequestsPerSecond,
+		})
+	}
+
+	// Burst must be at least as large as requests per second
+	if c.RateLimit.Burst < c.RateLimit.RequestsPerSecond {
+		errors = append(errors, ValidationError{
+			Field:   "RateLimit.Burst",
+			Message: "burst must be at least as large as requests per second",
+			Value:   c.RateLimit.Burst,
+		})
+	}
+
+	// Key type must be valid
+	validKeyTypes := map[string]bool{
+		"ip":     true,
+		"user":   true,
+		"token":  true,
+		"custom": true,
+	}
+	if !validKeyTypes[c.RateLimit.KeyType] {
+		errors = append(errors, ValidationError{
+			Field:   "RateLimit.KeyType",
+			Message: "invalid key type (must be ip, user, token, or custom)",
+			Value:   c.RateLimit.KeyType,
+		})
+	}
+
+	return errors
+}
+
+// validateLogging validates logging configuration
+func (c *UnifiedConfig) validateLogging() ValidationErrors {
+	var errors ValidationErrors
+
+	// Log level must be valid
+	validLevels := map[string]bool{
+		"debug": true,
+		"info":  true,
+		"warn":  true,
+		"error": true,
+	}
+	if !validLevels[c.Logging.Level] {
+		errors = append(errors, ValidationError{
+			Field:   "Logging.Level",
+			Message: "invalid log level (must be debug, info, warn, or error)",
+			Value:   c.Logging.Level,
+		})
+	}
+
+	// Format must be valid
+	validFormats := map[string]bool{
+		"json":       true,
+		"text":       true,
+		"structured": true,
+	}
+	if !validFormats[c.Logging.Format] {
+		errors = append(errors, ValidationError{
+			Field:   "Logging.Format",
+			Message: "invalid log format (must be json, text, or structured)",
+			Value:   c.Logging.Format,
+		})
+	}
+
+	// Output must be valid
+	validOutputs := map[string]bool{
+		"stdout": true,
+		"stderr": true,
+		"file":   true,
+	}
+	if !validOutputs[c.Logging.Output] {
+		errors = append(errors, ValidationError{
+			Field:   "Logging.Output",
+			Message: "invalid log output (must be stdout, stderr, or file)",
+			Value:   c.Logging.Output,
+		})
+	}
+
+	// File path required if output is file
+	if c.Logging.Output == "file" && c.Logging.FilePath == "" {
+		errors = append(errors, ValidationError{
+			Field:   "Logging.FilePath",
+			Message: "file path is required when output is 'file'",
+		})
+	}
+
+	return errors
+}
+
+// validateMetrics validates metrics configuration
+func (c *UnifiedConfig) validateMetrics() ValidationErrors {
+	var errors ValidationErrors
+
+	if !c.Metrics.Enabled {
+		return errors
+	}
+
+	// Provider must be valid
+	validProviders := map[string]bool{
+		"prometheus": true,
+		"statsd":     true,
+		"otlp":       true,
+	}
+	if !validProviders[c.Metrics.Provider] {
+		errors = append(errors, ValidationError{
+			Field:   "Metrics.Provider",
+			Message: "invalid metrics provider (must be prometheus, statsd, or otlp)",
+			Value:   c.Metrics.Provider,
+		})
+	}
+
+	// Endpoint required for some providers
+	if (c.Metrics.Provider == "statsd" || c.Metrics.Provider == "otlp") && c.Metrics.Endpoint == "" {
+		errors = append(errors, ValidationError{
+			Field:   "Metrics.Endpoint",
+			Message: fmt.Sprintf("endpoint is required for %s provider", c.Metrics.Provider),
+		})
+	}
+
+	return errors
+}
+
+// validateTransport validates transport configuration
+func (c *UnifiedConfig) validateTransport() ValidationErrors {
+	var errors ValidationErrors
+
+	// Max connections must be reasonable
+	if c.Transport.MaxIdleConns < 0 || c.Transport.MaxIdleConns > 10000 {
+		errors = append(errors, ValidationError{
+			Field:   "Transport.MaxIdleConns",
+			Message: "max idle connections must be between 0 and 10000",
+			Value:   c.Transport.MaxIdleConns,
+		})
+	}
+
+	// TLS min version must be valid
+	validTLSVersions := map[string]bool{
+		"TLS1.0": true,
+		"TLS1.1": true,
+		"TLS1.2": true,
+		"TLS1.3": true,
+	}
+	if c.Transport.TLSMinVersion != "" && !validTLSVersions[c.Transport.TLSMinVersion] {
+		errors = append(errors, ValidationError{
+			Field:   "Transport.TLSMinVersion",
+			Message: "invalid TLS min version (must be TLS1.0, TLS1.1, TLS1.2, or TLS1.3)",
+			Value:   c.Transport.TLSMinVersion,
+		})
+	}
+
+	// Proxy URL must be valid if provided
+	if c.Transport.ProxyURL != "" {
+		if _, err := url.Parse(c.Transport.ProxyURL); err != nil {
+			errors = append(errors, ValidationError{
+				Field:   "Transport.ProxyURL",
+				Message: "invalid proxy URL",
+				Value:   c.Transport.ProxyURL,
+			})
+		}
+	}
+
+	return errors
+}
+
+// validateCircuit validates circuit breaker configuration
+func (c *UnifiedConfig) validateCircuit() ValidationErrors {
+	var errors ValidationErrors
+
+	if !c.Circuit.Enabled {
+		return errors
+	}
+
+	// Consecutive failures must be reasonable
+	if c.Circuit.ConsecutiveFailures < 1 || c.Circuit.ConsecutiveFailures > 100 {
+		errors = append(errors, ValidationError{
+			Field:   "Circuit.ConsecutiveFailures",
+			Message: "consecutive failures must be between 1 and 100",
+			Value:   c.Circuit.ConsecutiveFailures,
+		})
+	}
+
+	// Failure ratio must be between 0 and 1
+	if c.Circuit.FailureRatio < 0 || c.Circuit.FailureRatio > 1 {
+		errors = append(errors, ValidationError{
+			Field:   "Circuit.FailureRatio",
+			Message: "failure ratio must be between 0 and 1",
+			Value:   c.Circuit.FailureRatio,
+		})
+	}
+
+	// OnOpen action must be valid
+	validActions := map[string]bool{
+		"reject":      true,
+		"fallback":    true,
+		"passthrough": true,
+	}
+	if !validActions[c.Circuit.OnOpen] {
+		errors = append(errors, ValidationError{
+			Field:   "Circuit.OnOpen",
+			Message: "invalid OnOpen action (must be reject, fallback, or passthrough)",
+			Value:   c.Circuit.OnOpen,
+		})
+	}
+
+	return errors
+}

config/validator_test.go

@@ -0,0 +1,588 @@
+//go:build !yaegi
+
+package config
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestValidateUnifiedConfig tests the validation of UnifiedConfig
+func TestValidateUnifiedConfig(t *testing.T) {
+	tests := []struct {
+		name        string
+		config      *UnifiedConfig
+		expectError bool
+		errorField  string
+	}{
+		{
+			name: "valid config with minimum requirements",
+			config: &UnifiedConfig{
+				Provider: ProviderConfig{
+					IssuerURL:    "https://auth.example.com",
+					ClientID:     "test-client",
+					ClientSecret: "secret",
+					Scopes:       []string{"openid", "profile", "email"},
+				},
+				Session: SessionConfig{
+					Name:          "oidc_session",
+					EncryptionKey: "this-is-a-32-character-key-12345",
+					ChunkSize:     4000,
+					MaxChunks:     5,
+					StorageType:   "cookie",
+				},
+				Token: TokenConfig{
+					AccessTokenTTL:  time.Hour,
+					RefreshTokenTTL: 24 * time.Hour,
+					ValidationMode:  "jwt",
+				},
+				Middleware: MiddlewareConfig{
+					MaxRequestSize: 10 * 1024 * 1024,
+					RequestTimeout: 30 * time.Second,
+				},
+				Logging: LoggingConfig{
+					Level:  "info",
+					Format: "json",
+					Output: "stdout",
+				},
+			},
+			expectError: false,
+		},
+		{
+			name: "missing provider URL",
+			config: &UnifiedConfig{
+				Provider: ProviderConfig{
+					ClientID:     "test-client",
+					ClientSecret: "secret",
+				},
+				Session: SessionConfig{
+					EncryptionKey: "this-is-a-32-character-key-12345",
+				},
+			},
+			expectError: true,
+			errorField:  "Provider.IssuerURL",
+		},
+		{
+			name: "missing client ID",
+			config: &UnifiedConfig{
+				Provider: ProviderConfig{
+					IssuerURL:    "https://auth.example.com",
+					ClientSecret: "secret",
+				},
+				Session: SessionConfig{
+					EncryptionKey: "this-is-a-32-character-key-12345",
+				},
+			},
+			expectError: true,
+			errorField:  "Provider.ClientID",
+		},
+		{
+			name: "encryption key too short",
+			config: &UnifiedConfig{
+				Provider: ProviderConfig{
+					IssuerURL:    "https://auth.example.com",
+					ClientID:     "test-client",
+					ClientSecret: "secret",
+				},
+				Session: SessionConfig{
+					EncryptionKey: "too-short",
+				},
+			},
+			expectError: true,
+			errorField:  "Session.EncryptionKey",
+		},
+		{
+			name: "invalid chunk size",
+			config: &UnifiedConfig{
+				Provider: ProviderConfig{
+					IssuerURL:    "https://auth.example.com",
+					ClientID:     "test-client",
+					ClientSecret: "secret",
+				},
+				Session: SessionConfig{
+					EncryptionKey: "this-is-a-32-character-key-12345",
+					ChunkSize:     500, // Too small
+				},
+			},
+			expectError: true,
+			errorField:  "Session.ChunkSize",
+		},
+		{
+			name: "invalid max chunks",
+			config: &UnifiedConfig{
+				Provider: ProviderConfig{
+					IssuerURL:    "https://auth.example.com",
+					ClientID:     "test-client",
+					ClientSecret: "secret",
+				},
+				Session: SessionConfig{
+					EncryptionKey: "this-is-a-32-character-key-12345",
+					ChunkSize:     4000,
+					MaxChunks:     0, // Too small
+				},
+			},
+			expectError: true,
+			errorField:  "Session.MaxChunks",
+		},
+		{
+			name: "invalid TLS min version",
+			config: &UnifiedConfig{
+				Provider: ProviderConfig{
+					IssuerURL:    "https://auth.example.com",
+					ClientID:     "test-client",
+					ClientSecret: "secret",
+				},
+				Session: SessionConfig{
+					EncryptionKey: "this-is-a-32-character-key-12345",
+				},
+				Transport: TransportConfig{
+					TLSMinVersion: "1.0", // Too old
+				},
+			},
+			expectError: true,
+			errorField:  "Transport.TLSMinVersion",
+		},
+		{
+			name: "invalid circuit breaker failure ratio",
+			config: &UnifiedConfig{
+				Provider: ProviderConfig{
+					IssuerURL:    "https://auth.example.com",
+					ClientID:     "test-client",
+					ClientSecret: "secret",
+				},
+				Session: SessionConfig{
+					EncryptionKey: "this-is-a-32-character-key-12345",
+				},
+				Circuit: CircuitConfig{
+					Enabled:      true,
+					FailureRatio: 1.5, // Too high
+				},
+			},
+			expectError: true,
+			errorField:  "Circuit.FailureRatio",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.config.Validate()
+
+			if tt.expectError {
+				if err == nil {
+					t.Errorf("Expected validation error for field %s, but got none", tt.errorField)
+				} else if validationErrs, ok := err.(ValidationErrors); ok {
+					found := false
+					for _, e := range validationErrs {
+						if e.Field == tt.errorField {
+							found = true
+							break
+						}
+					}
+					if !found {
+						t.Errorf("Expected validation error for field %s, but got errors for: %v",
+							tt.errorField, validationErrs)
+					}
+				}
+			} else {
+				if err != nil {
+					t.Errorf("Expected no validation error, but got: %v", err)
+				}
+			}
+		})
+	}
+}
+
+// TestValidationErrorMessage tests validation error formatting
+func TestValidationErrorMessage(t *testing.T) {
+	errs := ValidationErrors{
+		{
+			Field:   "Provider.IssuerURL",
+			Message: "is required",
+			Value:   nil,
+		},
+		{
+			Field:   "Session.EncryptionKey",
+			Message: "must be at least 32 characters",
+			Value:   16,
+		},
+	}
+
+	errMsg := errs.Error()
+
+	if !strings.Contains(errMsg, "Provider.IssuerURL") {
+		t.Error("Error message should contain field name Provider.IssuerURL")
+	}
+	if !strings.Contains(errMsg, "is required") {
+		t.Error("Error message should contain 'is required'")
+	}
+	if !strings.Contains(errMsg, "Session.EncryptionKey") {
+		t.Error("Error message should contain field name Session.EncryptionKey")
+	}
+	if !strings.Contains(errMsg, "must be at least 32 characters") {
+		t.Error("Error message should contain 'must be at least 32 characters'")
+	}
+}
+
+// TestValidateRedisConfig tests Redis configuration validation
+func TestValidateRedisConfig(t *testing.T) {
+	tests := []struct {
+		name        string
+		config      *RedisConfig
+		expectError bool
+		errorMsg    string
+	}{
+		{
+			name: "valid standalone config",
+			config: &RedisConfig{
+				Enabled: true,
+				Mode:    RedisModeStandalone,
+				Addr:    "localhost:6379",
+			},
+			expectError: false,
+		},
+		{
+			name: "missing address for standalone",
+			config: &RedisConfig{
+				Enabled: true,
+				Mode:    RedisModeStandalone,
+				Addr:    "",
+			},
+			expectError: true,
+			errorMsg:    "Redis address is required",
+		},
+		{
+			name: "valid cluster config",
+			config: &RedisConfig{
+				Enabled:      true,
+				Mode:         RedisModeCluster,
+				ClusterAddrs: []string{"localhost:7000", "localhost:7001"},
+			},
+			expectError: false,
+		},
+		{
+			name: "missing cluster addresses",
+			config: &RedisConfig{
+				Enabled:      true,
+				Mode:         RedisModeCluster,
+				ClusterAddrs: []string{},
+			},
+			expectError: true,
+			errorMsg:    "cluster address is required",
+		},
+		{
+			name: "valid sentinel config",
+			config: &RedisConfig{
+				Enabled:       true,
+				Mode:          RedisModeSentinel,
+				MasterName:    "mymaster",
+				SentinelAddrs: []string{"localhost:26379"},
+			},
+			expectError: false,
+		},
+		{
+			name: "missing master name for sentinel",
+			config: &RedisConfig{
+				Enabled:       true,
+				Mode:          RedisModeSentinel,
+				MasterName:    "",
+				SentinelAddrs: []string{"localhost:26379"},
+			},
+			expectError: true,
+			errorMsg:    "Master name is required",
+		},
+		{
+			name: "missing sentinel addresses",
+			config: &RedisConfig{
+				Enabled:       true,
+				Mode:          RedisModeSentinel,
+				MasterName:    "mymaster",
+				SentinelAddrs: []string{},
+			},
+			expectError: true,
+			errorMsg:    "sentinel address is required",
+		},
+		{
+			name: "disabled redis needs no validation",
+			config: &RedisConfig{
+				Enabled: false,
+			},
+			expectError: false,
+		},
+		{
+			name: "invalid redis mode",
+			config: &RedisConfig{
+				Enabled: true,
+				Mode:    "invalid-mode",
+			},
+			expectError: true,
+			errorMsg:    "Invalid Redis mode",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.config.Validate()
+
+			if tt.expectError {
+				if err == nil {
+					t.Errorf("Expected validation error containing '%s', but got none", tt.errorMsg)
+				} else if !strings.Contains(err.Error(), tt.errorMsg) {
+					t.Errorf("Expected error message to contain '%s', but got: %v", tt.errorMsg, err)
+				}
+			} else {
+				if err != nil {
+					t.Errorf("Expected no validation error, but got: %v", err)
+				}
+			}
+		})
+	}
+}
+
+// ============================================================================
+// validateRateLimit Tests
+// ============================================================================
+
+func TestValidateRateLimit_Disabled(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.RateLimit.Enabled = false
+
+	errors := config.validateRateLimit()
+
+	assert.Empty(t, errors, "Should have no errors when rate limiting is disabled")
+}
+
+func TestValidateRateLimit_ValidConfig(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.RateLimit.Enabled = true
+	config.RateLimit.RequestsPerSecond = 100
+	config.RateLimit.Burst = 200
+	config.RateLimit.KeyType = "ip"
+
+	errors := config.validateRateLimit()
+
+	assert.Empty(t, errors, "Should have no errors for valid rate limit config")
+}
+
+func TestValidateRateLimit_RequestsPerSecondTooLow(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.RateLimit.Enabled = true
+	config.RateLimit.RequestsPerSecond = 0
+	config.RateLimit.Burst = 100
+	config.RateLimit.KeyType = "ip"
+
+	errors := config.validateRateLimit()
+
+	require.Len(t, errors, 1)
+	assert.Equal(t, "RateLimit.RequestsPerSecond", errors[0].Field)
+	assert.Contains(t, errors[0].Message, "between 1 and 10000")
+}
+
+func TestValidateRateLimit_RequestsPerSecondTooHigh(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.RateLimit.Enabled = true
+	config.RateLimit.RequestsPerSecond = 15000
+	config.RateLimit.Burst = 20000
+	config.RateLimit.KeyType = "ip"
+
+	errors := config.validateRateLimit()
+
+	require.Len(t, errors, 1)
+	assert.Equal(t, "RateLimit.RequestsPerSecond", errors[0].Field)
+	assert.Contains(t, errors[0].Message, "between 1 and 10000")
+}
+
+func TestValidateRateLimit_BurstTooSmall(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.RateLimit.Enabled = true
+	config.RateLimit.RequestsPerSecond = 100
+	config.RateLimit.Burst = 50 // Less than RequestsPerSecond
+	config.RateLimit.KeyType = "ip"
+
+	errors := config.validateRateLimit()
+
+	require.Len(t, errors, 1)
+	assert.Equal(t, "RateLimit.Burst", errors[0].Field)
+	assert.Contains(t, errors[0].Message, "at least as large as requests per second")
+}
+
+func TestValidateRateLimit_InvalidKeyType(t *testing.T) {
+	tests := []struct {
+		name    string
+		keyType string
+	}{
+		{"empty key type", ""},
+		{"invalid key type", "invalid"},
+		{"random string", "foobar"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := NewUnifiedConfig()
+			config.RateLimit.Enabled = true
+			config.RateLimit.RequestsPerSecond = 100
+			config.RateLimit.Burst = 200
+			config.RateLimit.KeyType = tt.keyType
+
+			errors := config.validateRateLimit()
+
+			require.Len(t, errors, 1)
+			assert.Equal(t, "RateLimit.KeyType", errors[0].Field)
+			assert.Contains(t, errors[0].Message, "invalid key type")
+		})
+	}
+}
+
+func TestValidateRateLimit_ValidKeyTypes(t *testing.T) {
+	validKeyTypes := []string{"ip", "user", "token", "custom"}
+
+	for _, keyType := range validKeyTypes {
+		t.Run(keyType, func(t *testing.T) {
+			config := NewUnifiedConfig()
+			config.RateLimit.Enabled = true
+			config.RateLimit.RequestsPerSecond = 100
+			config.RateLimit.Burst = 200
+			config.RateLimit.KeyType = keyType
+
+			errors := config.validateRateLimit()
+
+			assert.Empty(t, errors, "Should have no errors for valid key type: %s", keyType)
+		})
+	}
+}
+
+func TestValidateRateLimit_MultipleErrors(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.RateLimit.Enabled = true
+	config.RateLimit.RequestsPerSecond = 0 // Too low
+	config.RateLimit.Burst = 50            // Will pass (0 < 50)
+	config.RateLimit.KeyType = "invalid"   // Invalid
+
+	errors := config.validateRateLimit()
+
+	// Should have 2 errors (rps and keyType)
+	assert.Len(t, errors, 2)
+
+	// Check each error is present
+	fields := make(map[string]bool)
+	for _, err := range errors {
+		fields[err.Field] = true
+	}
+	assert.True(t, fields["RateLimit.RequestsPerSecond"])
+	assert.True(t, fields["RateLimit.KeyType"])
+}
+
+// ============================================================================
+// validateMetrics Tests
+// ============================================================================
+
+func TestValidateMetrics_Disabled(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.Metrics.Enabled = false
+
+	errors := config.validateMetrics()
+
+	assert.Empty(t, errors, "Should have no errors when metrics are disabled")
+}
+
+func TestValidateMetrics_ValidPrometheus(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.Metrics.Enabled = true
+	config.Metrics.Provider = "prometheus"
+	config.Metrics.Endpoint = "" // Prometheus doesn't require endpoint
+
+	errors := config.validateMetrics()
+
+	assert.Empty(t, errors, "Should have no errors for valid prometheus config")
+}
+
+func TestValidateMetrics_ValidStatsd(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.Metrics.Enabled = true
+	config.Metrics.Provider = "statsd"
+	config.Metrics.Endpoint = "localhost:8125"
+
+	errors := config.validateMetrics()
+
+	assert.Empty(t, errors, "Should have no errors for valid statsd config")
+}
+
+func TestValidateMetrics_ValidOTLP(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.Metrics.Enabled = true
+	config.Metrics.Provider = "otlp"
+	config.Metrics.Endpoint = "localhost:4317"
+
+	errors := config.validateMetrics()
+
+	assert.Empty(t, errors, "Should have no errors for valid otlp config")
+}
+
+func TestValidateMetrics_InvalidProvider(t *testing.T) {
+	tests := []struct {
+		name     string
+		provider string
+	}{
+		{"empty provider", ""},
+		{"invalid provider", "invalid"},
+		{"datadog", "datadog"},
+		{"influx", "influx"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := NewUnifiedConfig()
+			config.Metrics.Enabled = true
+			config.Metrics.Provider = tt.provider
+			config.Metrics.Endpoint = "localhost:8080"
+
+			errors := config.validateMetrics()
+
+			require.Len(t, errors, 1)
+			assert.Equal(t, "Metrics.Provider", errors[0].Field)
+			assert.Contains(t, errors[0].Message, "invalid metrics provider")
+		})
+	}
+}
+
+func TestValidateMetrics_StatsdMissingEndpoint(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.Metrics.Enabled = true
+	config.Metrics.Provider = "statsd"
+	config.Metrics.Endpoint = "" // Missing required endpoint
+
+	errors := config.validateMetrics()
+
+	require.Len(t, errors, 1)
+	assert.Equal(t, "Metrics.Endpoint", errors[0].Field)
+	assert.Contains(t, errors[0].Message, "endpoint is required for statsd provider")
+}
+
+func TestValidateMetrics_OTLPMissingEndpoint(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.Metrics.Enabled = true
+	config.Metrics.Provider = "otlp"
+	config.Metrics.Endpoint = "" // Missing required endpoint
+
+	errors := config.validateMetrics()
+
+	require.Len(t, errors, 1)
+	assert.Equal(t, "Metrics.Endpoint", errors[0].Field)
+	assert.Contains(t, errors[0].Message, "endpoint is required for otlp provider")
+}
+
+func TestValidateMetrics_MultipleErrors(t *testing.T) {
+	config := NewUnifiedConfig()
+	config.Metrics.Enabled = true
+	config.Metrics.Provider = "invalid" // Invalid provider
+	config.Metrics.Endpoint = ""        // Would be missing if provider was statsd/otlp
+
+	errors := config.validateMetrics()
+
+	// Should have at least 1 error for invalid provider
+	assert.NotEmpty(t, errors)
+	assert.Equal(t, "Metrics.Provider", errors[0].Field)
+}

config_marshalling.go

@@ -0,0 +1,116 @@
+package traefikoidc
+
+import (
+	"encoding/json"
+)
+
+// REDACTED is the placeholder value for sensitive information
+const REDACTED = "[REDACTED]"
+
+// MarshalJSON implements custom JSON marshalling to redact sensitive fields
+// Rewritten without type aliases for yaegi compatibility
+func (c Config) MarshalJSON() ([]byte, error) {
+	// Build a map manually to avoid type alias issues with yaegi
+	result := make(map[string]interface{})
+
+	// Copy public fields
+	result["providerURL"] = c.ProviderURL
+	result["clientID"] = c.ClientID
+	result["callbackURL"] = c.CallbackURL
+	result["logoutURL"] = c.LogoutURL
+	result["postLogoutRedirectURI"] = c.PostLogoutRedirectURI
+	result["scopes"] = c.Scopes
+	result["forceHTTPS"] = c.ForceHTTPS
+	result["logLevel"] = c.LogLevel
+	result["rateLimit"] = c.RateLimit
+	result["excludedURLs"] = c.ExcludedURLs
+	result["allowedUserDomains"] = c.AllowedUserDomains
+	result["allowedUsers"] = c.AllowedUsers
+	result["allowedRolesAndGroups"] = c.AllowedRolesAndGroups
+
+	// Redact sensitive fields
+	result["clientSecret"] = REDACTED
+	result["sessionEncryptionKey"] = REDACTED
+
+	// Handle Redis config
+	if c.Redis != nil {
+		redisMap := make(map[string]interface{})
+		redisMap["enabled"] = c.Redis.Enabled
+		redisMap["address"] = c.Redis.Address
+		redisMap["password"] = REDACTED
+		redisMap["db"] = c.Redis.DB
+		redisMap["poolSize"] = c.Redis.PoolSize
+		redisMap["cacheMode"] = c.Redis.CacheMode
+		result["redis"] = redisMap
+	}
+
+	return json.Marshal(result)
+}
+
+// MarshalYAML implements custom YAML marshalling to redact sensitive fields
+// Rewritten without type aliases for yaegi compatibility
+func (c Config) MarshalYAML() (interface{}, error) {
+	// Build a map manually to avoid type alias issues with yaegi
+	result := make(map[string]interface{})
+
+	// Copy public fields
+	result["providerURL"] = c.ProviderURL
+	result["clientID"] = c.ClientID
+	result["callbackURL"] = c.CallbackURL
+	result["logoutURL"] = c.LogoutURL
+	result["postLogoutRedirectURI"] = c.PostLogoutRedirectURI
+	result["scopes"] = c.Scopes
+	result["forceHTTPS"] = c.ForceHTTPS
+	result["logLevel"] = c.LogLevel
+	result["rateLimit"] = c.RateLimit
+	result["excludedURLs"] = c.ExcludedURLs
+	result["allowedUserDomains"] = c.AllowedUserDomains
+	result["allowedUsers"] = c.AllowedUsers
+	result["allowedRolesAndGroups"] = c.AllowedRolesAndGroups
+
+	// Redact sensitive fields
+	result["clientSecret"] = REDACTED
+	result["sessionEncryptionKey"] = REDACTED
+
+	// Handle Redis config
+	if c.Redis != nil {
+		redisMap := make(map[string]interface{})
+		redisMap["enabled"] = c.Redis.Enabled
+		redisMap["address"] = c.Redis.Address
+		redisMap["password"] = REDACTED
+		redisMap["db"] = c.Redis.DB
+		redisMap["poolSize"] = c.Redis.PoolSize
+		redisMap["cacheMode"] = c.Redis.CacheMode
+		result["redis"] = redisMap
+	}
+
+	return result, nil
+}
+
+// MarshalJSON for RedisConfig to redact sensitive fields
+// Rewritten without type aliases for yaegi compatibility
+func (r RedisConfig) MarshalJSON() ([]byte, error) {
+	result := make(map[string]interface{})
+	result["enabled"] = r.Enabled
+	result["address"] = r.Address
+	result["password"] = REDACTED
+	result["db"] = r.DB
+	result["poolSize"] = r.PoolSize
+	result["cacheMode"] = r.CacheMode
+
+	return json.Marshal(result)
+}
+
+// MarshalYAML for RedisConfig to redact sensitive fields
+// Rewritten without type aliases for yaegi compatibility
+func (r RedisConfig) MarshalYAML() (interface{}, error) {
+	result := make(map[string]interface{})
+	result["enabled"] = r.Enabled
+	result["address"] = r.Address
+	result["password"] = REDACTED
+	result["db"] = r.DB
+	result["poolSize"] = r.PoolSize
+	result["cacheMode"] = r.CacheMode
+
+	return result, nil
+}

csrf_session_test.go

@@ -18,7 +18,7 @@ func TestCSRFTokenSessionManagement(t *testing.T) {
 	// Test that CSRF tokens persist through the authentication flow
 	t.Run("CSRF_Token_Persists_After_Selective_Clear", func(t *testing.T) {
 		// Create a session manager
-		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 		require.NoError(t, err)
 
 		// Create initial request
@@ -90,7 +90,7 @@ func TestCSRFTokenSessionManagement(t *testing.T) {
 
 	// Test that marking session as dirty forces save
 	t.Run("Mark_Dirty_Forces_Session_Save", func(t *testing.T) {
-		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 		require.NoError(t, err)
 
 		req := httptest.NewRequest("GET", "http://example.com/test", nil)
@@ -126,7 +126,7 @@ func TestCSRFTokenSessionManagement(t *testing.T) {
 
 	// Test Azure-specific session handling
 	t.Run("Azure_Session_Cookie_Configuration", func(t *testing.T) {
-		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 		require.NoError(t, err)
 
 		// Simulate Azure callback scenario
@@ -158,7 +158,7 @@ func TestCSRFTokenSessionManagement(t *testing.T) {
 
 	// Test session continuity through auth flow
 	t.Run("Session_Continuity_Through_Auth_Flow", func(t *testing.T) {
-		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 		require.NoError(t, err)
 
 		// Step 1: Initial request
@@ -199,7 +199,7 @@ func TestCSRFTokenSessionManagement(t *testing.T) {
 
 	// Test large token handling doesn't affect CSRF
 	t.Run("Large_Tokens_Dont_Affect_CSRF", func(t *testing.T) {
-		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 		require.NoError(t, err)
 
 		req := httptest.NewRequest("GET", "http://example.com/test", nil)
@@ -262,7 +262,7 @@ func TestAuthFlowWithoutExternalDependencies(t *testing.T) {
 
 	// We can't fully initialize TraefikOidc without network access,
 	// but we can test the session management directly
-	sessionManager, err := NewSessionManager(plugin.SessionEncryptionKey, plugin.ForceHTTPS, "", NewLogger(plugin.LogLevel))
+	sessionManager, err := NewSessionManager(plugin.SessionEncryptionKey, plugin.ForceHTTPS, "", "", 0, NewLogger(plugin.LogLevel))
 	require.NoError(t, err)
 
 	t.Run("Session_Created_On_Protected_Request", func(t *testing.T) {
@@ -291,7 +291,7 @@ func TestAuthFlowWithoutExternalDependencies(t *testing.T) {
 // TestRegressionLoginLoop specifically tests the fix for issue #53
 func TestRegressionLoginLoop(t *testing.T) {
 	// This test verifies that the specific changes made to fix the login loop work correctly
-	sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+	sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 	require.NoError(t, err)
 
 	// Simulate the exact flow that was causing the login loop
@@ -392,7 +392,7 @@ func TestRegressionLoginLoop(t *testing.T) {
 
 // TestCSRFValidationTiming tests timing-sensitive CSRF validation scenarios
 func TestCSRFValidationTiming(t *testing.T) {
-	sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+	sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 	require.NoError(t, err)
 
 	t.Run("Rapid_Redirect_Maintains_CSRF", func(t *testing.T) {

custom_claims_test.go

@@ -0,0 +1,364 @@
+//go:build !yaegi
+
+package traefikoidc
+
+import (
+	"testing"
+)
+
+// TestCustomClaimNames_DefaultBehavior tests backward compatibility with default claim names
+func TestCustomClaimNames_DefaultBehavior(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Explicitly set defaults to test backward compatibility
+	ts.tOidc.roleClaimName = "roles"
+	ts.tOidc.groupClaimName = "groups"
+
+	// Test that when no custom claim names are configured, it uses defaults "roles" and "groups"
+	claims := map[string]interface{}{
+		"groups": []interface{}{"admin", "users"},
+		"roles":  []interface{}{"editor", "viewer"},
+	}
+
+	token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims)
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	groups, roles, err := ts.tOidc.extractGroupsAndRoles(token)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+
+	if !stringSliceEqual(groups, []string{"admin", "users"}) {
+		t.Errorf("Expected groups [admin users], got %v", groups)
+	}
+
+	if !stringSliceEqual(roles, []string{"editor", "viewer"}) {
+		t.Errorf("Expected roles [editor viewer], got %v", roles)
+	}
+}
+
+// TestCustomClaimNames_Auth0Namespaced tests Auth0-style namespaced claims
+func TestCustomClaimNames_Auth0Namespaced(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Configure custom claim names for Auth0
+	ts.tOidc.roleClaimName = "https://myapp.com/roles"
+	ts.tOidc.groupClaimName = "https://myapp.com/groups"
+
+	// Create token with Auth0-style namespaced claims
+	claims := map[string]interface{}{
+		"https://myapp.com/groups": []interface{}{"admin", "users"},
+		"https://myapp.com/roles":  []interface{}{"editor", "viewer"},
+	}
+
+	token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims)
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	groups, roles, err := ts.tOidc.extractGroupsAndRoles(token)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+
+	if !stringSliceEqual(groups, []string{"admin", "users"}) {
+		t.Errorf("Expected groups [admin users], got %v", groups)
+	}
+
+	if !stringSliceEqual(roles, []string{"editor", "viewer"}) {
+		t.Errorf("Expected roles [editor viewer], got %v", roles)
+	}
+}
+
+// TestCustomClaimNames_CustomSimpleNames tests custom simple claim names
+func TestCustomClaimNames_CustomSimpleNames(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Configure custom simple claim names
+	ts.tOidc.roleClaimName = "user_roles"
+	ts.tOidc.groupClaimName = "user_groups"
+
+	// Create token with custom claim names
+	claims := map[string]interface{}{
+		"user_groups": []interface{}{"engineering", "product"},
+		"user_roles":  []interface{}{"developer", "manager"},
+	}
+
+	token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims)
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	groups, roles, err := ts.tOidc.extractGroupsAndRoles(token)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+
+	if !stringSliceEqual(groups, []string{"engineering", "product"}) {
+		t.Errorf("Expected groups [engineering product], got %v", groups)
+	}
+
+	if !stringSliceEqual(roles, []string{"developer", "manager"}) {
+		t.Errorf("Expected roles [developer manager], got %v", roles)
+	}
+}
+
+// TestCustomClaimNames_MissingClaims tests behavior when custom claims are missing
+func TestCustomClaimNames_MissingClaims(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Configure custom claim names
+	ts.tOidc.roleClaimName = "custom_roles"
+	ts.tOidc.groupClaimName = "custom_groups"
+
+	// Create token WITHOUT the custom claims
+	claims := map[string]interface{}{
+		"sub":   "user123",
+		"email": "[email protected]",
+	}
+
+	token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims)
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	groups, roles, err := ts.tOidc.extractGroupsAndRoles(token)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+
+	// Should return empty slices, not error
+	if len(groups) != 0 {
+		t.Errorf("Expected empty groups, got %v", groups)
+	}
+
+	if len(roles) != 0 {
+		t.Errorf("Expected empty roles, got %v", roles)
+	}
+}
+
+// TestCustomClaimNames_MalformedClaims tests error handling for malformed claims
+func TestCustomClaimNames_MalformedRoleClaim(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Configure custom claim names
+	ts.tOidc.roleClaimName = "custom_roles"
+
+	// Create token with malformed role claim (not an array)
+	claims := map[string]interface{}{
+		"custom_roles": "this-should-be-an-array",
+	}
+
+	token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims)
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	_, _, err = ts.tOidc.extractGroupsAndRoles(token)
+	if err == nil {
+		t.Error("Expected error for malformed role claim, got nil")
+	}
+
+	// Check error message contains the custom claim name
+	expectedError := "custom_roles claim is not an array"
+	if err.Error() != expectedError {
+		t.Errorf("Expected error '%s', got '%s'", expectedError, err.Error())
+	}
+}
+
+// TestCustomClaimNames_MalformedGroupClaim tests error handling for malformed group claims
+func TestCustomClaimNames_MalformedGroupClaim(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Configure custom claim names
+	ts.tOidc.groupClaimName = "custom_groups"
+
+	// Create token with malformed group claim (not an array)
+	claims := map[string]interface{}{
+		"custom_groups": 12345, // Not an array
+	}
+
+	token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims)
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	_, _, err = ts.tOidc.extractGroupsAndRoles(token)
+	if err == nil {
+		t.Error("Expected error for malformed group claim, got nil")
+	}
+
+	// Check error message contains the custom claim name
+	expectedError := "custom_groups claim is not an array"
+	if err.Error() != expectedError {
+		t.Errorf("Expected error '%s', got '%s'", expectedError, err.Error())
+	}
+}
+
+// TestCustomClaimNames_PartialConfiguration tests when only one claim name is customized
+func TestCustomClaimNames_OnlyRoleCustomized(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Configure only role claim name (group uses default)
+	ts.tOidc.roleClaimName = "https://myapp.com/roles"
+	ts.tOidc.groupClaimName = "groups" // default
+
+	// Create token with mixed claim names
+	claims := map[string]interface{}{
+		"groups":                  []interface{}{"admin"},
+		"https://myapp.com/roles": []interface{}{"editor"},
+	}
+
+	token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims)
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	groups, roles, err := ts.tOidc.extractGroupsAndRoles(token)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+
+	if !stringSliceEqual(groups, []string{"admin"}) {
+		t.Errorf("Expected groups [admin], got %v", groups)
+	}
+
+	if !stringSliceEqual(roles, []string{"editor"}) {
+		t.Errorf("Expected roles [editor], got %v", roles)
+	}
+}
+
+// TestCustomClaimNames_OnlyGroupCustomized tests when only group claim name is customized
+func TestCustomClaimNames_OnlyGroupCustomized(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Configure only group claim name (role uses default)
+	ts.tOidc.roleClaimName = "roles" // default
+	ts.tOidc.groupClaimName = "https://myapp.com/groups"
+
+	// Create token with mixed claim names
+	claims := map[string]interface{}{
+		"roles":                    []interface{}{"viewer"},
+		"https://myapp.com/groups": []interface{}{"users"},
+	}
+
+	token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims)
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	groups, roles, err := ts.tOidc.extractGroupsAndRoles(token)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+
+	if !stringSliceEqual(groups, []string{"users"}) {
+		t.Errorf("Expected groups [users], got %v", groups)
+	}
+
+	if !stringSliceEqual(roles, []string{"viewer"}) {
+		t.Errorf("Expected roles [viewer], got %v", roles)
+	}
+}
+
+// TestCustomClaimNames_EmptyArrays tests extraction with empty claim arrays
+func TestCustomClaimNames_EmptyArrays(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Configure custom claim names
+	ts.tOidc.roleClaimName = "https://myapp.com/roles"
+	ts.tOidc.groupClaimName = "https://myapp.com/groups"
+
+	// Create token with empty arrays
+	claims := map[string]interface{}{
+		"https://myapp.com/groups": []interface{}{},
+		"https://myapp.com/roles":  []interface{}{},
+	}
+
+	token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims)
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	groups, roles, err := ts.tOidc.extractGroupsAndRoles(token)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+
+	if len(groups) != 0 {
+		t.Errorf("Expected empty groups, got %v", groups)
+	}
+
+	if len(roles) != 0 {
+		t.Errorf("Expected empty roles, got %v", roles)
+	}
+}
+
+// TestCustomClaimNames_NonStringElements tests handling of non-string elements in claim arrays
+func TestCustomClaimNames_NonStringInRoleArray(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Configure custom claim names
+	ts.tOidc.roleClaimName = "custom_roles"
+
+	// Create token with mixed-type array (should skip non-string elements)
+	claims := map[string]interface{}{
+		"custom_roles": []interface{}{"role1", 12345, "role2", true},
+	}
+
+	token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims)
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	_, roles, err := ts.tOidc.extractGroupsAndRoles(token)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+
+	// Should only extract string elements
+	if !stringSliceEqual(roles, []string{"role1", "role2"}) {
+		t.Errorf("Expected roles [role1 role2], got %v", roles)
+	}
+}
+
+// TestCustomClaimNames_NonStringInGroupArray tests handling of non-string elements in group arrays
+func TestCustomClaimNames_NonStringInGroupArray(t *testing.T) {
+	ts := NewTestSuite(t)
+	ts.Setup()
+
+	// Configure custom claim names
+	ts.tOidc.groupClaimName = "custom_groups"
+
+	// Create token with mixed-type array (should skip non-string elements)
+	claims := map[string]interface{}{
+		"custom_groups": []interface{}{"group1", nil, "group2", 3.14},
+	}
+
+	token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims)
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	groups, _, err := ts.tOidc.extractGroupsAndRoles(token)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+
+	// Should only extract string elements
+	if !stringSliceEqual(groups, []string{"group1", "group2"}) {
+		t.Errorf("Expected groups [group1 group2], got %v", groups)
+	}
+}

docs/AUTH0_AUDIENCE_GUIDE.md

@@ -0,0 +1,424 @@
+# Auth0 Audience Validation Guide
+
+## Overview
+
+This guide explains how to configure audience validation for Auth0 and other OIDC providers that support custom API audiences. It covers three common Auth0 scenarios and how to configure the middleware for maximum security.
+
+## Table of Contents
+
+1. [Understanding Audiences](#understanding-audiences)
+2. [The Three Auth0 Scenarios](#the-three-auth0-scenarios)
+3. [Configuration Options](#configuration-options)
+4. [Security Recommendations](#security-recommendations)
+5. [Troubleshooting](#troubleshooting)
+
+---
+
+## Understanding Audiences
+
+### What is an Audience?
+
+The **audience** (`aud`) claim in a JWT identifies the intended recipient of the token. Per OAuth 2.0 and OIDC specifications:
+
+- **ID Tokens**: MUST have `aud = client_id` (per OIDC Core 1.0 spec)
+- **Access Tokens**: Can have custom audiences (e.g., API identifiers)
+
+### Why Does This Matter?
+
+Proper audience validation prevents **token confusion attacks** where a token intended for one API is used to access another API.
+
+---
+
+## The Three Auth0 Scenarios
+
+### Scenario 1: Custom API Audience ✅ **RECOMMENDED**
+
+**Configuration:**
+```yaml
+audience: "https://my-api.example.com"  # Your API identifier from Auth0
+```
+
+**What Happens:**
+1. Authorization request includes `audience` parameter
+2. Auth0 issues:
+   - **ID Token**: `aud = client_id`
+   - **Access Token**: `aud = ["https://issuer/userinfo", "https://my-api.example.com"]`
+3. Middleware validates:
+   - ID tokens against `client_id`
+   - Access tokens against custom audience
+
+**Result:** ✅ Fully secure, OIDC compliant
+
+---
+
+### Scenario 2: Default Audience (No Custom API) ⚠️ **USE WITH CAUTION**
+
+**Configuration:**
+```yaml
+# audience not specified (defaults to client_id)
+```
+
+**What Happens:**
+1. Authorization request WITHOUT `audience` parameter
+2. Auth0 issues:
+   - **ID Token**: `aud = client_id`
+   - **Access Token**: `aud = ["https://issuer/userinfo", "default_api"]` (no `client_id`)
+3. Access token validation fails (audience mismatch)
+4. Middleware falls back to ID token validation
+
+**Security Warning:**
+```
+⚠️⚠️⚠️  SECURITY WARNING: Falling back to ID token validation despite access token audience mismatch!
+⚠️  This could allow tokens intended for different APIs to grant access
+⚠️  Set strictAudienceValidation=true to enforce proper audience validation
+⚠️  See: https://github.com/lukaszraczylo/traefikoidc/issues/74
+```
+
+**Recommended Fix:**
+```yaml
+strictAudienceValidation: true  # Reject sessions with audience mismatch
+```
+
+**Result:**
+- Default: ⚠️ Works but logs security warnings
+- With strict mode: ✅ Secure (rejects mismatched tokens)
+
+---
+
+### Scenario 3: Opaque Access Tokens ✅ **SUPPORTED**
+
+**Configuration:**
+```yaml
+allowOpaqueTokens: true              # Enable opaque token support
+requireTokenIntrospection: true      # Require introspection (recommended)
+```
+
+**What Happens:**
+1. Auth0 issues opaque (non-JWT) access token
+2. Middleware detects opaque token (not 3 parts separated by dots)
+3. Uses OAuth 2.0 Token Introspection (RFC 7662) to validate
+4. Falls back to ID token if introspection unavailable (unless `requireTokenIntrospection=true`)
+
+**Requirements:**
+- Provider must support `introspection_endpoint` in OIDC discovery
+- Client must have introspection permissions
+
+**Result:** ✅ Secure with introspection, ⚠️ risky without
+
+---
+
+## Configuration Options
+
+### Audience Settings
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `audience` | string | `client_id` | Expected audience for access tokens |
+
+**Example:**
+```yaml
+# .traefik.yml
+http:
+  middlewares:
+    oidc-auth:
+      plugin:
+        traefikoidc:
+          audience: "https://my-api.example.com"
+```
+
+---
+
+### Security Mode Settings
+
+#### `strictAudienceValidation`
+
+**Type:** boolean
+**Default:** `false`
+**Recommended:** `true` for production
+
+**What it does:**
+- When `true`: Rejects sessions if access token audience doesn't match (prevents Scenario 2)
+- When `false`: Logs warnings but allows fallback to ID token (backward compatible)
+
+**Example:**
+```yaml
+strictAudienceValidation: true
+```
+
+**When to use:**
+- ✅ Always use in production environments
+- ✅ When you have custom API audiences configured in Auth0
+- ⚠️ May break existing deployments relying on Scenario 2 behavior
+
+---
+
+#### `allowOpaqueTokens`
+
+**Type:** boolean
+**Default:** `false`
+
+**What it does:**
+- When `true`: Accepts opaque (non-JWT) access tokens
+- When `false`: Only accepts JWT access tokens
+
+**Example:**
+```yaml
+allowOpaqueTokens: true
+```
+
+**When to use:**
+- ✅ When Auth0 issues opaque tokens (no default API configured)
+- ✅ When using Auth0 Management API tokens
+- ⚠️ Requires introspection endpoint for security
+
+---
+
+#### `requireTokenIntrospection`
+
+**Type:** boolean
+**Default:** `false`
+**Recommended:** `true` when `allowOpaqueTokens=true`
+
+**What it does:**
+- When `true`: Rejects opaque tokens if introspection fails or endpoint unavailable
+- When `false`: Falls back to ID token validation for opaque tokens
+
+**Example:**
+```yaml
+allowOpaqueTokens: true
+requireTokenIntrospection: true
+```
+
+**When to use:**
+- ✅ Always use when `allowOpaqueTokens=true` for maximum security
+- ⚠️ Requires provider to expose introspection endpoint
+
+---
+
+## Security Recommendations
+
+### Recommended Configuration for Auth0
+
+**For APIs with custom audiences (Scenario 1):**
+```yaml
+audience: "https://my-api.example.com"
+strictAudienceValidation: true
+allowOpaqueTokens: false
+```
+
+**For default Auth0 setup (Scenario 2):**
+```yaml
+# Don't set audience (defaults to client_id)
+strictAudienceValidation: true  # Enforce proper configuration
+```
+
+**For opaque tokens (Scenario 3):**
+```yaml
+allowOpaqueTokens: true
+requireTokenIntrospection: true
+strictAudienceValidation: true
+```
+
+### Security Best Practices
+
+1. ✅ **Always set `strictAudienceValidation: true` in production**
+2. ✅ **Configure custom API audiences in Auth0 dashboard**
+3. ✅ **Use `requireTokenIntrospection: true` if accepting opaque tokens**
+4. ✅ **Monitor logs for security warnings**
+5. ❌ **Don't rely on Scenario 2 fallback behavior**
+
+---
+
+## Troubleshooting
+
+### "Access token validation failed due to audience mismatch"
+
+**Symptom:**
+```
+⚠️  SCENARIO 2 DETECTED: Access token validation failed due to audience mismatch
+```
+
+**Cause:** Access token audience doesn't match configured audience
+
+**Solutions:**
+1. **Configure correct audience:**
+   ```yaml
+   audience: "https://your-api-identifier"  # From Auth0 API settings
+   ```
+
+2. **Update Auth0 authorization request:**
+   - Ensure `audience` parameter is included in authorize URL
+   - Middleware automatically adds this when `audience != client_id`
+
+3. **Accept the behavior (not recommended):**
+   ```yaml
+   strictAudienceValidation: false  # Logs warnings but allows
+   ```
+
+---
+
+### "Opaque token detected but allowOpaqueTokens=false"
+
+**Symptom:**
+```
+⚠️  Opaque access token detected but allowOpaqueTokens=false
+```
+
+**Cause:** Auth0 issued non-JWT access token but middleware not configured to accept them
+
+**Solutions:**
+1. **Enable opaque tokens:**
+   ```yaml
+   allowOpaqueTokens: true
+   requireTokenIntrospection: true
+   ```
+
+2. **Configure Auth0 to issue JWT access tokens:**
+   - Create an API in Auth0 dashboard
+   - Set API identifier as `audience` in configuration
+
+---
+
+### "Introspection endpoint not available"
+
+**Symptom:**
+```
+⚠️  Opaque tokens enabled but no introspection endpoint available from provider
+```
+
+**Cause:** Auth0 provider metadata doesn't include `introspection_endpoint`
+
+**Solutions:**
+1. **Check provider discovery:**
+   ```bash
+   curl https://YOUR_DOMAIN/.well-known/openid-configuration
+   ```
+   Look for `introspection_endpoint`
+
+2. **Disable required introspection (less secure):**
+   ```yaml
+   allowOpaqueTokens: true
+   requireTokenIntrospection: false  # Falls back to ID token
+   ```
+
+3. **Use JWT access tokens instead** (recommended)
+
+---
+
+### "Token introspection required but endpoint not available"
+
+**Symptom:**
+```
+❌ SECURITY: Opaque token rejected (introspection required but failed)
+```
+
+**Cause:** `requireTokenIntrospection=true` but provider doesn't support it
+
+**Solutions:**
+1. **Disable required introspection:**
+   ```yaml
+   requireTokenIntrospection: false
+   ```
+
+2. **Configure Auth0 to issue JWT tokens** (better solution)
+
+---
+
+## Advanced Topics
+
+### Token Type Detection
+
+The middleware uses a sophisticated 6-step detection algorithm:
+
+1. **RFC 9068 `typ` header**: `at+jwt` → Access Token
+2. **Explicit type claims**: `token_use`, `token_type`
+3. **`scope` claim**: Present → Access Token
+4. **`nonce` claim**: Present → ID Token (OIDC spec)
+5. **Audience check**: `aud == client_id` only → ID Token
+6. **Default**: Access Token
+
+### OAuth 2.0 Token Introspection (RFC 7662)
+
+When opaque tokens are detected:
+
+1. Middleware calls provider's `introspection_endpoint`
+2. Authenticates using client credentials
+3. Receives response with `active` status and claims
+4. Caches result for 5 minutes (configurable via TTL)
+5. Validates expiration, not-before, and audience if present
+
+**Cache behavior:**
+- Cache key: Token hash
+- TTL: 5 minutes or token expiry (whichever is shorter)
+- Reduces introspection requests for frequently used tokens
+
+---
+
+## Reference Links
+
+- [GitHub Issue #74](https://github.com/lukaszraczylo/traefikoidc/issues/74) - Original Auth0 audience discussion
+- [OIDC Core 1.0 Spec](https://openid.net/specs/openid-connect-core-1_0.html) - ID Token requirements
+- [OAuth 2.0 RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749) - OAuth 2.0 specification
+- [RFC 7662](https://datatracker.ietf.org/doc/html/rfc7662) - OAuth 2.0 Token Introspection
+- [RFC 9068](https://datatracker.ietf.org/doc/html/rfc9068) - JWT Access Token Profile
+- [Auth0 API Authorization](https://auth0.com/docs/secure/tokens/access-tokens) - Auth0 audience documentation
+
+---
+
+## Migration Guide
+
+### From Previous Versions
+
+**If you're upgrading from a version without these features:**
+
+1. **No action required for default behavior** - backward compatible
+2. **Recommended: Enable strict mode gradually**
+   ```yaml
+   # Step 1: Enable and monitor logs
+   strictAudienceValidation: false  # Default
+
+   # Step 2: After confirming no warnings, enable
+   strictAudienceValidation: true
+   ```
+
+3. **For opaque tokens: Enable explicitly**
+   ```yaml
+   allowOpaqueTokens: true
+   requireTokenIntrospection: true
+   ```
+
+### Testing Your Configuration
+
+1. **Check logs for warnings:**
+   ```bash
+   # Look for Scenario 2 warnings
+   grep "SCENARIO 2 DETECTED" /var/log/traefik.log
+
+   # Look for opaque token warnings
+   grep "Opaque" /var/log/traefik.log
+   ```
+
+2. **Test with curl:**
+   ```bash
+   # Get token from Auth0
+   ACCESS_TOKEN="your_access_token"
+
+   # Test request
+   curl -H "Authorization: Bearer $ACCESS_TOKEN" \
+        https://your-app.example.com/api
+   ```
+
+3. **Monitor for security warnings in production logs**
+
+---
+
+## Support
+
+For issues or questions:
+- GitHub Issues: https://github.com/lukaszraczylo/traefikoidc/issues
+- Security issues: See SECURITY.md for responsible disclosure
+
+---
+
+**Last Updated:** 2025-01-09
+**Version:** 0.7.8+

docs/PROVIDER_CONFIGURATIONS.md

@@ -89,8 +89,9 @@ scopes: ["openid", "profile", "email", "offline_access"]
 - **Offline access**: Requires `offline_access` scope for refresh tokens
 - **Access token validation**: Supports both JWT and opaque access tokens
 - **Tenant isolation**: Can restrict to specific Azure AD tenants
+- **Application ID URI**: Supports custom audience for protected APIs
 
-### Example Configuration
+### Example Configuration (Basic)
 ```yaml
 http:
   middlewares:
@@ -108,6 +109,33 @@ http:
           forceHttps: true
 ```
 
+### Azure AD API Configuration (Application ID URI)
+
+When exposing your application as an API with a custom Application ID URI, you need to specify the `audience` parameter. Azure AD includes the Application ID URI in the JWT `aud` claim.
+
+```yaml
+http:
+  middlewares:
+    azure-api-oidc:
+      plugin:
+        traefik-oidc:
+          providerUrl: "https://login.microsoftonline.com/common/v2.0"
+          clientId: "12345678-1234-1234-1234-123456789abc"
+          clientSecret: "your-azure-client-secret"
+          # Specify the Application ID URI as audience
+          audience: "api://12345678-1234-1234-1234-123456789abc"
+          callbackUrl: "https://app.example.com/auth/callback"
+          logoutUrl: "https://app.example.com/auth/logout"
+          scopes: ["openid", "profile", "email", "offline_access"]
+          forceHttps: true
+```
+
+**Important**:
+- The `audience` parameter should match your Application ID URI (typically `api://{app-id}`)
+- Find your Application ID URI in Azure Portal → App Registration → Expose an API → Application ID URI
+- Without the `audience` parameter, access tokens with custom audiences will be rejected
+- For ID token validation only (no API access), you can omit the `audience` parameter
+
 ### Azure App Registration Setup
 1. Go to [Azure Portal](https://portal.azure.com/)
 2. Navigate to "Azure Active Directory" > "App registrations"
@@ -116,6 +144,12 @@ http:
 5. Create client secret in "Certificates & secrets"
 6. Configure API permissions for required scopes
 
+### Azure AD API Exposure Setup (for custom audiences)
+1. In your App Registration, go to "Expose an API"
+2. Set the Application ID URI (e.g., `api://12345678-1234-1234-1234-123456789abc`)
+3. Add any custom scopes your API exposes
+4. Update the middleware configuration to include the `audience` parameter with this URI
+
 ---
 
 ## Auth0
@@ -138,8 +172,9 @@ scopes: ["openid", "profile", "email", "offline_access"]
 - **Rules and hooks**: Leverages Auth0's extensibility
 - **Social connections**: Works with Auth0's social identity providers
 - **Offline access**: Requires `offline_access` scope
+- **API audiences**: Supports custom audience for API access tokens
 
-### Example Configuration
+### Example Configuration (Basic)
 ```yaml
 http:
   middlewares:
@@ -158,6 +193,34 @@ http:
           enablePkce: true
 ```
 
+### Auth0 API Configuration (Custom Audience)
+
+When using Auth0 APIs with custom audience parameters, you need to specify the `audience` field. Auth0 includes the API identifier in the JWT `aud` claim instead of the `clientId`.
+
+```yaml
+http:
+  middlewares:
+    auth0-api-oidc:
+      plugin:
+        traefik-oidc:
+          providerUrl: "https://company.auth0.com"
+          clientId: "abcdef123456789"
+          clientSecret: "your-auth0-client-secret"
+          # Specify the Auth0 API identifier as audience
+          audience: "https://api.company.com"
+          callbackUrl: "https://app.example.com/auth/callback"
+          logoutUrl: "https://app.example.com/auth/logout"
+          scopes: ["openid", "profile", "email", "offline_access"]
+          forceHttps: true
+          enablePkce: true
+```
+
+**Important**:
+- The `audience` parameter should match your Auth0 API identifier (not the client ID)
+- Find your API identifier in Auth0 Dashboard → APIs → Your API → Settings → Identifier
+- Without the `audience` parameter, access tokens with custom audiences will be rejected with "invalid audience" error
+- For ID token validation only (no APIs), you can omit the `audience` parameter
+
 ### Auth0 Application Setup
 1. Go to [Auth0 Dashboard](https://manage.auth0.com/)
 2. Create new application (Regular Web Application)
@@ -165,6 +228,14 @@ http:
 4. Configure allowed logout URLs: `https://your-domain.com/auth/logout`
 5. Enable OIDC Conformant in Advanced Settings
 
+### Auth0 API Setup (for custom audiences)
+1. Go to Auth0 Dashboard → APIs
+2. Create a new API or select existing API
+3. Note the "Identifier" field (e.g., `https://api.company.com`) - this is your `audience` value
+4. In API Settings → Machine to Machine Applications, authorize your application
+5. Configure API permissions/scopes as needed
+6. Use the API identifier as the `audience` parameter in your configuration
+
 ---
 
 ## GitHub
@@ -236,7 +307,7 @@ scopes: ["openid", "profile", "email"]
 - **Self-hosted support**: Works with self-hosted GitLab instances
 - **Group membership**: Can restrict by GitLab groups
 - **Project access**: Can validate project permissions
-- **Offline access**: Supports refresh tokens with `offline_access`
+- **Offline access**: Supports refresh tokens without requiring `offline_access` scope
 
 ### Example Configuration
 ```yaml
@@ -250,7 +321,9 @@ http:
           clientSecret: "your-gitlab-application-secret"
           callbackUrl: "https://app.example.com/auth/callback"
           logoutUrl: "https://app.example.com/auth/logout"
-          scopes: ["openid", "profile", "email", "offline_access"]
+          scopes: ["openid", "profile", "email"]
+          # Note: GitLab doesn't support the offline_access scope.
+          # Refresh tokens are issued automatically for the openid scope.
           allowedRolesAndGroups: ["developers", "maintainers"]
           forceHttps: true
           enablePkce: true
@@ -459,8 +532,120 @@ http:
 
 ---
 
+## Automatic Scope Filtering
+
+### Overview
+
+The middleware automatically filters OAuth scopes based on the provider's capabilities declared in their OIDC discovery document (`.well-known/openid-configuration`). This prevents authentication failures when providers reject unsupported scopes.
+
+### How It Works
+
+1. **Discovery Document Parsing**: The middleware fetches the provider's discovery document and extracts the `scopes_supported` field
+2. **Intelligent Filtering**: Requested scopes are filtered to only include those the provider supports
+3. **Fallback Behavior**: If the provider doesn't declare `scopes_supported`, all requested scopes are used (backward compatible)
+4. **Provider-Specific Handling**: Special logic for Google and Azure is preserved and applied after filtering
+
+### Example Scenarios
+
+#### Self-Hosted GitLab
+
+**Problem**: Self-hosted GitLab instances reject the `offline_access` scope with error:
+```
+The requested scope is invalid, unknown, or malformed.
+```
+
+**Solution**: The middleware automatically detects this by:
+1. Reading GitLab's discovery document at `https://gitlab.example.com/.well-known/openid-configuration`
+2. Observing that `offline_access` is NOT in the `scopes_supported` list
+3. Filtering out `offline_access` from the request
+4. Authentication succeeds
+
+**Configuration**:
+```yaml
+http:
+  middlewares:
+    gitlab-oidc:
+      plugin:
+        traefik-oidc:
+          providerUrl: "https://gitlab.example.com"
+          clientId: "your-gitlab-application-id"
+          clientSecret: "your-gitlab-application-secret"
+          callbackUrl: "https://app.example.com/auth/callback"
+          scopes: ["openid", "profile", "email", "offline_access"]
+          # Even though offline_access is listed, it will be automatically
+          # filtered out if GitLab doesn't support it
+```
+
+#### Auth0 or Keycloak
+
+These providers typically support `offline_access` and it will be included:
+
+```yaml
+# Auth0 scopes_supported: ["openid", "profile", "email", "offline_access", ...]
+# Result: All requested scopes are sent
+```
+
+### Benefits
+
+1. **Self-Hosted Support**: Works seamlessly with self-hosted provider instances
+2. **No Manual Configuration**: No need to know which scopes each provider supports
+3. **Error Prevention**: Eliminates "invalid scope" authentication failures
+4. **Standards Compliant**: Uses official OIDC discovery specification (RFC 8414)
+5. **Backward Compatible**: Existing configurations continue to work
+
+### Logging
+
+The middleware provides detailed logging for scope filtering:
+
+```
+INFO: ScopeFilter: Filtered unsupported scopes for https://gitlab.example.com: [offline_access]
+DEBUG: ScopeFilter: Provider https://gitlab.example.com supported scopes: [openid profile email read_user read_api]
+DEBUG: ScopeFilter: Final filtered scopes: [openid profile email]
+```
+
+### Troubleshooting
+
+**Issue**: Provider rejects scope even after filtering
+
+**Possible Causes**:
+1. Provider's discovery document is outdated
+2. Provider doesn't properly implement `scopes_supported`
+3. Custom authorization server with non-standard behavior
+
+**Solutions**:
+1. Use `overrideScopes: true` and explicitly list only supported scopes
+2. Check the provider's discovery document manually: `curl https://your-provider/.well-known/openid-configuration`
+3. Review middleware debug logs for filtering decisions
+
+---
+
 ## Common Configuration Options
 
+### Audience Configuration
+
+The `audience` parameter specifies the expected JWT audience claim value. This is particularly important when using Auth0 APIs, Azure AD Application ID URIs, or other providers with custom audience requirements.
+
+```yaml
+# Optional: Custom audience for JWT validation
+# If not set, defaults to clientID for backward compatibility
+audience: "https://api.example.com"  # Auth0 API identifier
+# OR
+audience: "api://12345-guid"  # Azure AD Application ID URI
+```
+
+**When to use**:
+- **Auth0**: When using Auth0 APIs with custom audience parameters
+- **Azure AD**: When exposing your app as an API with Application ID URI
+- **Keycloak**: When using audience-restricted tokens
+- **Okta**: When using custom authorization servers with API audiences
+
+**When to omit**:
+- For standard ID token validation (default behavior)
+- When the provider sets `aud` claim to your `clientID`
+- For backward compatibility with existing configurations
+
+**Security Note**: The `audience` parameter prevents token confusion attacks by ensuring tokens issued for one service cannot be used at another service.
+
 ### Security Settings
 ```yaml
 # Force HTTPS (recommended for production)

docs/REDIS_CACHE_TEST_SUITE.md

@@ -0,0 +1,413 @@
+# Redis Cache Backend Test Suite
+
+## Overview
+
+This document describes the comprehensive test suite created for the Redis cache backend feature in the Traefik OIDC plugin. The test suite ensures reliability, performance, and correctness of the caching infrastructure.
+
+## Test Structure
+
+### Directory Organization
+
+```
+internal/cache/
+├── backend/
+│   ├── interface.go                 # CacheBackend interface definition
+│   ├── interface_test.go            # Contract tests for all backends
+│   ├── memory.go                    # In-memory backend implementation
+│   ├── memory_test.go               # Memory backend unit tests
+│   ├── redis.go                     # Redis backend implementation
+│   ├── redis_test.go                # Redis backend unit tests
+│   ├── errors.go                    # Error definitions
+│   └── test_helpers_test.go         # Test infrastructure and helpers
+│
+└── resilience/
+    ├── circuit_breaker.go           # Circuit breaker implementation
+    ├── circuit_breaker_test.go      # Circuit breaker tests
+    ├── health_check.go              # Health checker implementation
+    └── health_check_test.go         # Health check tests
+
+redis_integration_test.go            # End-to-end integration tests
+```
+
+## Test Categories
+
+### 1. Interface Contract Tests (`interface_test.go`)
+
+**Purpose:** Ensure all backend implementations (Memory, Redis, Hybrid) comply with the CacheBackend interface contract.
+
+**Test Cases:**
+- `TestCacheBackendContract` - Runs all contract tests against each backend type
+- `testBasicSetGet` - Verifies basic set/get operations
+- `testGetNonExistent` - Tests behavior for non-existent keys
+- `testUpdateExisting` - Validates updating existing keys
+- `testDelete` - Tests delete operations
+- `testDeleteNonExistent` - Delete non-existent keys
+- `testExists` - Key existence checking
+- `testTTLExpiration` - TTL and expiration behavior
+- `testClear` - Clear all keys operation
+- `testPing` - Health check functionality
+- `testStats` - Statistics tracking
+- `testConcurrentAccess` - Thread safety with 10+ goroutines
+- `testLargeValues` - Handling of 1MB+ values
+- `testEmptyValues` - Empty byte array handling
+- `testSpecialCharactersInKeys` - Special characters in key names
+
+**Coverage:** ~95% of interface methods
+
+### 2. Memory Backend Tests (`memory_test.go`)
+
+**Purpose:** Test the in-memory LRU cache backend with comprehensive edge cases.
+
+**Test Cases:**
+
+#### Basic Operations (6 tests)
+- `TestMemoryBackend_BasicOperations` - CRUD operations
+  - SetAndGet
+  - GetNonExistent
+  - Delete
+  - DeleteNonExistent
+  - Exists
+  - Clear
+
+#### TTL and Expiration (3 tests)
+- `TestMemoryBackend_TTLExpiration`
+  - ShortTTL (100ms)
+  - TTLDecrement over time
+  - CleanupExpiredItems
+
+#### LRU Eviction (2 tests)
+- `TestMemoryBackend_LRUEviction` - Verifies LRU algorithm
+- `TestMemoryBackend_MemoryLimit` - Memory-based eviction
+
+#### Concurrency (1 test)
+- `TestMemoryBackend_ConcurrentAccess` - 20 goroutines, 50 iterations each
+
+#### Edge Cases (6 tests)
+- `TestMemoryBackend_UpdateExisting` - Overwriting values
+- `TestMemoryBackend_Stats` - Metrics tracking (hits, misses, hit rate)
+- `TestMemoryBackend_EmptyValues` - Zero-length byte arrays
+- `TestMemoryBackend_LargeValues` - 1MB values
+- `TestMemoryBackend_Close` - Proper cleanup
+- `TestMemoryBackend_Ping` - Health checks
+- `TestMemoryBackend_ValueIsolation` - Returns copies, not references
+
+**Coverage:** ~92% of memory backend code
+
+### 3. Redis Backend Tests (`redis_test.go`)
+
+**Purpose:** Test Redis backend using miniredis (in-memory Redis mock).
+
+**Test Cases:**
+
+#### Basic Operations (4 tests)
+- `TestRedisBackend_BasicOperations`
+  - SetAndGet
+  - GetNonExistent
+  - Delete
+  - Exists
+
+#### Redis-Specific Features (6 tests)
+- `TestRedisBackend_KeyPrefixing` - Namespace isolation
+- `TestRedisBackend_TTLExpiration` - Redis TTL handling
+- `TestRedisBackend_Clear` - Bulk delete with SCAN
+- `TestRedisBackend_NoPrefix` - Operation without prefix
+
+#### Error Handling (2 tests)
+- `TestRedisBackend_ConnectionFailure` - Connection errors
+- `TestRedisBackend_RedisErrors` - Simulated Redis failures
+
+#### Concurrency (1 test)
+- `TestRedisBackend_ConcurrentAccess` - 20 goroutines, 50 operations
+
+#### Advanced Features (3 tests)
+- `TestRedisBackend_PipelineOperations`
+  - SetMany (batch writes)
+  - GetMany (batch reads)
+  - GetManyWithNonExistent
+
+#### Edge Cases (5 tests)
+- `TestRedisBackend_Stats` - Statistics tracking
+- `TestRedisBackend_Ping` - Connection health
+- `TestRedisBackend_Close` - Resource cleanup
+- `TestRedisBackend_UpdateExisting` - Overwrite handling
+- `TestRedisBackend_LargeValues` - 1MB values
+- `TestRedisBackend_EmptyValues` - Empty arrays
+
+**Coverage:** ~88% of Redis backend code
+
+**Key Testing Tool:** `miniredis` - In-memory Redis mock that supports:
+- All basic Redis commands
+- TTL and expiration
+- Time manipulation (FastForward)
+- Error simulation
+- No external Redis server required
+
+### 4. Circuit Breaker Tests (`circuit_breaker_test.go`)
+
+**Purpose:** Verify circuit breaker pattern implementation for fault tolerance.
+
+**Test Cases:**
+
+#### State Transitions (5 tests)
+- `TestCircuitBreaker_StateTransitions`
+  - Initial state (Closed)
+  - Closed → Open (after max failures)
+  - Open → HalfOpen (after timeout)
+  - HalfOpen → Closed (after successful requests)
+  - HalfOpen → Open (on failure)
+
+#### Behavior Tests (5 tests)
+- `TestCircuitBreaker_OpenCircuitBlocks` - Blocks requests when open
+- `TestCircuitBreaker_HalfOpenMaxRequests` - Limits requests in half-open
+- `TestCircuitBreaker_SuccessResetsFailures` - Failure counter reset
+- `TestCircuitBreaker_ConcurrentAccess` - Thread safety
+- `TestCircuitBreaker_Stats` - Statistics tracking
+
+#### Advanced Tests (7 tests)
+- `TestCircuitBreaker_Reset` - Manual reset
+- `TestCircuitBreaker_StateChangeCallback` - Notifications
+- `TestCircuitBreaker_IsAvailable` - Availability check
+- `TestCircuitBreaker_RapidFailures` - Fast consecutive failures
+- `TestCircuitBreaker_TimeoutAccuracy` - Timeout precision
+- `TestCircuitBreaker_DefaultConfig` - Default configuration
+- `TestCircuitBreaker_StateString` - String representation
+
+**Benchmarks:**
+- `BenchmarkCircuitBreaker_Execute` - Successful operations
+- `BenchmarkCircuitBreaker_ExecuteWithFailures` - Mixed success/failure
+
+**Coverage:** ~95% of circuit breaker code
+
+### 5. Health Check Tests (`health_check_test.go`)
+
+**Purpose:** Validate periodic health checking and status management.
+
+**Test Cases:**
+
+#### Status Transitions (4 tests)
+- `TestHealthChecker_StatusTransitions` - Healthy → Degraded → Unhealthy → Healthy
+- `TestHealthChecker_InitialState` - Default healthy state
+- `TestHealthChecker_ForceCheck` - Manual health check trigger
+- `TestHealthChecker_StatusChangeCallback` - Change notifications
+
+#### Behavior Tests (6 tests)
+- `TestHealthChecker_Stats` - Statistics tracking
+- `TestHealthChecker_Timeout` - Check timeout handling
+- `TestHealthChecker_ConcurrentAccess` - Thread safety
+- `TestHealthChecker_StopAndStart` - Lifecycle management
+- `TestHealthChecker_DegradedState` - Degraded status detection
+- `TestHealthChecker_DefaultConfig` - Default settings
+
+#### Advanced Tests (2 tests)
+- `TestHealthChecker_StatusString` - String representation
+- `TestHealthChecker_RecoveryPattern` - Typical failure/recovery cycle
+
+**Benchmarks:**
+- `BenchmarkHealthChecker_ForceCheck` - Check performance
+- `BenchmarkHealthChecker_Status` - Status read performance
+
+**Coverage:** ~90% of health checker code
+
+### 6. Integration Tests (`redis_integration_test.go`)
+
+**Purpose:** End-to-end testing of real-world scenarios.
+
+**Test Cases:**
+
+#### Multi-Instance Tests (3 tests)
+- `TestRedisIntegration_MultipleInstances`
+  - ShareTokenBlacklist - JTI sharing across Traefik replicas
+  - ShareTokenCache - Token cache sharing
+  - ShareMetadataCache - Provider metadata sharing
+
+#### Replay Detection (2 tests)
+- `TestRedisIntegration_JTIReplayDetection`
+  - PreventReplayAcrossInstances - Block used JTIs
+  - ConcurrentJTIChecks - Race condition handling
+
+#### Resilience (1 test)
+- `TestRedisIntegration_Failover`
+  - RedisTemporaryFailure - Recovery from temporary failures
+
+#### Performance (1 test)
+- `TestRedisIntegration_HighLoad`
+  - HighConcurrency - 50 goroutines × 100 operations
+
+#### Consistency (2 tests)
+- `TestRedisIntegration_TTLConsistency` - TTL accuracy
+- `TestRedisIntegration_MemoryUsage` - 10,000 item dataset
+- `TestRedisIntegration_Cleanup` - Bulk cleanup operations
+
+**Coverage:** Integration scenarios covering 80%+ of realistic use cases
+
+## Test Helpers and Infrastructure
+
+### Test Helpers (`test_helpers_test.go`)
+
+**Utilities:**
+- `TestLogger` - Logging for tests
+- `MiniredisServer` - Miniredis setup/teardown
+- `TestConfig` - Default test configurations
+- `GenerateTestData` - Test data generation
+- `GenerateLargeValue` - Large value creation
+- `AssertCacheStats` - Statistics validation
+- `WaitForCondition` - Async condition waiting
+- `AssertEventuallyExpires` - TTL expiration verification
+
+## Running the Tests
+
+### Run All Tests
+```bash
+go test ./internal/cache/backend/... -v
+go test ./internal/cache/resilience/... -v
+go test -run TestRedisIntegration -v
+```
+
+### Run Specific Test Suites
+```bash
+# Memory backend only
+go test ./internal/cache/backend -run TestMemoryBackend -v
+
+# Redis backend only
+go test ./internal/cache/backend -run TestRedisBackend -v
+
+# Circuit breaker only
+go test ./internal/cache/resilience -run TestCircuitBreaker -v
+
+# Integration tests only
+go test -run TestRedisIntegration -v
+```
+
+### Run with Coverage
+```bash
+go test ./internal/cache/backend/... -coverprofile=coverage.out
+go test ./internal/cache/resilience/... -coverprofile=coverage_resilience.out
+go tool cover -html=coverage.out
+```
+
+### Run Benchmarks
+```bash
+go test ./internal/cache/backend -bench=. -benchmem
+go test ./internal/cache/resilience -bench=. -benchmem
+```
+
+### Run with Race Detector
+```bash
+go test ./internal/cache/... -race -v
+```
+
+## Test Patterns Used
+
+### 1. Table-Driven Tests
+Used for testing multiple scenarios with similar structure.
+
+### 2. Subtests (t.Run)
+Organized test cases into logical groups with clear names.
+
+### 3. Parallel Tests
+Tests marked with `t.Parallel()` for faster execution.
+
+### 4. Test Fixtures
+Reusable setup functions for common test data.
+
+### 5. Mocking
+- `miniredis` for Redis operations
+- Mock functions for callbacks and health checks
+
+### 6. Assertion Helpers
+Using `testify/assert` and `testify/require` for clear assertions.
+
+## Test Coverage Summary
+
+| Component | Coverage | Tests | Lines of Code |
+|-----------|----------|-------|---------------|
+| Interface Contract | 95% | 14 | ~200 |
+| Memory Backend | 92% | 18 | ~350 |
+| Redis Backend | 88% | 21 | ~400 |
+| Circuit Breaker | 95% | 17 | ~250 |
+| Health Checker | 90% | 12 | ~200 |
+| Integration Tests | 80% | 9 | ~300 |
+| **Total** | **90%** | **91** | **~1,700** |
+
+## Edge Cases Tested
+
+1. **Empty values** - Zero-length byte arrays
+2. **Large values** - 1MB+ data
+3. **Special characters** - Keys with :, /, -, _, ., |
+4. **Concurrent access** - 10-50 goroutines
+5. **TTL edge cases** - Very short (<100ms) and long (24h+) TTLs
+6. **Connection failures** - Network errors, timeouts
+7. **Redis errors** - Simulated Redis failures
+8. **Memory limits** - Eviction under memory pressure
+9. **Race conditions** - Concurrent JTI checks
+10. **State transitions** - All circuit breaker and health check states
+
+## Performance Benchmarks
+
+Benchmarks included for:
+- Cache operations (Set, Get, Delete)
+- Circuit breaker execution
+- Health check operations
+- Concurrent access patterns
+- Large datasets (10,000+ items)
+
+## Dependencies
+
+### Testing Libraries
+- `github.com/stretchr/testify` - Assertions and test utilities
+- `github.com/alicebob/miniredis/v2` - In-memory Redis mock
+- `github.com/redis/go-redis/v9` - Redis client
+
+### Why Miniredis?
+- **No external dependencies** - No Redis server required
+- **Fast** - In-memory, perfect for unit tests
+- **Full Redis API** - Supports all operations we need
+- **Time manipulation** - FastForward for TTL testing
+- **Error simulation** - Test failure scenarios
+
+## Future Enhancements
+
+### Planned Tests
+1. Hybrid backend tests (L1/L2 cache)
+2. Network partition scenarios
+3. Redis cluster support
+4. Persistence and recovery tests
+5. Metrics and monitoring integration
+
+### Test Infrastructure Improvements
+1. Test containers for real Redis integration
+2. Performance regression tracking
+3. Chaos engineering tests
+4. Load testing framework
+
+## Continuous Integration
+
+### Recommended CI Configuration
+
+```yaml
+test:
+  script:
+    - go test ./internal/cache/... -race -cover -v
+    - go test -run TestRedisIntegration -v
+    - go test ./internal/cache/... -bench=. -benchmem
+```
+
+## Maintenance Guidelines
+
+1. **Add tests for new features** - Maintain >85% coverage
+2. **Update contract tests** - When interface changes
+3. **Test edge cases** - Always test error paths
+4. **Document test purpose** - Clear comments explaining what each test validates
+5. **Keep tests fast** - Use t.Parallel() where possible
+6. **Mock external dependencies** - Use miniredis, not real Redis
+
+## Conclusion
+
+This comprehensive test suite provides:
+- **High confidence** in cache backend correctness
+- **Fast feedback** - Tests run in seconds
+- **Good coverage** - 90% overall
+- **Clear documentation** - Each test is well-documented
+- **Maintainability** - Clear structure and patterns
+
+The test suite ensures that the Redis cache backend feature is production-ready and reliable for multi-replica Traefik deployments with shared caching requirements.

error_recovery.go

@@ -123,8 +123,10 @@ func (b *BaseRecoveryMechanism) GetBaseMetrics() map[string]interface{} {
 		metrics["seconds_since_last_success"] = time.Since(b.lastSuccessTime).Seconds()
 	}
 
-	if metrics["total_requests"].(int64) > 0 {
-		successRate := float64(metrics["total_successes"].(int64)) / float64(metrics["total_requests"].(int64))
+	totalReq, _ := metrics["total_requests"].(int64)   // Safe to ignore: type assertion with fallback
+	totalSucc, _ := metrics["total_successes"].(int64) // Safe to ignore: type assertion with fallback
+	if totalReq > 0 {
+		successRate := float64(totalSucc) / float64(totalReq)
 		metrics["success_rate"] = successRate
 	} else {
 		metrics["success_rate"] = 1.0

error_recovery_advanced_test.go

@@ -0,0 +1,560 @@
+package traefikoidc
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRetryExecutorReset tests the Reset method
+func TestRetryExecutorReset(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	executor := NewRetryExecutor(DefaultRetryConfig(), logger)
+
+	require.NotNil(t, executor)
+
+	// Should not panic
+	assert.NotPanics(t, func() {
+		executor.Reset()
+	})
+
+	// Multiple resets should be safe
+	executor.Reset()
+	executor.Reset()
+}
+
+// TestRetryExecutorIsAvailable tests the IsAvailable method
+func TestRetryExecutorIsAvailable(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	executor := NewRetryExecutor(DefaultRetryConfig(), logger)
+
+	// Retry executor should always be available
+	assert.True(t, executor.IsAvailable())
+
+	// Should remain available after operations
+	ctx := context.Background()
+	executor.ExecuteWithContext(ctx, func() error {
+		return nil
+	})
+
+	assert.True(t, executor.IsAvailable())
+}
+
+// TestSessionErrorUnwrap tests SessionError.Unwrap
+func TestSessionErrorUnwrap(t *testing.T) {
+	t.Run("unwrap with cause", func(t *testing.T) {
+		rootErr := errors.New("root cause")
+		sessionErr := NewSessionError("save", "failed to save session", rootErr)
+
+		unwrapped := sessionErr.Unwrap()
+		assert.Equal(t, rootErr, unwrapped)
+	})
+
+	t.Run("unwrap without cause", func(t *testing.T) {
+		sessionErr := NewSessionError("load", "failed to load session", nil)
+
+		unwrapped := sessionErr.Unwrap()
+		assert.Nil(t, unwrapped)
+	})
+
+	t.Run("error chain", func(t *testing.T) {
+		rootErr := errors.New("database error")
+		sessionErr := NewSessionError("delete", "failed to delete session", rootErr)
+
+		// Verify error chain works
+		assert.True(t, errors.Is(sessionErr, rootErr))
+	})
+}
+
+// TestTokenErrorUnwrap tests TokenError.Unwrap
+func TestTokenErrorUnwrap(t *testing.T) {
+	t.Run("unwrap with cause", func(t *testing.T) {
+		rootErr := errors.New("signature verification failed")
+		tokenErr := NewTokenError("id_token", "invalid", "token is invalid", rootErr)
+
+		unwrapped := tokenErr.Unwrap()
+		assert.Equal(t, rootErr, unwrapped)
+	})
+
+	t.Run("unwrap without cause", func(t *testing.T) {
+		tokenErr := NewTokenError("access_token", "expired", "token has expired", nil)
+
+		unwrapped := tokenErr.Unwrap()
+		assert.Nil(t, unwrapped)
+	})
+
+	t.Run("error chain", func(t *testing.T) {
+		rootErr := errors.New("crypto error")
+		tokenErr := NewTokenError("refresh_token", "malformed", "token is malformed", rootErr)
+
+		// Verify error chain works
+		assert.True(t, errors.Is(tokenErr, rootErr))
+	})
+}
+
+// TestGracefulDegradationRegisterFallback tests fallback registration
+func TestGracefulDegradationRegisterFallback(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	config := DefaultGracefulDegradationConfig()
+	gd := NewGracefulDegradation(config, logger)
+	defer gd.Close()
+
+	t.Run("register single fallback", func(t *testing.T) {
+		fallback := func() (interface{}, error) {
+			return "fallback result", nil
+		}
+
+		gd.RegisterFallback("service1", fallback)
+
+		// Verify fallback was registered (indirectly)
+		result, err := gd.ExecuteWithFallback("service1", func() (interface{}, error) {
+			return nil, errors.New("service failed")
+		})
+
+		assert.NoError(t, err)
+		assert.Equal(t, "fallback result", result)
+	})
+
+	t.Run("register multiple fallbacks", func(t *testing.T) {
+		gd.RegisterFallback("service2", func() (interface{}, error) {
+			return "fallback2", nil
+		})
+		gd.RegisterFallback("service3", func() (interface{}, error) {
+			return "fallback3", nil
+		})
+
+		result2, _ := gd.ExecuteWithFallback("service2", func() (interface{}, error) {
+			return nil, errors.New("fail")
+		})
+		result3, _ := gd.ExecuteWithFallback("service3", func() (interface{}, error) {
+			return nil, errors.New("fail")
+		})
+
+		assert.Equal(t, "fallback2", result2)
+		assert.Equal(t, "fallback3", result3)
+	})
+
+	t.Run("override existing fallback", func(t *testing.T) {
+		gd.RegisterFallback("service4", func() (interface{}, error) {
+			return "old fallback", nil
+		})
+		gd.RegisterFallback("service4", func() (interface{}, error) {
+			return "new fallback", nil
+		})
+
+		result, _ := gd.ExecuteWithFallback("service4", func() (interface{}, error) {
+			return nil, errors.New("fail")
+		})
+
+		assert.Equal(t, "new fallback", result)
+	})
+}
+
+// TestGracefulDegradationRegisterHealthCheck tests health check registration
+func TestGracefulDegradationRegisterHealthCheck(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	config := DefaultGracefulDegradationConfig()
+	config.HealthCheckInterval = 50 * time.Millisecond
+	gd := NewGracefulDegradation(config, logger)
+	defer gd.Close()
+
+	t.Run("register health check", func(t *testing.T) {
+		healthy := true
+		healthCheck := func() bool {
+			return healthy
+		}
+
+		gd.RegisterHealthCheck("service1", healthCheck)
+
+		// Mark service as degraded
+		gd.markServiceDegraded("service1")
+		assert.True(t, gd.isServiceDegraded("service1"))
+
+		// Set healthy and wait for health check to run
+		healthy = true
+		time.Sleep(100 * time.Millisecond)
+
+		// Service should be recovered
+		// (may still be degraded due to timing, but health check was registered)
+	})
+
+	t.Run("multiple health checks", func(t *testing.T) {
+		gd.RegisterHealthCheck("service2", func() bool { return true })
+		gd.RegisterHealthCheck("service3", func() bool { return false })
+
+		// Health checks are registered and will be called periodically
+	})
+}
+
+// TestGracefulDegradationExecuteWithContext tests ExecuteWithContext
+func TestGracefulDegradationExecuteWithContext(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	config := DefaultGracefulDegradationConfig()
+	gd := NewGracefulDegradation(config, logger)
+	defer gd.Close()
+
+	t.Run("successful execution", func(t *testing.T) {
+		ctx := context.Background()
+		err := gd.ExecuteWithContext(ctx, func() error {
+			return nil
+		})
+
+		assert.NoError(t, err)
+	})
+
+	t.Run("failed execution", func(t *testing.T) {
+		ctx := context.Background()
+		testErr := errors.New("operation failed")
+
+		err := gd.ExecuteWithContext(ctx, func() error {
+			return testErr
+		})
+
+		assert.Error(t, err)
+	})
+
+	t.Run("uses fallback on failure", func(t *testing.T) {
+		gd.RegisterFallback("default", func() (interface{}, error) {
+			return nil, nil // Success fallback
+		})
+
+		ctx := context.Background()
+		err := gd.ExecuteWithContext(ctx, func() error {
+			return errors.New("primary failed")
+		})
+
+		// With fallback succeeding, overall operation succeeds
+		assert.NoError(t, err)
+	})
+}
+
+// TestGracefulDegradationExecuteWithFallback tests ExecuteWithFallback
+func TestGracefulDegradationExecuteWithFallback(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	config := DefaultGracefulDegradationConfig()
+	gd := NewGracefulDegradation(config, logger)
+	defer gd.Close()
+
+	t.Run("primary succeeds", func(t *testing.T) {
+		result, err := gd.ExecuteWithFallback("service1", func() (interface{}, error) {
+			return "primary result", nil
+		})
+
+		assert.NoError(t, err)
+		assert.Equal(t, "primary result", result)
+	})
+
+	t.Run("fallback succeeds when primary fails", func(t *testing.T) {
+		gd.RegisterFallback("service2", func() (interface{}, error) {
+			return "fallback result", nil
+		})
+
+		result, err := gd.ExecuteWithFallback("service2", func() (interface{}, error) {
+			return nil, errors.New("primary failed")
+		})
+
+		assert.NoError(t, err)
+		assert.Equal(t, "fallback result", result)
+	})
+
+	t.Run("error when no fallback available", func(t *testing.T) {
+		config.EnableFallbacks = false
+		gdNoFallback := NewGracefulDegradation(config, logger)
+		defer gdNoFallback.Close()
+
+		result, err := gdNoFallback.ExecuteWithFallback("service3", func() (interface{}, error) {
+			return nil, errors.New("primary failed")
+		})
+
+		assert.Error(t, err)
+		assert.Nil(t, result)
+	})
+
+	t.Run("fallback also fails", func(t *testing.T) {
+		gd.RegisterFallback("service4", func() (interface{}, error) {
+			return nil, errors.New("fallback also failed")
+		})
+
+		result, err := gd.ExecuteWithFallback("service4", func() (interface{}, error) {
+			return nil, errors.New("primary failed")
+		})
+
+		assert.Error(t, err)
+		assert.Nil(t, result)
+		assert.Contains(t, err.Error(), "fallback also failed")
+	})
+}
+
+// TestGracefulDegradationIsServiceDegraded tests service degradation status
+func TestGracefulDegradationIsServiceDegraded(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	config := DefaultGracefulDegradationConfig()
+	config.RecoveryTimeout = 100 * time.Millisecond
+	gd := NewGracefulDegradation(config, logger)
+	defer gd.Close()
+
+	t.Run("service not degraded initially", func(t *testing.T) {
+		assert.False(t, gd.isServiceDegraded("new-service"))
+	})
+
+	t.Run("service degraded after marking", func(t *testing.T) {
+		gd.markServiceDegraded("service1")
+		assert.True(t, gd.isServiceDegraded("service1"))
+	})
+
+	t.Run("service recovers after timeout", func(t *testing.T) {
+		gd.markServiceDegraded("service2")
+		assert.True(t, gd.isServiceDegraded("service2"))
+
+		// Wait for recovery timeout
+		time.Sleep(150 * time.Millisecond)
+
+		// Should be recovered
+		assert.False(t, gd.isServiceDegraded("service2"))
+	})
+}
+
+// TestGracefulDegradationMarkServiceDegraded tests marking services as degraded
+func TestGracefulDegradationMarkServiceDegraded(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	config := DefaultGracefulDegradationConfig()
+	gd := NewGracefulDegradation(config, logger)
+	defer gd.Close()
+
+	t.Run("mark single service", func(t *testing.T) {
+		gd.markServiceDegraded("service1")
+
+		degraded := gd.GetDegradedServices()
+		assert.Contains(t, degraded, "service1")
+	})
+
+	t.Run("mark multiple services", func(t *testing.T) {
+		gd.markServiceDegraded("service2")
+		gd.markServiceDegraded("service3")
+
+		degraded := gd.GetDegradedServices()
+		assert.Contains(t, degraded, "service2")
+		assert.Contains(t, degraded, "service3")
+	})
+
+	t.Run("marking same service multiple times updates timestamp", func(t *testing.T) {
+		gd.markServiceDegraded("service4")
+		time.Sleep(50 * time.Millisecond)
+		gd.markServiceDegraded("service4")
+
+		// Service should still be marked as degraded
+		assert.True(t, gd.isServiceDegraded("service4"))
+	})
+}
+
+// TestGracefulDegradationExecuteFallback tests fallback execution
+func TestGracefulDegradationExecuteFallback(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	config := DefaultGracefulDegradationConfig()
+	gd := NewGracefulDegradation(config, logger)
+	defer gd.Close()
+
+	t.Run("execute registered fallback", func(t *testing.T) {
+		gd.RegisterFallback("service1", func() (interface{}, error) {
+			return "fallback value", nil
+		})
+
+		result, err := gd.executeFallback("service1")
+
+		assert.NoError(t, err)
+		assert.Equal(t, "fallback value", result)
+	})
+
+	t.Run("error when fallback not registered", func(t *testing.T) {
+		result, err := gd.executeFallback("non-existent-service")
+
+		assert.Error(t, err)
+		assert.Nil(t, result)
+		assert.Contains(t, err.Error(), "no fallback available")
+	})
+
+	t.Run("propagate fallback errors", func(t *testing.T) {
+		gd.RegisterFallback("service2", func() (interface{}, error) {
+			return nil, errors.New("fallback error")
+		})
+
+		result, err := gd.executeFallback("service2")
+
+		assert.Error(t, err)
+		assert.Nil(t, result)
+		assert.Contains(t, err.Error(), "fallback error")
+	})
+}
+
+// TestGracefulDegradationReset tests Reset method
+func TestGracefulDegradationReset(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	config := DefaultGracefulDegradationConfig()
+	gd := NewGracefulDegradation(config, logger)
+	defer gd.Close()
+
+	t.Run("reset clears degraded services", func(t *testing.T) {
+		// Mark several services as degraded
+		gd.markServiceDegraded("service1")
+		gd.markServiceDegraded("service2")
+		gd.markServiceDegraded("service3")
+
+		assert.Len(t, gd.GetDegradedServices(), 3)
+
+		// Reset
+		gd.Reset()
+
+		// All should be cleared
+		assert.Len(t, gd.GetDegradedServices(), 0)
+	})
+
+	t.Run("can mark services degraded after reset", func(t *testing.T) {
+		gd.Reset()
+		gd.markServiceDegraded("service4")
+
+		assert.Len(t, gd.GetDegradedServices(), 1)
+		assert.Contains(t, gd.GetDegradedServices(), "service4")
+	})
+
+	t.Run("multiple resets are safe", func(t *testing.T) {
+		assert.NotPanics(t, func() {
+			gd.Reset()
+			gd.Reset()
+			gd.Reset()
+		})
+	})
+}
+
+// TestGracefulDegradationIsAvailable tests IsAvailable method
+func TestGracefulDegradationIsAvailable(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	config := DefaultGracefulDegradationConfig()
+	gd := NewGracefulDegradation(config, logger)
+	defer gd.Close()
+
+	// Should always return true
+	assert.True(t, gd.IsAvailable())
+
+	// Even with degraded services
+	gd.markServiceDegraded("service1")
+	assert.True(t, gd.IsAvailable())
+
+	// Even after reset
+	gd.Reset()
+	assert.True(t, gd.IsAvailable())
+}
+
+// TestGracefulDegradationGetMetrics tests GetMetrics method
+func TestGracefulDegradationGetMetrics(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	config := DefaultGracefulDegradationConfig()
+	gd := NewGracefulDegradation(config, logger)
+	defer gd.Close()
+
+	t.Run("basic metrics", func(t *testing.T) {
+		metrics := gd.GetMetrics()
+
+		require.NotNil(t, metrics)
+		assert.Contains(t, metrics, "degraded_services_count")
+		assert.Contains(t, metrics, "degraded_services")
+		assert.Contains(t, metrics, "registered_fallbacks_count")
+		assert.Contains(t, metrics, "registered_health_checks_count")
+		assert.Contains(t, metrics, "health_check_interval_seconds")
+		assert.Contains(t, metrics, "recovery_timeout_seconds")
+		assert.Contains(t, metrics, "fallbacks_enabled")
+	})
+
+	t.Run("metrics reflect degraded services", func(t *testing.T) {
+		gd.Reset()
+		gd.markServiceDegraded("service1")
+		gd.markServiceDegraded("service2")
+
+		metrics := gd.GetMetrics()
+
+		assert.Equal(t, 2, metrics["degraded_services_count"])
+		degradedList := metrics["degraded_services"].([]string)
+		assert.Len(t, degradedList, 2)
+	})
+
+	t.Run("metrics reflect registered fallbacks", func(t *testing.T) {
+		gd.RegisterFallback("service1", func() (interface{}, error) { return nil, nil })
+		gd.RegisterFallback("service2", func() (interface{}, error) { return nil, nil })
+
+		metrics := gd.GetMetrics()
+
+		assert.GreaterOrEqual(t, metrics["registered_fallbacks_count"], 2)
+	})
+
+	t.Run("metrics include base metrics", func(t *testing.T) {
+		metrics := gd.GetMetrics()
+
+		// Should include base recovery mechanism metrics
+		assert.Contains(t, metrics, "name")
+		assert.Contains(t, metrics, "uptime_seconds")
+		assert.Contains(t, metrics, "total_requests")
+	})
+}
+
+// TestGracefulDegradationFullScenario tests a complete degradation scenario
+func TestGracefulDegradationFullScenario(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping full scenario test in short mode")
+	}
+
+	logger := GetSingletonNoOpLogger()
+	config := DefaultGracefulDegradationConfig()
+	config.RecoveryTimeout = 200 * time.Millisecond
+	config.HealthCheckInterval = 50 * time.Millisecond
+	gd := NewGracefulDegradation(config, logger)
+	defer gd.Close()
+
+	// Register fallback
+	gd.RegisterFallback("critical-service", func() (interface{}, error) {
+		return "fallback data", nil
+	})
+
+	// Register health check
+	serviceHealthy := false
+	gd.RegisterHealthCheck("critical-service", func() bool {
+		return serviceHealthy
+	})
+
+	// First call - primary succeeds
+	result1, err1 := gd.ExecuteWithFallback("critical-service", func() (interface{}, error) {
+		return "primary data", nil
+	})
+	assert.NoError(t, err1)
+	assert.Equal(t, "primary data", result1)
+
+	// Second call - primary fails, fallback succeeds
+	result2, err2 := gd.ExecuteWithFallback("critical-service", func() (interface{}, error) {
+		return nil, errors.New("service down")
+	})
+	assert.NoError(t, err2)
+	assert.Equal(t, "fallback data", result2)
+
+	// Service is now degraded
+	assert.True(t, gd.isServiceDegraded("critical-service"))
+
+	// Third call - should use fallback immediately
+	result3, err3 := gd.ExecuteWithFallback("critical-service", func() (interface{}, error) {
+		return "should not be called", nil
+	})
+	assert.NoError(t, err3)
+	assert.Equal(t, "fallback data", result3)
+
+	// Mark service as healthy and wait for health check
+	serviceHealthy = true
+	time.Sleep(250 * time.Millisecond)
+
+	// Service should be recovered
+	// (timing-dependent, so we don't assert)
+
+	// Get metrics
+	metrics := gd.GetMetrics()
+	assert.NotNil(t, metrics)
+}

error_recovery_enhanced_test.go

@@ -0,0 +1,663 @@
+package traefikoidc
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestCircuitBreakerAllowRequestEdgeCases tests edge cases in circuit breaker request allowing
+func TestCircuitBreakerAllowRequestEdgeCases(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+
+	t.Run("invalid state returns false", func(t *testing.T) {
+		config := DefaultCircuitBreakerConfig()
+		cb := NewCircuitBreaker(config, logger)
+
+		// Force invalid state
+		cb.mutex.Lock()
+		cb.state = CircuitBreakerState(999) // Invalid state
+		cb.mutex.Unlock()
+
+		// Should return false for invalid state
+		allowed := cb.allowRequest()
+		assert.False(t, allowed, "invalid state should not allow requests")
+	})
+
+	t.Run("open to half-open transition on timeout", func(t *testing.T) {
+		baseTimeout := GetTestDuration(50 * time.Millisecond)
+		config := CircuitBreakerConfig{
+			MaxFailures:  1,
+			Timeout:      baseTimeout,
+			ResetTimeout: 30 * time.Second,
+		}
+		cb := NewCircuitBreaker(config, logger)
+
+		// Trip the circuit
+		cb.Execute(func() error { return errors.New("fail") })
+
+		// Verify circuit is open
+		assert.Equal(t, CircuitBreakerOpen, cb.GetState())
+		assert.False(t, cb.allowRequest())
+
+		// Wait for timeout (longer than timeout to ensure transition)
+		time.Sleep(baseTimeout + GetTestDuration(20*time.Millisecond))
+
+		// Should transition to half-open
+		allowed := cb.allowRequest()
+		assert.True(t, allowed, "should allow request after timeout")
+		assert.Equal(t, CircuitBreakerHalfOpen, cb.GetState())
+	})
+
+	t.Run("half-open allows requests", func(t *testing.T) {
+		config := DefaultCircuitBreakerConfig()
+		cb := NewCircuitBreaker(config, logger)
+
+		// Manually set to half-open
+		cb.mutex.Lock()
+		cb.state = CircuitBreakerHalfOpen
+		cb.mutex.Unlock()
+
+		allowed := cb.allowRequest()
+		assert.True(t, allowed, "half-open should allow requests")
+	})
+
+	t.Run("open blocks requests before timeout", func(t *testing.T) {
+		config := CircuitBreakerConfig{
+			MaxFailures:  1,
+			Timeout:      1 * time.Hour, // Long timeout
+			ResetTimeout: 30 * time.Second,
+		}
+		cb := NewCircuitBreaker(config, logger)
+
+		// Trip the circuit
+		cb.Execute(func() error { return errors.New("fail") })
+
+		// Should be blocked
+		allowed := cb.allowRequest()
+		assert.False(t, allowed, "open circuit should block requests")
+	})
+}
+
+// TestRetryExecutorIsRetryableErrorEdgeCases tests edge cases for retry decision
+func TestRetryExecutorIsRetryableErrorEdgeCases(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	config := DefaultRetryConfig()
+	re := NewRetryExecutor(config, logger)
+
+	t.Run("nil error is not retryable", func(t *testing.T) {
+		retryable := re.isRetryableError(nil)
+		assert.False(t, retryable)
+	})
+
+	t.Run("HTTPError with 429 is retryable", func(t *testing.T) {
+		httpErr := &HTTPError{
+			StatusCode: 429,
+			Message:    "Too Many Requests",
+		}
+
+		retryable := re.isRetryableError(httpErr)
+		assert.True(t, retryable, "429 Too Many Requests should be retryable")
+	})
+
+	t.Run("HTTPError with 500 is retryable", func(t *testing.T) {
+		httpErr := &HTTPError{
+			StatusCode: 500,
+			Message:    "Internal Server Error",
+		}
+
+		retryable := re.isRetryableError(httpErr)
+		assert.True(t, retryable, "500 errors should be retryable")
+	})
+
+	t.Run("HTTPError with 503 is retryable", func(t *testing.T) {
+		httpErr := &HTTPError{
+			StatusCode: 503,
+			Message:    "Service Unavailable",
+		}
+
+		retryable := re.isRetryableError(httpErr)
+		assert.True(t, retryable, "503 errors should be retryable")
+	})
+
+	t.Run("HTTPError with 400 is not retryable", func(t *testing.T) {
+		httpErr := &HTTPError{
+			StatusCode: 400,
+			Message:    "Bad Request",
+		}
+
+		retryable := re.isRetryableError(httpErr)
+		assert.False(t, retryable, "400 errors should not be retryable")
+	})
+
+	t.Run("net.Error with timeout is retryable", func(t *testing.T) {
+		netErr := &mockNetError{
+			timeout:   true,
+			temporary: false,
+			msg:       "timeout error",
+		}
+
+		retryable := re.isRetryableError(netErr)
+		assert.True(t, retryable, "timeout errors should be retryable")
+	})
+
+	t.Run("net.Error with connection refused is retryable", func(t *testing.T) {
+		netErr := &mockNetError{
+			timeout:   false,
+			temporary: false,
+			msg:       "connection refused",
+		}
+
+		retryable := re.isRetryableError(netErr)
+		assert.True(t, retryable, "connection refused should be retryable")
+	})
+
+	t.Run("net.Error with connection reset is retryable", func(t *testing.T) {
+		netErr := &mockNetError{
+			timeout:   false,
+			temporary: false,
+			msg:       "connection reset by peer",
+		}
+
+		retryable := re.isRetryableError(netErr)
+		assert.True(t, retryable, "connection reset should be retryable")
+	})
+
+	t.Run("net.Error with network unreachable is retryable", func(t *testing.T) {
+		netErr := &mockNetError{
+			timeout:   false,
+			temporary: false,
+			msg:       "network is unreachable",
+		}
+
+		retryable := re.isRetryableError(netErr)
+		assert.True(t, retryable, "network unreachable should be retryable")
+	})
+
+	t.Run("net.Error with no route to host is retryable", func(t *testing.T) {
+		netErr := &mockNetError{
+			timeout:   false,
+			temporary: false,
+			msg:       "no route to host",
+		}
+
+		retryable := re.isRetryableError(netErr)
+		assert.True(t, retryable, "no route to host should be retryable")
+	})
+
+	t.Run("net.Error with temporary failure is retryable", func(t *testing.T) {
+		netErr := &mockNetError{
+			timeout:   false,
+			temporary: false,
+			msg:       "temporary failure in name resolution",
+		}
+
+		retryable := re.isRetryableError(netErr)
+		assert.True(t, retryable, "temporary failure should be retryable")
+	})
+
+	t.Run("net.Error with try again is retryable", func(t *testing.T) {
+		netErr := &mockNetError{
+			timeout:   false,
+			temporary: false,
+			msg:       "try again later",
+		}
+
+		retryable := re.isRetryableError(netErr)
+		assert.True(t, retryable, "try again should be retryable")
+	})
+
+	t.Run("net.Error with resource temporarily unavailable is retryable", func(t *testing.T) {
+		netErr := &mockNetError{
+			timeout:   false,
+			temporary: false,
+			msg:       "resource temporarily unavailable",
+		}
+
+		retryable := re.isRetryableError(netErr)
+		assert.True(t, retryable, "resource temporarily unavailable should be retryable")
+	})
+
+	t.Run("configured retryable error patterns", func(t *testing.T) {
+		err := errors.New("connection refused by server")
+
+		retryable := re.isRetryableError(err)
+		assert.True(t, retryable, "configured pattern should be retryable")
+	})
+
+	t.Run("non-retryable error", func(t *testing.T) {
+		err := errors.New("invalid input data")
+
+		retryable := re.isRetryableError(err)
+		assert.False(t, retryable, "non-configured error should not be retryable")
+	})
+}
+
+// TestRetryExecutorCalculateDelayEdgeCases tests delay calculation edge cases
+func TestRetryExecutorCalculateDelayEdgeCases(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+
+	t.Run("delay calculation without jitter", func(t *testing.T) {
+		config := RetryConfig{
+			MaxAttempts:   3,
+			InitialDelay:  100 * time.Millisecond,
+			MaxDelay:      5 * time.Second,
+			BackoffFactor: 2.0,
+			EnableJitter:  false, // Jitter disabled
+		}
+		re := NewRetryExecutor(config, logger)
+
+		// Attempt 1: 100ms * 2^0 = 100ms
+		delay1 := re.calculateDelay(1)
+		assert.Equal(t, 100*time.Millisecond, delay1)
+
+		// Attempt 2: 100ms * 2^1 = 200ms
+		delay2 := re.calculateDelay(2)
+		assert.Equal(t, 200*time.Millisecond, delay2)
+
+		// Attempt 3: 100ms * 2^2 = 400ms
+		delay3 := re.calculateDelay(3)
+		assert.Equal(t, 400*time.Millisecond, delay3)
+	})
+
+	t.Run("delay calculation with jitter", func(t *testing.T) {
+		config := RetryConfig{
+			MaxAttempts:   3,
+			InitialDelay:  100 * time.Millisecond,
+			MaxDelay:      5 * time.Second,
+			BackoffFactor: 2.0,
+			EnableJitter:  true, // Jitter enabled
+		}
+		re := NewRetryExecutor(config, logger)
+
+		// With jitter, delay should be within 10% of expected
+		delay := re.calculateDelay(2)
+		expectedBase := 200 * time.Millisecond
+		minDelay := time.Duration(float64(expectedBase) * 0.9)
+		maxDelay := time.Duration(float64(expectedBase) * 1.1)
+
+		assert.GreaterOrEqual(t, delay, minDelay, "delay should be >= 90% of base")
+		assert.LessOrEqual(t, delay, maxDelay, "delay should be <= 110% of base")
+	})
+
+	t.Run("delay capped at max delay", func(t *testing.T) {
+		config := RetryConfig{
+			MaxAttempts:   10,
+			InitialDelay:  100 * time.Millisecond,
+			MaxDelay:      500 * time.Millisecond, // Low max delay
+			BackoffFactor: 2.0,
+			EnableJitter:  false,
+		}
+		re := NewRetryExecutor(config, logger)
+
+		// Attempt 10: would be 100ms * 2^9 = 51200ms, but capped at 500ms
+		delay := re.calculateDelay(10)
+		assert.Equal(t, 500*time.Millisecond, delay, "delay should be capped at max")
+	})
+
+	t.Run("delay with large backoff factor", func(t *testing.T) {
+		config := RetryConfig{
+			MaxAttempts:   5,
+			InitialDelay:  50 * time.Millisecond,
+			MaxDelay:      10 * time.Second,
+			BackoffFactor: 3.0, // Larger backoff
+			EnableJitter:  false,
+		}
+		re := NewRetryExecutor(config, logger)
+
+		// Attempt 3: 50ms * 3^2 = 450ms
+		delay := re.calculateDelay(3)
+		assert.Equal(t, 450*time.Millisecond, delay)
+	})
+}
+
+// TestErrorTypesErrorMethodsWithoutCause tests error type Error() methods without cause
+func TestErrorTypesErrorMethodsWithoutCause(t *testing.T) {
+	t.Run("HTTPError.Error without cause", func(t *testing.T) {
+		httpErr := &HTTPError{
+			StatusCode: 404,
+			Message:    "Not Found",
+		}
+
+		errStr := httpErr.Error()
+		assert.Equal(t, "HTTP 404: Not Found", errStr)
+	})
+
+	t.Run("HTTPError.Error with different status codes", func(t *testing.T) {
+		testCases := []struct {
+			code     int
+			message  string
+			expected string
+		}{
+			{200, "OK", "HTTP 200: OK"},
+			{301, "Moved", "HTTP 301: Moved"},
+			{401, "Unauthorized", "HTTP 401: Unauthorized"},
+			{500, "Server Error", "HTTP 500: Server Error"},
+		}
+
+		for _, tc := range testCases {
+			httpErr := &HTTPError{
+				StatusCode: tc.code,
+				Message:    tc.message,
+			}
+			assert.Equal(t, tc.expected, httpErr.Error())
+		}
+	})
+
+	t.Run("OIDCError.Error without cause", func(t *testing.T) {
+		oidcErr := &OIDCError{
+			Code:    "invalid_token",
+			Message: "Token validation failed",
+			Context: make(map[string]interface{}),
+		}
+
+		errStr := oidcErr.Error()
+		assert.Equal(t, "OIDC error [invalid_token]: Token validation failed", errStr)
+	})
+
+	t.Run("OIDCError.Error with cause", func(t *testing.T) {
+		rootErr := errors.New("signature mismatch")
+		oidcErr := &OIDCError{
+			Code:    "invalid_signature",
+			Message: "JWT signature invalid",
+			Context: make(map[string]interface{}),
+			Cause:   rootErr,
+		}
+
+		errStr := oidcErr.Error()
+		assert.Contains(t, errStr, "OIDC error [invalid_signature]: JWT signature invalid")
+		assert.Contains(t, errStr, "caused by: signature mismatch")
+	})
+
+	t.Run("SessionError.Error without cause", func(t *testing.T) {
+		sessErr := &SessionError{
+			Operation: "load",
+			Message:   "Session not found",
+			SessionID: "sess123",
+		}
+
+		errStr := sessErr.Error()
+		assert.Equal(t, "Session error in load: Session not found", errStr)
+	})
+
+	t.Run("SessionError.Error with cause", func(t *testing.T) {
+		rootErr := errors.New("database connection failed")
+		sessErr := &SessionError{
+			Operation: "save",
+			Message:   "Failed to persist session",
+			SessionID: "sess456",
+			Cause:     rootErr,
+		}
+
+		errStr := sessErr.Error()
+		assert.Contains(t, errStr, "Session error in save: Failed to persist session")
+		assert.Contains(t, errStr, "caused by: database connection failed")
+	})
+
+	t.Run("TokenError.Error without cause", func(t *testing.T) {
+		tokenErr := &TokenError{
+			TokenType: "access_token",
+			Reason:    "expired",
+			Message:   "Token has expired",
+		}
+
+		errStr := tokenErr.Error()
+		assert.Equal(t, "Token error (access_token) - expired: Token has expired", errStr)
+	})
+
+	t.Run("TokenError.Error with cause", func(t *testing.T) {
+		rootErr := errors.New("time check failed")
+		tokenErr := &TokenError{
+			TokenType: "id_token",
+			Reason:    "expired",
+			Message:   "Token validity period exceeded",
+			Cause:     rootErr,
+		}
+
+		errStr := tokenErr.Error()
+		assert.Contains(t, errStr, "Token error (id_token) - expired: Token validity period exceeded")
+		assert.Contains(t, errStr, "caused by: time check failed")
+	})
+}
+
+// TestGracefulDegradationHealthChecks tests health check functionality
+func TestGracefulDegradationHealthChecks(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+
+	t.Run("performHealthChecks recovers degraded service", func(t *testing.T) {
+		config := DefaultGracefulDegradationConfig()
+		gd := NewGracefulDegradation(config, logger)
+		defer gd.Close()
+
+		// Register health check that returns true
+		healthCheckCalled := false
+		gd.RegisterHealthCheck("test-service", func() bool {
+			healthCheckCalled = true
+			return true // Service is healthy
+		})
+
+		// Mark service as degraded
+		gd.markServiceDegraded("test-service")
+
+		// Verify service is degraded
+		assert.True(t, gd.isServiceDegraded("test-service"))
+
+		// Manually trigger health check
+		gd.performHealthChecks()
+
+		// Health check should have been called
+		assert.True(t, healthCheckCalled, "health check should be called")
+
+		// Service should be recovered
+		assert.False(t, gd.isServiceDegraded("test-service"), "service should be recovered")
+	})
+
+	t.Run("performHealthChecks marks service degraded on failure", func(t *testing.T) {
+		config := DefaultGracefulDegradationConfig()
+		gd := NewGracefulDegradation(config, logger)
+		defer gd.Close()
+
+		// Register health check that returns false
+		gd.RegisterHealthCheck("failing-service", func() bool {
+			return false // Service is unhealthy
+		})
+
+		// Initially not degraded
+		assert.False(t, gd.isServiceDegraded("failing-service"))
+
+		// Manually trigger health check
+		gd.performHealthChecks()
+
+		// Service should be marked degraded
+		assert.True(t, gd.isServiceDegraded("failing-service"), "service should be degraded")
+	})
+
+	t.Run("performHealthChecks runs multiple health checks independently", func(t *testing.T) {
+		config := DefaultGracefulDegradationConfig()
+		gd := NewGracefulDegradation(config, logger)
+		defer gd.Close()
+
+		service1Checked := false
+		service2Checked := false
+
+		gd.RegisterHealthCheck("service1", func() bool {
+			service1Checked = true
+			return true
+		})
+
+		gd.RegisterHealthCheck("service2", func() bool {
+			service2Checked = true
+			return true
+		})
+
+		// Manually trigger health checks
+		gd.performHealthChecks()
+
+		assert.True(t, service1Checked, "service1 health check should run")
+		assert.True(t, service2Checked, "service2 health check should run")
+	})
+
+	t.Run("performHealthChecks handles empty health checks", func(t *testing.T) {
+		config := DefaultGracefulDegradationConfig()
+		gd := NewGracefulDegradation(config, logger)
+		defer gd.Close()
+
+		// Call performHealthChecks with no registered health checks
+		// Should not panic
+		assert.NotPanics(t, func() {
+			gd.performHealthChecks()
+		})
+	})
+}
+
+// TestGracefulDegradationServiceRecoveryTimeout tests recovery timeout behavior
+func TestGracefulDegradationServiceRecoveryTimeout(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+
+	t.Run("service auto-recovers after timeout", func(t *testing.T) {
+		baseTimeout := GetTestDuration(50 * time.Millisecond)
+		config := GracefulDegradationConfig{
+			HealthCheckInterval: 1 * time.Hour, // Long interval, won't run during test
+			RecoveryTimeout:     baseTimeout,
+			EnableFallbacks:     true,
+		}
+		gd := NewGracefulDegradation(config, logger)
+		defer gd.Close()
+
+		// Mark service degraded
+		gd.markServiceDegraded("auto-recover-service")
+
+		// Verify degraded
+		assert.True(t, gd.isServiceDegraded("auto-recover-service"))
+
+		// Wait for recovery timeout (longer than timeout to ensure recovery)
+		time.Sleep(baseTimeout + GetTestDuration(20*time.Millisecond))
+
+		// Should auto-recover
+		assert.False(t, gd.isServiceDegraded("auto-recover-service"), "service should auto-recover after timeout")
+	})
+
+	t.Run("service remains degraded before timeout", func(t *testing.T) {
+		config := GracefulDegradationConfig{
+			HealthCheckInterval: 1 * time.Hour,
+			RecoveryTimeout:     1 * time.Hour, // Very long timeout
+			EnableFallbacks:     true,
+		}
+		gd := NewGracefulDegradation(config, logger)
+		defer gd.Close()
+
+		// Mark service degraded
+		gd.markServiceDegraded("long-timeout-service")
+
+		// Verify degraded
+		assert.True(t, gd.isServiceDegraded("long-timeout-service"))
+
+		// Wait a bit
+		time.Sleep(GetTestDuration(10 * time.Millisecond))
+
+		// Should still be degraded
+		assert.True(t, gd.isServiceDegraded("long-timeout-service"), "service should remain degraded before timeout")
+	})
+}
+
+// TestErrorRecoveryManagerIntegration tests full integration of error recovery mechanisms
+func TestErrorRecoveryManagerIntegration(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	erm := NewErrorRecoveryManager(logger)
+
+	t.Run("circuit breaker and retry integration", func(t *testing.T) {
+		// Create a circuit breaker with higher max failures to allow retries
+		cb := NewCircuitBreaker(CircuitBreakerConfig{
+			MaxFailures:  10, // High threshold
+			Timeout:      60 * time.Second,
+			ResetTimeout: 30 * time.Second,
+		}, logger)
+
+		erm.mutex.Lock()
+		erm.circuitBreakers["test-service-integration"] = cb
+		erm.mutex.Unlock()
+
+		attempts := 0
+		fn := func() error {
+			attempts++
+			if attempts < 3 {
+				return errors.New("temporary failure")
+			}
+			return nil
+		}
+
+		err := erm.ExecuteWithRecovery(context.Background(), "test-service-integration", fn)
+
+		assert.NoError(t, err)
+		assert.GreaterOrEqual(t, attempts, 3, "should retry until success")
+	})
+
+	t.Run("circuit breaker opens on repeated failures", func(t *testing.T) {
+		fn := func() error {
+			return errors.New("persistent failure")
+		}
+
+		// First call - should fail after retries
+		err1 := erm.ExecuteWithRecovery(context.Background(), "failing-service", fn)
+		assert.Error(t, err1)
+
+		// Second call - should fail after retries
+		err2 := erm.ExecuteWithRecovery(context.Background(), "failing-service", fn)
+		assert.Error(t, err2)
+
+		// Check circuit breaker state
+		cb := erm.GetCircuitBreaker("failing-service")
+		state := cb.GetState()
+		assert.Equal(t, CircuitBreakerOpen, state, "circuit should be open after repeated failures")
+	})
+
+	t.Run("recovery metrics include all mechanisms", func(t *testing.T) {
+		metrics := erm.GetRecoveryMetrics()
+
+		assert.NotNil(t, metrics)
+		assert.Contains(t, metrics, "circuit_breakers")
+		assert.Contains(t, metrics, "degraded_services")
+	})
+}
+
+// TestContainsHelperFunction tests the contains helper function edge cases
+func TestContainsHelperFunction(t *testing.T) {
+	t.Run("exact match", func(t *testing.T) {
+		assert.True(t, contains("timeout", "timeout"))
+	})
+
+	t.Run("prefix match", func(t *testing.T) {
+		assert.True(t, contains("timeout error occurred", "timeout"))
+	})
+
+	t.Run("suffix match", func(t *testing.T) {
+		assert.True(t, contains("connection timeout", "timeout"))
+	})
+
+	t.Run("middle match", func(t *testing.T) {
+		assert.True(t, contains("a connection timeout error", "timeout"))
+	})
+
+	t.Run("no match", func(t *testing.T) {
+		assert.False(t, contains("connection refused", "timeout"))
+	})
+
+	t.Run("substring longer than string", func(t *testing.T) {
+		assert.False(t, contains("abc", "abcdef"))
+	})
+
+	t.Run("empty substring", func(t *testing.T) {
+		assert.True(t, contains("test", ""))
+	})
+
+	t.Run("empty string", func(t *testing.T) {
+		assert.False(t, contains("", "test"))
+	})
+
+	t.Run("both empty", func(t *testing.T) {
+		assert.True(t, contains("", ""))
+	})
+}

error_recovery_test.go

@@ -0,0 +1,848 @@
+package traefikoidc
+
+import (
+	"context"
+	"errors"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// Test Circuit Breaker State Transitions
+
+func TestCircuitBreakerStateTransitions(t *testing.T) {
+	tests := []struct {
+		name                string
+		failures            int
+		maxFailures         int
+		expectedStateBefore string
+		expectedStateAfter  string
+	}{
+		{
+			name:                "stays closed below threshold",
+			failures:            1,
+			maxFailures:         3,
+			expectedStateBefore: "closed",
+			expectedStateAfter:  "closed",
+		},
+		{
+			name:                "opens at threshold",
+			failures:            3,
+			maxFailures:         3,
+			expectedStateBefore: "closed",
+			expectedStateAfter:  "open",
+		},
+		{
+			name:                "opens above threshold",
+			failures:            5,
+			maxFailures:         3,
+			expectedStateBefore: "closed",
+			expectedStateAfter:  "open",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cb := NewCircuitBreaker(CircuitBreakerConfig{
+				MaxFailures:  tt.maxFailures,
+				Timeout:      time.Second,
+				ResetTimeout: time.Second,
+			}, nil)
+
+			// Verify initial state
+			if state := circuitBreakerStateToString(cb.GetState()); state != tt.expectedStateBefore {
+				t.Errorf("Expected initial state %s, got %s", tt.expectedStateBefore, state)
+			}
+
+			// Trigger failures
+			for i := 0; i < tt.failures; i++ {
+				_ = cb.Execute(func() error {
+					return errors.New("test failure")
+				})
+			}
+
+			// Verify final state
+			if state := circuitBreakerStateToString(cb.GetState()); state != tt.expectedStateAfter {
+				t.Errorf("Expected final state %s, got %s", tt.expectedStateAfter, state)
+			}
+		})
+	}
+}
+
+func TestCircuitBreakerHalfOpenTransition(t *testing.T) {
+	cb := NewCircuitBreaker(CircuitBreakerConfig{
+		MaxFailures:  2,
+		Timeout:      100 * time.Millisecond,
+		ResetTimeout: 50 * time.Millisecond,
+	}, nil)
+
+	// Open the circuit
+	_ = cb.Execute(func() error { return errors.New("fail") })
+	_ = cb.Execute(func() error { return errors.New("fail") })
+
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Error("Circuit should be open after failures")
+	}
+
+	// Wait for timeout to trigger half-open
+	time.Sleep(150 * time.Millisecond)
+
+	// Next request should be allowed (half-open)
+	allowed := false
+	_ = cb.Execute(func() error {
+		allowed = true
+		return nil
+	})
+
+	if !allowed {
+		t.Error("Request should be allowed in half-open state")
+	}
+
+	// Successful request should close the circuit
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Errorf("Circuit should be closed after successful half-open request, got %v", cb.GetState())
+	}
+}
+
+func TestCircuitBreakerHalfOpenFailure(t *testing.T) {
+	cb := NewCircuitBreaker(CircuitBreakerConfig{
+		MaxFailures:  2,
+		Timeout:      100 * time.Millisecond,
+		ResetTimeout: 50 * time.Millisecond,
+	}, nil)
+
+	// Open the circuit
+	_ = cb.Execute(func() error { return errors.New("fail") })
+	_ = cb.Execute(func() error { return errors.New("fail") })
+
+	// Wait for half-open
+	time.Sleep(150 * time.Millisecond)
+
+	// Fail in half-open state
+	_ = cb.Execute(func() error {
+		return errors.New("fail again")
+	})
+
+	// Should return to open state
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Errorf("Circuit should be open after half-open failure, got %v", cb.GetState())
+	}
+}
+
+func TestCircuitBreakerConcurrency(t *testing.T) {
+	cb := NewCircuitBreaker(CircuitBreakerConfig{
+		MaxFailures:  10,
+		Timeout:      time.Second,
+		ResetTimeout: time.Second,
+	}, nil)
+
+	var wg sync.WaitGroup
+	successCount := int64(0)
+	failureCount := int64(0)
+
+	// Concurrent successful requests
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			err := cb.Execute(func() error {
+				return nil
+			})
+			if err == nil {
+				atomic.AddInt64(&successCount, 1)
+			} else {
+				atomic.AddInt64(&failureCount, 1)
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	if successCount != 100 {
+		t.Errorf("Expected 100 successful requests, got %d", successCount)
+	}
+
+	metrics := cb.GetMetrics()
+	if metrics["total_requests"].(int64) != 100 {
+		t.Errorf("Expected 100 total requests, got %d", metrics["total_requests"])
+	}
+}
+
+func TestCircuitBreakerReset(t *testing.T) {
+	cb := NewCircuitBreaker(CircuitBreakerConfig{
+		MaxFailures:  2,
+		Timeout:      time.Second,
+		ResetTimeout: time.Second,
+	}, nil)
+
+	// Open the circuit
+	_ = cb.Execute(func() error { return errors.New("fail") })
+	_ = cb.Execute(func() error { return errors.New("fail") })
+
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Error("Circuit should be open")
+	}
+
+	// Reset
+	cb.Reset()
+
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Error("Circuit should be closed after reset")
+	}
+
+	// Should allow requests after reset
+	err := cb.Execute(func() error {
+		return nil
+	})
+
+	if err != nil {
+		t.Errorf("Should allow requests after reset, got error: %v", err)
+	}
+}
+
+func TestCircuitBreakerMetrics(t *testing.T) {
+	cb := NewCircuitBreaker(CircuitBreakerConfig{
+		MaxFailures:  3,
+		Timeout:      time.Second,
+		ResetTimeout: time.Second,
+	}, nil)
+
+	// Execute some requests
+	_ = cb.Execute(func() error { return nil })
+	_ = cb.Execute(func() error { return errors.New("fail") })
+	_ = cb.Execute(func() error { return nil })
+
+	metrics := cb.GetMetrics()
+
+	if metrics["total_requests"].(int64) != 3 {
+		t.Errorf("Expected 3 requests, got %d", metrics["total_requests"])
+	}
+
+	if metrics["total_successes"].(int64) != 2 {
+		t.Errorf("Expected 2 successes, got %d", metrics["total_successes"])
+	}
+
+	if metrics["total_failures"].(int64) != 1 {
+		t.Errorf("Expected 1 failure, got %d", metrics["total_failures"])
+	}
+
+	if metrics["state"] != "closed" {
+		t.Errorf("Expected state 'closed', got %v", metrics["state"])
+	}
+}
+
+func TestCircuitBreakerIsAvailable(t *testing.T) {
+	cb := NewCircuitBreaker(CircuitBreakerConfig{
+		MaxFailures:  2,
+		Timeout:      100 * time.Millisecond,
+		ResetTimeout: 50 * time.Millisecond,
+	}, nil)
+
+	// Should be available initially
+	if !cb.IsAvailable() {
+		t.Error("Circuit should be available initially")
+	}
+
+	// Open the circuit
+	_ = cb.Execute(func() error { return errors.New("fail") })
+	_ = cb.Execute(func() error { return errors.New("fail") })
+
+	// Should not be available when open
+	if cb.IsAvailable() {
+		t.Error("Circuit should not be available when open")
+	}
+
+	// Wait for timeout
+	time.Sleep(150 * time.Millisecond)
+
+	// Should be available in half-open
+	if !cb.IsAvailable() {
+		t.Error("Circuit should be available in half-open state")
+	}
+}
+
+// Test Retry Executor
+
+func TestRetryExecutorSuccess(t *testing.T) {
+	re := NewRetryExecutor(RetryConfig{
+		MaxAttempts:   3,
+		InitialDelay:  10 * time.Millisecond,
+		MaxDelay:      time.Second,
+		BackoffFactor: 2.0,
+		EnableJitter:  false,
+	}, nil)
+
+	attempts := 0
+	err := re.ExecuteWithContext(context.Background(), func() error {
+		attempts++
+		return nil
+	})
+
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	if attempts != 1 {
+		t.Errorf("Expected 1 attempt for immediate success, got %d", attempts)
+	}
+}
+
+func TestRetryExecutorEventualSuccess(t *testing.T) {
+	re := NewRetryExecutor(RetryConfig{
+		MaxAttempts:     3,
+		InitialDelay:    10 * time.Millisecond,
+		MaxDelay:        time.Second,
+		BackoffFactor:   2.0,
+		EnableJitter:    false,
+		RetryableErrors: []string{"temporary failure"},
+	}, nil)
+
+	attempts := 0
+	err := re.ExecuteWithContext(context.Background(), func() error {
+		attempts++
+		if attempts < 3 {
+			return errors.New("temporary failure")
+		}
+		return nil
+	})
+
+	if err != nil {
+		t.Errorf("Expected success after retries, got %v", err)
+	}
+
+	if attempts != 3 {
+		t.Errorf("Expected 3 attempts, got %d", attempts)
+	}
+}
+
+func TestRetryExecutorMaxAttemptsExceeded(t *testing.T) {
+	re := NewRetryExecutor(RetryConfig{
+		MaxAttempts:     3,
+		InitialDelay:    10 * time.Millisecond,
+		MaxDelay:        time.Second,
+		BackoffFactor:   2.0,
+		EnableJitter:    false,
+		RetryableErrors: []string{"temporary failure"},
+	}, nil)
+
+	attempts := 0
+	err := re.ExecuteWithContext(context.Background(), func() error {
+		attempts++
+		return errors.New("temporary failure")
+	})
+
+	if err == nil {
+		t.Error("Expected error after max attempts")
+	}
+
+	if attempts != 3 {
+		t.Errorf("Expected 3 attempts, got %d", attempts)
+	}
+}
+
+func TestRetryExecutorNonRetryableError(t *testing.T) {
+	re := NewRetryExecutor(RetryConfig{
+		MaxAttempts:     3,
+		InitialDelay:    10 * time.Millisecond,
+		MaxDelay:        time.Second,
+		BackoffFactor:   2.0,
+		EnableJitter:    false,
+		RetryableErrors: []string{"temporary failure"},
+	}, nil)
+
+	attempts := 0
+	err := re.ExecuteWithContext(context.Background(), func() error {
+		attempts++
+		return errors.New("permanent failure")
+	})
+
+	if err == nil {
+		t.Error("Expected error for non-retryable failure")
+	}
+
+	if attempts != 1 {
+		t.Errorf("Expected 1 attempt for non-retryable error, got %d", attempts)
+	}
+}
+
+func TestRetryExecutorContextCancellation(t *testing.T) {
+	re := NewRetryExecutor(RetryConfig{
+		MaxAttempts:     5,
+		InitialDelay:    100 * time.Millisecond,
+		MaxDelay:        time.Second,
+		BackoffFactor:   2.0,
+		EnableJitter:    false,
+		RetryableErrors: []string{"temporary failure"},
+	}, nil)
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	attempts := 0
+	done := make(chan error, 1)
+
+	go func() {
+		done <- re.ExecuteWithContext(ctx, func() error {
+			attempts++
+			return errors.New("temporary failure")
+		})
+	}()
+
+	// Cancel after short delay
+	time.Sleep(150 * time.Millisecond)
+	cancel()
+
+	err := <-done
+
+	if err != context.Canceled {
+		t.Errorf("Expected context.Canceled error, got %v", err)
+	}
+
+	if attempts == 0 {
+		t.Error("Should have attempted at least once")
+	}
+
+	if attempts >= 5 {
+		t.Error("Should not have completed all attempts after cancellation")
+	}
+}
+
+func TestRetryExecutorExponentialBackoff(t *testing.T) {
+	re := NewRetryExecutor(RetryConfig{
+		MaxAttempts:     4,
+		InitialDelay:    100 * time.Millisecond,
+		MaxDelay:        time.Second,
+		BackoffFactor:   2.0,
+		EnableJitter:    false,
+		RetryableErrors: []string{"temporary failure"},
+	}, nil)
+
+	attempts := 0
+	startTime := time.Now()
+
+	_ = re.ExecuteWithContext(context.Background(), func() error {
+		attempts++
+		return errors.New("temporary failure")
+	})
+
+	elapsed := time.Since(startTime)
+
+	// Should have delays: 100ms, 200ms, 400ms = 700ms total (approx)
+	if elapsed < 650*time.Millisecond || elapsed > 850*time.Millisecond {
+		t.Errorf("Expected ~700ms elapsed with exponential backoff, got %v", elapsed)
+	}
+
+	if attempts != 4 {
+		t.Errorf("Expected 4 attempts, got %d", attempts)
+	}
+}
+
+func TestRetryExecutorWithJitter(t *testing.T) {
+	re := NewRetryExecutor(RetryConfig{
+		MaxAttempts:     3,
+		InitialDelay:    100 * time.Millisecond,
+		MaxDelay:        time.Second,
+		BackoffFactor:   2.0,
+		EnableJitter:    true,
+		RetryableErrors: []string{"temporary failure"},
+	}, nil)
+
+	// Run multiple times to verify jitter adds variability
+	durations := make([]time.Duration, 5)
+	for i := 0; i < 5; i++ {
+		startTime := time.Now()
+		_ = re.ExecuteWithContext(context.Background(), func() error {
+			return errors.New("temporary failure")
+		})
+		durations[i] = time.Since(startTime)
+	}
+
+	// Check that not all durations are identical (jitter should add variance)
+	allSame := true
+	for i := 1; i < len(durations); i++ {
+		if durations[i] != durations[0] {
+			allSame = false
+			break
+		}
+	}
+
+	if allSame {
+		t.Error("Expected jitter to add variability to retry delays")
+	}
+}
+
+func TestRetryExecutorNetworkErrors(t *testing.T) {
+	re := NewRetryExecutor(RetryConfig{
+		MaxAttempts:   3,
+		InitialDelay:  10 * time.Millisecond,
+		MaxDelay:      time.Second,
+		BackoffFactor: 2.0,
+		EnableJitter:  false,
+	}, nil)
+
+	tests := []struct {
+		name        string
+		err         error
+		shouldRetry bool
+	}{
+		{
+			name:        "timeout error",
+			err:         &mockNetError{timeout: true, temporary: true},
+			shouldRetry: true,
+		},
+		{
+			name:        "temporary network error",
+			err:         &mockNetError{timeout: false, temporary: true, msg: "temporary failure"},
+			shouldRetry: true,
+		},
+		{
+			name:        "connection refused",
+			err:         &mockNetError{timeout: false, temporary: false, msg: "connection refused"},
+			shouldRetry: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			attempts := 0
+			_ = re.ExecuteWithContext(context.Background(), func() error {
+				attempts++
+				return tt.err
+			})
+
+			expectedAttempts := 1
+			if tt.shouldRetry {
+				expectedAttempts = 3
+			}
+
+			if attempts != expectedAttempts {
+				t.Errorf("Expected %d attempts, got %d", expectedAttempts, attempts)
+			}
+		})
+	}
+}
+
+func TestRetryExecutorHTTPErrors(t *testing.T) {
+	re := NewRetryExecutor(RetryConfig{
+		MaxAttempts:   3,
+		InitialDelay:  10 * time.Millisecond,
+		MaxDelay:      time.Second,
+		BackoffFactor: 2.0,
+		EnableJitter:  false,
+	}, nil)
+
+	tests := []struct {
+		name        string
+		statusCode  int
+		shouldRetry bool
+	}{
+		{"500 Internal Server Error", 500, true},
+		{"502 Bad Gateway", 502, true},
+		{"503 Service Unavailable", 503, true},
+		{"429 Too Many Requests", 429, true},
+		{"400 Bad Request", 400, false},
+		{"404 Not Found", 404, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			attempts := 0
+			_ = re.ExecuteWithContext(context.Background(), func() error {
+				attempts++
+				return &HTTPError{StatusCode: tt.statusCode, Message: "test"}
+			})
+
+			expectedAttempts := 1
+			if tt.shouldRetry {
+				expectedAttempts = 3
+			}
+
+			if attempts != expectedAttempts {
+				t.Errorf("Expected %d attempts, got %d", expectedAttempts, attempts)
+			}
+		})
+	}
+}
+
+func TestRetryExecutorMetrics(t *testing.T) {
+	re := NewRetryExecutor(RetryConfig{
+		MaxAttempts:   3,
+		InitialDelay:  10 * time.Millisecond,
+		MaxDelay:      time.Second,
+		BackoffFactor: 2.0,
+		EnableJitter:  true,
+	}, nil)
+
+	_ = re.ExecuteWithContext(context.Background(), func() error {
+		return nil
+	})
+
+	metrics := re.GetMetrics()
+
+	if metrics["max_attempts"] != 3 {
+		t.Errorf("Expected max_attempts 3, got %v", metrics["max_attempts"])
+	}
+
+	if metrics["backoff_factor"] != 2.0 {
+		t.Errorf("Expected backoff_factor 2.0, got %v", metrics["backoff_factor"])
+	}
+
+	if metrics["enable_jitter"] != true {
+		t.Errorf("Expected enable_jitter true, got %v", metrics["enable_jitter"])
+	}
+}
+
+// Test Error Types
+
+func TestOIDCErrorCreation(t *testing.T) {
+	err := NewOIDCError("invalid_token", "Token is expired", nil)
+
+	if err.Code != "invalid_token" {
+		t.Errorf("Expected code 'invalid_token', got %s", err.Code)
+	}
+
+	if err.Message != "Token is expired" {
+		t.Errorf("Expected message 'Token is expired', got %s", err.Message)
+	}
+
+	expectedMsg := "OIDC error [invalid_token]: Token is expired"
+	if err.Error() != expectedMsg {
+		t.Errorf("Expected error string '%s', got '%s'", expectedMsg, err.Error())
+	}
+}
+
+func TestOIDCErrorWithCause(t *testing.T) {
+	cause := errors.New("underlying error")
+	err := NewOIDCError("token_error", "Failed to validate", cause)
+
+	if err.Unwrap() != cause {
+		t.Error("Expected unwrap to return underlying cause")
+	}
+
+	if err.Error() == "" {
+		t.Error("Error string should include cause")
+	}
+}
+
+func TestOIDCErrorWithContext(t *testing.T) {
+	err := NewOIDCError("auth_failed", "Authentication failed", nil).
+		WithContext("provider", "google").
+		WithContext("user_id", "12345")
+
+	if err.Context["provider"] != "google" {
+		t.Errorf("Expected provider 'google', got %v", err.Context["provider"])
+	}
+
+	if err.Context["user_id"] != "12345" {
+		t.Errorf("Expected user_id '12345', got %v", err.Context["user_id"])
+	}
+}
+
+func TestSessionErrorCreation(t *testing.T) {
+	err := NewSessionError("save", "Failed to save session", nil)
+
+	if err.Operation != "save" {
+		t.Errorf("Expected operation 'save', got %s", err.Operation)
+	}
+
+	expectedMsg := "Session error in save: Failed to save session"
+	if err.Error() != expectedMsg {
+		t.Errorf("Expected error string '%s', got '%s'", expectedMsg, err.Error())
+	}
+}
+
+func TestSessionErrorWithSessionID(t *testing.T) {
+	err := NewSessionError("load", "Session not found", nil).
+		WithSessionID("sess_12345")
+
+	if err.SessionID != "sess_12345" {
+		t.Errorf("Expected session ID 'sess_12345', got %s", err.SessionID)
+	}
+}
+
+func TestTokenErrorCreation(t *testing.T) {
+	err := NewTokenError("id_token", "expired", "Token has expired", nil)
+
+	if err.TokenType != "id_token" {
+		t.Errorf("Expected token type 'id_token', got %s", err.TokenType)
+	}
+
+	if err.Reason != "expired" {
+		t.Errorf("Expected reason 'expired', got %s", err.Reason)
+	}
+
+	expectedMsg := "Token error (id_token) - expired: Token has expired"
+	if err.Error() != expectedMsg {
+		t.Errorf("Expected error string '%s', got '%s'", expectedMsg, err.Error())
+	}
+}
+
+// Test Base Recovery Mechanism
+
+func TestBaseRecoveryMechanismMetrics(t *testing.T) {
+	base := NewBaseRecoveryMechanism("test-mechanism", nil)
+
+	base.RecordRequest()
+	base.RecordSuccess()
+	base.RecordRequest()
+	base.RecordFailure()
+
+	metrics := base.GetBaseMetrics()
+
+	if metrics["total_requests"].(int64) != 2 {
+		t.Errorf("Expected 2 requests, got %d", metrics["total_requests"])
+	}
+
+	if metrics["total_successes"].(int64) != 1 {
+		t.Errorf("Expected 1 success, got %d", metrics["total_successes"])
+	}
+
+	if metrics["total_failures"].(int64) != 1 {
+		t.Errorf("Expected 1 failure, got %d", metrics["total_failures"])
+	}
+
+	if metrics["success_rate"].(float64) != 0.5 {
+		t.Errorf("Expected success rate 0.5, got %v", metrics["success_rate"])
+	}
+}
+
+func TestBaseRecoveryMechanismConcurrentUpdates(t *testing.T) {
+	base := NewBaseRecoveryMechanism("concurrent-test", nil)
+
+	var wg sync.WaitGroup
+	iterations := 1000
+
+	// Concurrent requests
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			base.RecordRequest()
+			if i%2 == 0 {
+				base.RecordSuccess()
+			} else {
+				base.RecordFailure()
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	metrics := base.GetBaseMetrics()
+
+	if metrics["total_requests"].(int64) != int64(iterations) {
+		t.Errorf("Expected %d requests, got %d", iterations, metrics["total_requests"])
+	}
+
+	totalSuccessesAndFailures := metrics["total_successes"].(int64) + metrics["total_failures"].(int64)
+	if totalSuccessesAndFailures != int64(iterations) {
+		t.Errorf("Expected %d total successes+failures, got %d", iterations, totalSuccessesAndFailures)
+	}
+}
+
+// Test Error Recovery Manager
+
+func TestErrorRecoveryManagerCreation(t *testing.T) {
+	erm := NewErrorRecoveryManager(nil)
+
+	if erm == nil {
+		t.Fatal("Expected non-nil error recovery manager")
+	}
+
+	if erm.retryExecutor == nil {
+		t.Error("Expected retry executor to be initialized")
+	}
+
+	if erm.gracefulDegradation == nil {
+		t.Error("Expected graceful degradation to be initialized")
+	}
+}
+
+func TestErrorRecoveryManagerGetCircuitBreaker(t *testing.T) {
+	erm := NewErrorRecoveryManager(nil)
+
+	cb1 := erm.GetCircuitBreaker("service1")
+	cb2 := erm.GetCircuitBreaker("service1")
+	cb3 := erm.GetCircuitBreaker("service2")
+
+	if cb1 == nil || cb2 == nil || cb3 == nil {
+		t.Fatal("Expected non-nil circuit breakers")
+	}
+
+	// Should return same instance for same service
+	if cb1 != cb2 {
+		t.Error("Expected same circuit breaker instance for same service")
+	}
+
+	// Should return different instances for different services
+	if cb1 == cb3 {
+		t.Error("Expected different circuit breaker instances for different services")
+	}
+}
+
+func TestErrorRecoveryManagerExecuteWithRecovery(t *testing.T) {
+	erm := NewErrorRecoveryManager(nil)
+
+	success := false
+	err := erm.ExecuteWithRecovery(context.Background(), "test-service", func() error {
+		success = true
+		return nil
+	})
+
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	if !success {
+		t.Error("Expected function to execute")
+	}
+}
+
+func TestErrorRecoveryManagerMetrics(t *testing.T) {
+	erm := NewErrorRecoveryManager(nil)
+
+	// Create some circuit breakers
+	_ = erm.GetCircuitBreaker("service1")
+	_ = erm.GetCircuitBreaker("service2")
+
+	metrics := erm.GetRecoveryMetrics()
+
+	cbMetrics, ok := metrics["circuit_breakers"].(map[string]interface{})
+	if !ok {
+		t.Fatal("Expected circuit_breakers in metrics")
+	}
+
+	if len(cbMetrics) != 2 {
+		t.Errorf("Expected 2 circuit breakers in metrics, got %d", len(cbMetrics))
+	}
+}
+
+// Helper functions and types
+
+func circuitBreakerStateToString(state CircuitBreakerState) string {
+	switch state {
+	case CircuitBreakerClosed:
+		return "closed"
+	case CircuitBreakerOpen:
+		return "open"
+	case CircuitBreakerHalfOpen:
+		return "half-open"
+	default:
+		return "unknown"
+	}
+}
+
+// Mock network error for testing
+type mockNetError struct {
+	timeout   bool
+	temporary bool
+	msg       string
+}
+
+func (e *mockNetError) Error() string   { return e.msg }
+func (e *mockNetError) Timeout() bool   { return e.timeout }
+func (e *mockNetError) Temporary() bool { return e.temporary }
+
+// Ensure mockNetError implements net.Error
+var _ net.Error = (*mockNetError)(nil)

examples/complete-traefik-config.yaml

@@ -0,0 +1,486 @@
+# ============================================================================
+# Complete Traefik Configuration Example with TraefikOIDC Plugin + Redis
+# ============================================================================
+#
+# This example shows a complete, production-ready configuration for using
+# the TraefikOIDC plugin with Redis caching in a multi-replica deployment.
+#
+
+# ============================================================================
+# Part 1: Traefik Static Configuration (traefik.yml)
+# ============================================================================
+# This file configures Traefik itself and enables the plugin.
+# Place this in /etc/traefik/traefik.yml or mount it in your container.
+
+---
+# Static Configuration
+api:
+  dashboard: true
+  insecure: false  # Set to true only for local development
+
+entryPoints:
+  web:
+    address: ":80"
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+
+  websecure:
+    address: ":443"
+    http:
+      tls:
+        certResolver: letsencrypt
+
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: [email protected]
+      storage: /letsencrypt/acme.json
+      httpChallenge:
+        entryPoint: web
+
+providers:
+  file:
+    filename: /etc/traefik/dynamic.yml
+    watch: true
+
+# Enable the TraefikOIDC plugin
+experimental:
+  plugins:
+    traefikoidc:
+      moduleName: github.com/lukaszraczylo/traefikoidc
+      version: v0.8.0
+
+log:
+  level: INFO
+  format: json
+
+accessLog:
+  format: json
+
+
+# ============================================================================
+# Part 2: Traefik Dynamic Configuration (dynamic.yml)
+# ============================================================================
+# This file defines your routes, services, and middleware.
+# Place this in /etc/traefik/dynamic.yml
+
+---
+http:
+  # -------------------------------------------------------------------------
+  # Middleware Definitions
+  # -------------------------------------------------------------------------
+  middlewares:
+    # Example 1: Minimal Redis Configuration
+    # Perfect for getting started quickly
+    oidc-minimal:
+      plugin:
+        traefikoidc:
+          # Required OIDC settings
+          clientID: "your-application-client-id"
+          clientSecret: "your-client-secret-from-provider"
+          providerURL: "https://auth.example.com"
+          callbackURL: "/oauth2/callback"
+          sessionEncryptionKey: "your-secure-64-character-encryption-key-must-be-kept-secret"
+
+          # Minimal Redis configuration
+          redis:
+            enabled: true
+            address: "redis:6379"
+
+    # Example 2: Production Redis Configuration
+    # Recommended for production deployments with multiple Traefik replicas
+    oidc-production:
+      plugin:
+        traefikoidc:
+          # OIDC Provider Configuration
+          clientID: "prod-client-id"
+          clientSecret: "prod-client-secret"
+          providerURL: "https://auth.example.com"
+          callbackURL: "/oauth2/callback"
+
+          # Session Configuration
+          sessionEncryptionKey: "prod-encryption-key-64-chars-long-keep-it-secret-and-safe"
+          sessionMaxAge: 28800  # 8 hours
+
+          # Security Settings
+          forceHTTPS: true
+          strictAudienceValidation: true
+
+          # Redis Configuration for Multi-Replica Deployment
+          redis:
+            enabled: true
+            address: "redis-master.redis-namespace.svc.cluster.local:6379"
+            password: "REPLACE_WITH_YOUR_REDIS_PASSWORD"
+            db: 0
+            keyPrefix: "traefikoidc:prod:"
+
+            # Cache Strategy
+            cacheMode: "hybrid"  # Fast local cache + shared Redis
+
+            # Connection Pooling
+            poolSize: 20
+            connectTimeout: 5
+            readTimeout: 3
+            writeTimeout: 3
+
+            # Resilience Features
+            enableCircuitBreaker: true
+            circuitBreakerThreshold: 5
+            circuitBreakerTimeout: 60
+            enableHealthCheck: true
+            healthCheckInterval: 30
+
+    # Example 3: Redis with TLS (for production security)
+    oidc-secure:
+      plugin:
+        traefikoidc:
+          clientID: "secure-client-id"
+          clientSecret: "secure-client-secret"
+          providerURL: "https://auth.example.com"
+          callbackURL: "/oauth2/callback"
+          sessionEncryptionKey: "secure-64-character-encryption-key-for-production-use-only"
+
+          redis:
+            enabled: true
+            address: "redis.example.com:6380"
+            password: "REPLACE_WITH_YOUR_REDIS_PASSWORD"
+            enableTLS: true
+            tlsSkipVerify: false  # Verify certificates in production
+            cacheMode: "redis"
+
+    # Example 4: Hybrid Mode (Best Performance + Consistency)
+    # Local cache for hot data, Redis for consistency across replicas
+    oidc-hybrid:
+      plugin:
+        traefikoidc:
+          clientID: "app-client-id"
+          clientSecret: "app-client-secret"
+          providerURL: "https://auth.example.com"
+          callbackURL: "/oauth2/callback"
+          sessionEncryptionKey: "hybrid-mode-encryption-key-64-characters-long-and-secure"
+
+          redis:
+            enabled: true
+            address: "redis:6379"
+            password: "REPLACE_WITH_YOUR_REDIS_PASSWORD"
+            cacheMode: "hybrid"
+
+            # Hybrid mode L1 cache settings
+            hybridL1Size: 1000        # Number of items in local cache
+            hybridL1MemoryMB: 20      # MB of memory for local cache
+
+  # -------------------------------------------------------------------------
+  # Router Definitions
+  # -------------------------------------------------------------------------
+  routers:
+    # Protected application using OIDC authentication
+    my-app:
+      rule: "Host(`app.example.com`)"
+      entryPoints:
+        - websecure
+      middlewares:
+        - oidc-production  # Use the OIDC middleware
+      service: my-app-service
+      tls:
+        certResolver: letsencrypt
+
+    # Another app with minimal OIDC config
+    simple-app:
+      rule: "Host(`simple.example.com`)"
+      entryPoints:
+        - websecure
+      middlewares:
+        - oidc-minimal
+      service: simple-app-service
+      tls:
+        certResolver: letsencrypt
+
+  # -------------------------------------------------------------------------
+  # Service Definitions
+  # -------------------------------------------------------------------------
+  services:
+    my-app-service:
+      loadBalancer:
+        servers:
+          - url: "http://my-app:8080"
+        healthCheck:
+          path: /health
+          interval: 30s
+          timeout: 5s
+
+    simple-app-service:
+      loadBalancer:
+        servers:
+          - url: "http://simple-app:3000"
+
+
+# ============================================================================
+# Part 3: Docker Compose Example
+# ============================================================================
+
+---
+# docker-compose.yml
+version: '3.8'
+
+services:
+  # Redis service for shared caching
+  redis:
+    image: redis:7-alpine
+    command: redis-server --requirepass yourredispassword --maxmemory 256mb --maxmemory-policy allkeys-lru
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis-data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+    networks:
+      - traefik-network
+
+  # Traefik with TraefikOIDC plugin
+  traefik:
+    image: traefik:v3.2
+    command:
+      - "--api.dashboard=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.file.filename=/etc/traefik/dynamic.yml"
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.websecure.address=:443"
+      - "--experimental.plugins.traefikoidc.modulename=github.com/lukaszraczylo/traefikoidc"
+      - "--experimental.plugins.traefikoidc.version=v0.8.0"
+    ports:
+      - "80:80"
+      - "443:443"
+      - "8080:8080"  # Dashboard
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
+      - ./letsencrypt:/letsencrypt
+    depends_on:
+      - redis
+    networks:
+      - traefik-network
+
+  # Your application
+  my-app:
+    image: my-app:latest
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.my-app.rule=Host(`app.example.com`)"
+      - "traefik.http.routers.my-app.entrypoints=websecure"
+      - "traefik.http.routers.my-app.tls.certresolver=letsencrypt"
+
+      # OIDC Middleware Configuration with Redis (using labels)
+      - "traefik.http.routers.my-app.middlewares=my-oidc@docker"
+      - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.clientID=your-client-id"
+      - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.clientSecret=your-client-secret"
+      - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.providerURL=https://auth.example.com"
+      - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.callbackURL=/oauth2/callback"
+      - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.sessionEncryptionKey=your-64-character-encryption-key-here"
+
+      # Redis configuration
+      - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.enabled=true"
+      - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.address=redis:6379"
+      - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.password=yourredispassword"
+      - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.db=0"
+      - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.keyPrefix=traefikoidc:"
+      - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.cacheMode=hybrid"
+    networks:
+      - traefik-network
+    deploy:
+      replicas: 3  # Multiple replicas sharing Redis cache
+
+volumes:
+  redis-data:
+
+networks:
+  traefik-network:
+    driver: bridge
+
+
+# ============================================================================
+# Part 4: Kubernetes Example
+# ============================================================================
+
+---
+# kubernetes-example.yaml
+
+# Redis Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: traefik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+      - name: redis
+        image: redis:7-alpine
+        args:
+          - redis-server
+          - --requirepass
+          - $(REDIS_PASSWORD)
+          - --maxmemory
+          - 512mb
+          - --maxmemory-policy
+          - allkeys-lru
+        env:
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: redis-secret
+              key: password
+        ports:
+        - containerPort: 6379
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "100m"
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+---
+# Redis Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: traefik
+spec:
+  selector:
+    app: redis
+  ports:
+  - port: 6379
+    targetPort: 6379
+---
+# Redis Secret
+apiVersion: v1
+kind: Secret
+metadata:
+  name: redis-secret
+  namespace: traefik
+type: Opaque
+stringData:
+  password: "REPLACE_WITH_YOUR_REDIS_PASSWORD"
+---
+# OIDC Middleware with Redis
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-auth
+  namespace: traefik
+spec:
+  plugin:
+    traefikoidc:
+      # OIDC Configuration
+      clientID: "kubernetes-client-id"
+      clientSecret: "kubernetes-client-secret"
+      providerURL: "https://auth.example.com"
+      callbackURL: "/oauth2/callback"
+      sessionEncryptionKey: "kubernetes-64-character-session-encryption-key-keep-secret"
+
+      # Redis Configuration
+      redis:
+        enabled: true
+        address: "redis.traefik.svc.cluster.local:6379"
+        password: "REPLACE_WITH_YOUR_REDIS_PASSWORD"
+        db: 0
+        keyPrefix: "traefikoidc:k8s:"
+        cacheMode: "hybrid"
+        poolSize: 20
+        enableCircuitBreaker: true
+        enableHealthCheck: true
+---
+# IngressRoute using the middleware
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: my-app
+  namespace: default
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`app.example.com`)
+    kind: Rule
+    middlewares:
+    - name: oidc-auth
+      namespace: traefik
+    services:
+    - name: my-app
+      port: 80
+  tls:
+    certResolver: letsencrypt
+
+
+# ============================================================================
+# Part 5: Environment Variables (Optional Fallback)
+# ============================================================================
+
+# If you prefer environment variables as fallback (not recommended for production),
+# you can set these. NOTE: Plugin configuration takes precedence!
+
+# Docker Compose env file (.env)
+---
+# OIDC Configuration
+OIDC_CLIENT_ID=your-client-id
+OIDC_CLIENT_SECRET=your-client-secret
+OIDC_PROVIDER_URL=https://auth.example.com
+
+# Redis Configuration (fallback)
+REDIS_ENABLED=true
+REDIS_ADDRESS=redis:6379
+REDIS_PASSWORD=yourredispassword
+REDIS_DB=0
+REDIS_KEY_PREFIX=traefikoidc:
+REDIS_CACHE_MODE=hybrid
+REDIS_POOL_SIZE=20
+REDIS_ENABLE_CIRCUIT_BREAKER=true
+REDIS_ENABLE_HEALTH_CHECK=true
+
+
+# ============================================================================
+# Configuration Cheat Sheet
+# ============================================================================
+
+# Minimal Setup (Quick Start):
+#   redis:
+#     enabled: true
+#     address: "redis:6379"
+
+# Production Setup (Recommended):
+#   redis:
+#     enabled: true
+#     address: "redis-master:6379"
+#     password: "strong-password"
+#     cacheMode: "hybrid"
+#     enableCircuitBreaker: true
+#     enableHealthCheck: true
+
+# High Security Setup:
+#   redis:
+#     enabled: true
+#     address: "redis.example.com:6380"
+#     password: "strong-password"
+#     enableTLS: true
+#     tlsSkipVerify: false
+#     cacheMode: "redis"
+
+# Cache Modes:
+#   - "memory": Local cache only (default, no Redis needed)
+#   - "redis": Redis only (consistent, shared across replicas)
+#   - "hybrid": Local L1 + Redis L2 (best performance + consistency)

examples/redis-config.yaml

@@ -0,0 +1,149 @@
+# Example Traefik configuration for TraefikOIDC plugin with Redis caching
+# This example shows how to configure Redis through Traefik's dynamic configuration
+
+# Static configuration (traefik.yml)
+experimental:
+  plugins:
+    traefikoidc:
+      moduleName: github.com/lukaszraczylo/traefikoidc
+      version: v0.8.0
+
+# Dynamic configuration (dynamic.yml or labels)
+http:
+  middlewares:
+    # Example 1: Basic Redis configuration
+    oidc-redis-basic:
+      plugin:
+        traefikoidc:
+          # Required OIDC settings
+          clientID: "your-client-id"
+          clientSecret: "your-client-secret"
+          providerURL: "https://auth.example.com"
+          callbackURL: "/oauth2/callback"
+          sessionEncryptionKey: "your-64-character-encryption-key-here-keep-it-secret"
+
+          # Redis configuration
+          redis:
+            enabled: true
+            address: "redis:6379"
+            # password: "your-redis-password"  # Optional
+            db: 0
+            keyPrefix: "traefikoidc:"
+
+    # Example 2: Redis with resilience features
+    oidc-redis-resilient:
+      plugin:
+        traefikoidc:
+          # Required OIDC settings
+          clientID: "your-client-id"
+          clientSecret: "your-client-secret"
+          providerURL: "https://auth.example.com"
+          callbackURL: "/oauth2/callback"
+          sessionEncryptionKey: "your-64-character-encryption-key-here-keep-it-secret"
+
+          # Redis with full resilience configuration
+          redis:
+            enabled: true
+            address: "redis:6379"
+            password: "REPLACE_WITH_YOUR_REDIS_PASSWORD"  # Example placeholder - use your actual password
+            db: 1
+            keyPrefix: "myapp:"
+            poolSize: 20
+            connectTimeout: 10
+            readTimeout: 5
+            writeTimeout: 5
+            cacheMode: "redis"  # Options: "redis", "hybrid", "memory"
+            # Circuit breaker settings
+            enableCircuitBreaker: true
+            circuitBreakerThreshold: 5
+            circuitBreakerTimeout: 60
+            # Health check settings
+            enableHealthCheck: true
+            healthCheckInterval: 30
+
+    # Example 3: Redis with TLS
+    oidc-redis-tls:
+      plugin:
+        traefikoidc:
+          # Required OIDC settings
+          clientID: "your-client-id"
+          clientSecret: "your-client-secret"
+          providerURL: "https://auth.example.com"
+          callbackURL: "/oauth2/callback"
+          sessionEncryptionKey: "your-64-character-encryption-key-here-keep-it-secret"
+
+          # Redis with TLS configuration
+          redis:
+            enabled: true
+            address: "redis.example.com:6380"
+            password: "REPLACE_WITH_YOUR_REDIS_PASSWORD"  # Example placeholder
+            enableTLS: true
+            tlsSkipVerify: false  # Set to true only for testing
+            cacheMode: "redis"
+
+  routers:
+    my-app:
+      rule: "Host(`app.example.com`)"
+      middlewares:
+        - oidc-redis-basic
+      service: my-app-service
+
+  services:
+    my-app-service:
+      loadBalancer:
+        servers:
+          - url: "http://localhost:8080"
+
+# Docker Compose labels example
+# version: '3.8'
+# services:
+#   traefik:
+#     image: traefik:v3.0
+#     # ... other config ...
+#
+#   my-app:
+#     image: my-app:latest
+#     labels:
+#       - "traefik.enable=true"
+#       - "traefik.http.routers.my-app.rule=Host(`app.example.com`)"
+#       - "traefik.http.routers.my-app.middlewares=my-oidc"
+#       # OIDC middleware configuration with Redis
+#       - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.clientID=your-client-id"
+#       - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.clientSecret=your-secret"
+#       - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.providerURL=https://auth.example.com"
+#       - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.callbackURL=/oauth2/callback"
+#       - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.sessionEncryptionKey=your-64-char-key"
+#       # Redis configuration via labels
+#       - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.enabled=true"
+#       - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.address=redis:6379"
+#       - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.password=redis-password"
+#       - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.db=0"
+#       - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.keyPrefix=traefikoidc:"
+#       - "traefik.http.middlewares.my-oidc.plugin.traefikoidc.redis.cacheMode=redis"
+#
+#   redis:
+#     image: redis:7-alpine
+#     command: redis-server --requirepass redis-password
+#     # ... other config ...
+
+# Environment variable fallback (optional)
+# If Redis configuration is not provided in Traefik config, these environment variables
+# can be used as a fallback (but Traefik config takes precedence):
+#
+# REDIS_ENABLED=true
+# REDIS_ADDRESS=redis:6379
+# REDIS_PASSWORD=secret
+# REDIS_DB=0
+# REDIS_KEY_PREFIX=traefikoidc:
+# REDIS_CACHE_MODE=redis
+# REDIS_POOL_SIZE=10
+# REDIS_CONNECT_TIMEOUT=5
+# REDIS_READ_TIMEOUT=3
+# REDIS_WRITE_TIMEOUT=3
+# REDIS_ENABLE_TLS=false
+# REDIS_TLS_SKIP_VERIFY=false
+# REDIS_ENABLE_CIRCUIT_BREAKER=true
+# REDIS_CIRCUIT_BREAKER_THRESHOLD=5
+# REDIS_CIRCUIT_BREAKER_TIMEOUT=60
+# REDIS_ENABLE_HEALTH_CHECK=true
+# REDIS_HEALTH_CHECK_INTERVAL=30

go.mod

@@ -3,15 +3,20 @@ module github.com/lukaszraczylo/traefikoidc
 go 1.24.0
 
 require (
+	github.com/alicebob/miniredis/v2 v2.35.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/sessions v1.3.0
+	github.com/redis/go-redis/v9 v9.14.0
 	github.com/stretchr/testify v1.10.0
-	golang.org/x/time v0.13.0
+	golang.org/x/time v0.14.0
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	github.com/yuin/gopher-lua v1.1.1 // indirect
 )

go.sum

@@ -1,5 +1,15 @@
+github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
+github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
+github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
+github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
+github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
+github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -10,10 +20,14 @@ github.com/gorilla/sessions v1.3.0 h1:XYlkq7KcpOB2ZhHBPv5WpjMIxrQosiZanfoy1HLZFz
 github.com/gorilla/sessions v1.3.0/go.mod h1:ePLdVu+jbEgHH+KWw8I1z2wqd0BAdAQh/8LRvBeoNcQ=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/redis/go-redis/v9 v9.14.0 h1:u4tNCjXOyzfgeLN+vAZaW1xUooqWDqVEsZN0U01jfAE=
+github.com/redis/go-redis/v9 v9.14.0/go.mod h1:huWgSWd8mW6+m0VPhJjSSQ+d6Nh1VICQ6Q5lHuCH/Iw=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-golang.org/x/time v0.13.0 h1:eUlYslOIt32DgYD6utsuUeHs4d7AsEYLuIAdg7FlYgI=
-golang.org/x/time v0.13.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
+github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

goroutine_manager.go

@@ -86,7 +86,7 @@ func (m *GoroutineManager) StartPeriodicTask(name string, interval time.Duration
 		for {
 			select {
 			case <-ctx.Done():
-				m.logger.Debugf("Periodic task %s cancelled", name)
+				m.logger.Debugf("Periodic task %s canceled", name)
 				return
 			case <-ticker.C:
 				task()

goroutine_manager_test.go

@@ -0,0 +1,625 @@
+package traefikoidc
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// Test GoroutineManager Creation
+
+func TestNewGoroutineManager(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+
+	if gm == nil {
+		t.Fatal("Expected non-nil goroutine manager")
+	}
+
+	if gm.ctx == nil {
+		t.Error("Expected context to be initialized")
+	}
+
+	if gm.cancel == nil {
+		t.Error("Expected cancel function to be initialized")
+	}
+
+	if gm.goroutines == nil {
+		t.Error("Expected goroutines map to be initialized")
+	}
+
+	if gm.logger != logger {
+		t.Error("Expected logger to be set")
+	}
+}
+
+// Test Starting Goroutines
+
+func TestStartGoroutine(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	executed := atomic.Bool{}
+
+	gm.StartGoroutine("test-goroutine", func(ctx context.Context) {
+		executed.Store(true)
+	})
+
+	// Give goroutine time to execute
+	time.Sleep(50 * time.Millisecond)
+
+	if !executed.Load() {
+		t.Error("Expected goroutine to execute")
+	}
+
+	status := gm.GetStatus()
+	if len(status) != 1 {
+		t.Errorf("Expected 1 goroutine in status, got %d", len(status))
+	}
+
+	if _, exists := status["test-goroutine"]; !exists {
+		t.Error("Expected goroutine 'test-goroutine' in status")
+	}
+}
+
+func TestStartGoroutineDuplicate(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	counter := atomic.Int32{}
+
+	// Start a long-running goroutine
+	gm.StartGoroutine("duplicate-test", func(ctx context.Context) {
+		counter.Add(1)
+		<-ctx.Done()
+	})
+
+	// Give first goroutine time to start
+	time.Sleep(50 * time.Millisecond)
+
+	// Try to start another with same name (should be skipped)
+	gm.StartGoroutine("duplicate-test", func(ctx context.Context) {
+		counter.Add(1)
+	})
+
+	time.Sleep(50 * time.Millisecond)
+
+	// Should only have executed once
+	if counter.Load() != 1 {
+		t.Errorf("Expected counter to be 1 (duplicate should be skipped), got %d", counter.Load())
+	}
+}
+
+func TestStartGoroutineContextCancellation(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+
+	started := atomic.Bool{}
+	canceled := atomic.Bool{}
+
+	gm.StartGoroutine("cancel-test", func(ctx context.Context) {
+		started.Store(true)
+		<-ctx.Done()
+		canceled.Store(true)
+	})
+
+	// Wait for goroutine to start
+	time.Sleep(50 * time.Millisecond)
+
+	if !started.Load() {
+		t.Error("Expected goroutine to start")
+	}
+
+	// Stop the goroutine
+	gm.StopGoroutine("cancel-test")
+
+	// Wait for cancellation
+	time.Sleep(50 * time.Millisecond)
+
+	if !canceled.Load() {
+		t.Error("Expected goroutine to be canceled")
+	}
+}
+
+func TestStartGoroutineWithPanic(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	executed := atomic.Bool{}
+
+	gm.StartGoroutine("panic-test", func(ctx context.Context) {
+		executed.Store(true)
+		panic("test panic")
+	})
+
+	// Give goroutine time to panic and recover
+	time.Sleep(100 * time.Millisecond)
+
+	if !executed.Load() {
+		t.Error("Expected goroutine to execute before panic")
+	}
+
+	// Check that goroutine is marked as not running after panic
+	status := gm.GetStatus()
+	if goroutineStatus, exists := status["panic-test"]; exists {
+		if goroutineStatus.Running {
+			t.Error("Expected goroutine to be marked as not running after panic")
+		}
+	}
+
+	// Manager should still be functional
+	counter := atomic.Int32{}
+	gm.StartGoroutine("after-panic", func(ctx context.Context) {
+		counter.Add(1)
+	})
+
+	time.Sleep(50 * time.Millisecond)
+
+	if counter.Load() != 1 {
+		t.Error("Expected manager to still be functional after panic recovery")
+	}
+}
+
+// Test Periodic Tasks
+
+func TestStartPeriodicTask(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	counter := atomic.Int32{}
+
+	gm.StartPeriodicTask("periodic-test", 50*time.Millisecond, func() {
+		counter.Add(1)
+	})
+
+	// Wait for multiple executions
+	time.Sleep(160 * time.Millisecond)
+
+	// Should have executed at least 2-3 times
+	count := counter.Load()
+	if count < 2 {
+		t.Errorf("Expected periodic task to execute at least 2 times, got %d", count)
+	}
+}
+
+func TestStartPeriodicTaskCancellation(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	counter := atomic.Int32{}
+
+	gm.StartPeriodicTask("cancel-periodic", 50*time.Millisecond, func() {
+		counter.Add(1)
+	})
+
+	// Wait for some executions
+	time.Sleep(120 * time.Millisecond)
+
+	// Stop the task
+	gm.StopGoroutine("cancel-periodic")
+
+	countBeforeStop := counter.Load()
+
+	// Wait and verify no more executions
+	time.Sleep(120 * time.Millisecond)
+
+	countAfterStop := counter.Load()
+
+	// Allow 1 additional execution (could be in progress when stopped)
+	if countAfterStop > countBeforeStop+1 {
+		t.Errorf("Expected periodic task to stop executing, before: %d, after: %d",
+			countBeforeStop, countAfterStop)
+	}
+}
+
+// Test Stopping Goroutines
+
+func TestStopGoroutine(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	stopped := atomic.Bool{}
+
+	gm.StartGoroutine("stop-test", func(ctx context.Context) {
+		<-ctx.Done()
+		stopped.Store(true)
+	})
+
+	// Wait for goroutine to start
+	time.Sleep(50 * time.Millisecond)
+
+	gm.StopGoroutine("stop-test")
+
+	// Wait for goroutine to stop
+	time.Sleep(50 * time.Millisecond)
+
+	if !stopped.Load() {
+		t.Error("Expected goroutine to be stopped")
+	}
+
+	status := gm.GetStatus()
+	if goroutineStatus, exists := status["stop-test"]; exists {
+		if goroutineStatus.Running {
+			t.Error("Expected goroutine to be marked as not running")
+		}
+	}
+}
+
+func TestStopGoroutineNonExistent(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	// Should not panic or error when stopping non-existent goroutine
+	gm.StopGoroutine("non-existent")
+}
+
+func TestStopGoroutineAlreadyStopped(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	gm.StartGoroutine("already-stopped", func(ctx context.Context) {
+		// Exit immediately
+	})
+
+	// Wait for goroutine to finish
+	time.Sleep(50 * time.Millisecond)
+
+	// Try to stop already-stopped goroutine (should be safe)
+	gm.StopGoroutine("already-stopped")
+}
+
+// Test Shutdown
+
+func TestShutdownGraceful(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+
+	counter := atomic.Int32{}
+
+	// Start multiple goroutines
+	for i := 0; i < 5; i++ {
+		name := "goroutine-" + string(rune('0'+i))
+		gm.StartGoroutine(name, func(ctx context.Context) {
+			counter.Add(1)
+			<-ctx.Done()
+			counter.Add(-1)
+		})
+	}
+
+	// Wait for all to start
+	time.Sleep(100 * time.Millisecond)
+
+	if counter.Load() != 5 {
+		t.Errorf("Expected 5 goroutines running, got %d", counter.Load())
+	}
+
+	// Shutdown with generous timeout
+	err := gm.Shutdown(time.Second)
+
+	if err != nil {
+		t.Errorf("Expected graceful shutdown, got error: %v", err)
+	}
+
+	if counter.Load() != 0 {
+		t.Errorf("Expected all goroutines to complete cleanup, got %d still running", counter.Load())
+	}
+}
+
+func TestShutdownWithTimeout(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+
+	// Start a goroutine that ignores cancellation (bad behavior, but testing timeout)
+	gm.StartGoroutine("stubborn", func(ctx context.Context) {
+		// Simulate a goroutine that takes too long to stop
+		time.Sleep(500 * time.Millisecond)
+	})
+
+	time.Sleep(50 * time.Millisecond)
+
+	// Shutdown with very short timeout
+	err := gm.Shutdown(10 * time.Millisecond)
+
+	if err == nil {
+		t.Error("Expected timeout error")
+	}
+
+	if err != ErrShutdownTimeout {
+		t.Errorf("Expected ErrShutdownTimeout, got %v", err)
+	}
+}
+
+func TestShutdownEmpty(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+
+	// Shutdown with no goroutines should succeed immediately
+	err := gm.Shutdown(time.Second)
+
+	if err != nil {
+		t.Errorf("Expected no error for empty shutdown, got: %v", err)
+	}
+}
+
+// Test Status
+
+func TestGetStatus(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	// Start multiple goroutines with different states
+	gm.StartGoroutine("running", func(ctx context.Context) {
+		<-ctx.Done()
+	})
+
+	gm.StartGoroutine("quick", func(ctx context.Context) {
+		// Exits immediately
+	})
+
+	time.Sleep(50 * time.Millisecond)
+
+	status := gm.GetStatus()
+
+	if len(status) != 2 {
+		t.Errorf("Expected 2 goroutines in status, got %d", len(status))
+	}
+
+	if runningStatus, exists := status["running"]; exists {
+		if !runningStatus.Running {
+			t.Error("Expected 'running' goroutine to be marked as running")
+		}
+
+		if runningStatus.Name != "running" {
+			t.Errorf("Expected name 'running', got %s", runningStatus.Name)
+		}
+
+		if runningStatus.StartTime.IsZero() {
+			t.Error("Expected non-zero start time")
+		}
+
+		if runningStatus.Runtime <= 0 {
+			t.Error("Expected positive runtime")
+		}
+	} else {
+		t.Error("Expected 'running' goroutine in status")
+	}
+
+	if quickStatus, exists := status["quick"]; exists {
+		if quickStatus.Running {
+			t.Error("Expected 'quick' goroutine to be marked as not running")
+		}
+	} else {
+		t.Error("Expected 'quick' goroutine in status")
+	}
+}
+
+func TestGetStatusEmpty(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	status := gm.GetStatus()
+
+	if status == nil {
+		t.Fatal("Expected non-nil status map")
+	}
+
+	if len(status) != 0 {
+		t.Errorf("Expected empty status, got %d entries", len(status))
+	}
+}
+
+// Test Concurrent Operations
+
+func TestConcurrentStartGoroutine(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(2 * time.Second)
+
+	counter := atomic.Int32{}
+	const numGoroutines = 50
+
+	// Start many goroutines concurrently
+	for i := 0; i < numGoroutines; i++ {
+		go func(id int) {
+			name := "concurrent-" + string(rune('0'+id%10)) + string(rune('0'+id/10))
+			gm.StartGoroutine(name, func(ctx context.Context) {
+				counter.Add(1)
+				time.Sleep(50 * time.Millisecond)
+				counter.Add(-1)
+			})
+		}(i)
+	}
+
+	// Wait for all to start
+	time.Sleep(150 * time.Millisecond)
+
+	// Verify goroutines are tracked
+	status := gm.GetStatus()
+	if len(status) < numGoroutines/2 {
+		t.Errorf("Expected at least %d goroutines, got %d", numGoroutines/2, len(status))
+	}
+}
+
+func TestConcurrentStopGoroutine(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	const numGoroutines = 20
+
+	// Start goroutines
+	for i := 0; i < numGoroutines; i++ {
+		name := "stop-concurrent-" + string(rune('0'+i%10))
+		gm.StartGoroutine(name, func(ctx context.Context) {
+			<-ctx.Done()
+		})
+	}
+
+	time.Sleep(50 * time.Millisecond)
+
+	// Stop all concurrently
+	for i := 0; i < numGoroutines; i++ {
+		go func(id int) {
+			name := "stop-concurrent-" + string(rune('0'+id%10))
+			gm.StopGoroutine(name)
+		}(i)
+	}
+
+	time.Sleep(100 * time.Millisecond)
+
+	// Verify all stopped
+	status := gm.GetStatus()
+	for _, s := range status {
+		if s.Running {
+			t.Errorf("Expected goroutine %s to be stopped", s.Name)
+		}
+	}
+}
+
+func TestConcurrentGetStatus(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	// Start some goroutines
+	for i := 0; i < 10; i++ {
+		name := "status-test-" + string(rune('0'+i))
+		gm.StartGoroutine(name, func(ctx context.Context) {
+			<-ctx.Done()
+		})
+	}
+
+	// Concurrently read status many times (should not race)
+	done := make(chan struct{})
+	for i := 0; i < 20; i++ {
+		go func() {
+			for j := 0; j < 100; j++ {
+				_ = gm.GetStatus()
+			}
+			done <- struct{}{}
+		}()
+	}
+
+	// Wait for all concurrent reads
+	for i := 0; i < 20; i++ {
+		<-done
+	}
+}
+
+// Test Error Cases
+
+func TestShutdownTimeoutError(t *testing.T) {
+	err := ErrShutdownTimeout
+
+	if err.Error() != "shutdown timeout: some goroutines did not stop in time" {
+		t.Errorf("Unexpected error message: %s", err.Error())
+	}
+}
+
+// Test Edge Cases
+
+func TestStartGoroutineAfterShutdown(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+
+	// Shutdown immediately
+	_ = gm.Shutdown(time.Second)
+
+	executed := atomic.Bool{}
+
+	// Try to start goroutine after shutdown
+	gm.StartGoroutine("after-shutdown", func(ctx context.Context) {
+		executed.Store(true)
+		<-ctx.Done()
+	})
+
+	time.Sleep(50 * time.Millisecond)
+
+	// Goroutine should have started but context already canceled
+	// It may or may not execute depending on timing, but shouldn't panic
+	status := gm.GetStatus()
+	if _, exists := status["after-shutdown"]; exists {
+		// If it's in status, it was tracked (acceptable)
+		t.Log("Goroutine was tracked even after shutdown")
+	}
+}
+
+func TestMultipleShutdowns(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+
+	// First shutdown
+	err1 := gm.Shutdown(time.Second)
+	if err1 != nil {
+		t.Errorf("Expected first shutdown to succeed, got: %v", err1)
+	}
+
+	// Second shutdown (should not panic or error)
+	err2 := gm.Shutdown(time.Second)
+	if err2 != nil {
+		t.Errorf("Expected second shutdown to succeed, got: %v", err2)
+	}
+}
+
+func TestGoroutineWithImmediateReturn(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	executed := atomic.Bool{}
+
+	gm.StartGoroutine("immediate", func(ctx context.Context) {
+		executed.Store(true)
+		// Return immediately
+	})
+
+	time.Sleep(50 * time.Millisecond)
+
+	if !executed.Load() {
+		t.Error("Expected goroutine to execute")
+	}
+
+	status := gm.GetStatus()
+	if goroutineStatus, exists := status["immediate"]; exists {
+		if goroutineStatus.Running {
+			t.Error("Expected immediately-returning goroutine to be marked as not running")
+		}
+	}
+}
+
+func TestPeriodicTaskPanicRecovery(t *testing.T) {
+	logger := GetSingletonNoOpLogger()
+	gm := NewGoroutineManager(logger)
+	defer gm.Shutdown(time.Second)
+
+	counter := atomic.Int32{}
+
+	gm.StartPeriodicTask("panic-periodic", 50*time.Millisecond, func() {
+		counter.Add(1)
+		if counter.Load() == 2 {
+			panic("periodic panic")
+		}
+	})
+
+	// Wait for panic to occur
+	time.Sleep(200 * time.Millisecond)
+
+	// After panic, the goroutine should have stopped
+	status := gm.GetStatus()
+	if goroutineStatus, exists := status["panic-periodic"]; exists {
+		if goroutineStatus.Running {
+			t.Error("Expected panicked periodic task to stop")
+		}
+	}
+}

handlers/oauth_handler.go

@@ -147,7 +147,12 @@ func (h *OAuthHandler) HandleCallback(rw http.ResponseWriter, req *http.Request,
 		cookie, err := req.Cookie("_oidc_raczylo_m")
 		if err != nil {
 			h.logger.Errorf("Main session cookie not found in request: %v", err)
-			h.logger.Debugf("Available cookies: %v", req.Header.Get("Cookie"))
+			// Log cookie names only, not values (avoid logging sensitive session data)
+			cookieNames := make([]string, 0, len(req.Cookies()))
+			for _, c := range req.Cookies() {
+				cookieNames = append(cookieNames, c.Name)
+			}
+			h.logger.Debugf("Available cookies (names only): %v", cookieNames)
 		} else {
 			h.logger.Errorf("Main session cookie exists but CSRF token is empty. Cookie value length: %d", len(cookie.Value))
 			h.logger.Debugf("Cookie details - Domain: %s, Path: %s, Secure: %v, HttpOnly: %v, SameSite: %v",

helpers.go

@@ -109,7 +109,7 @@ func (t *TraefikOidc) exchangeTokens(ctx context.Context, grantType string, code
 	client := t.tokenHTTPClient
 	if client == nil {
 		// Use shared transport pool to prevent memory leaks
-		jar, _ := cookiejar.New(nil)
+		jar, _ := cookiejar.New(nil) // Safe to ignore: cookiejar creation with nil options rarely fails
 		pooledClient := CreateTokenHTTPClient()
 		client = &http.Client{
 			Transport: pooledClient.Transport,
@@ -124,7 +124,12 @@ func (t *TraefikOidc) exchangeTokens(ctx context.Context, grantType string, code
 		}
 	}
 
-	req, err := http.NewRequestWithContext(ctx, "POST", t.tokenURL, strings.NewReader(data.Encode()))
+	// Read tokenURL with RLock
+	t.metadataMu.RLock()
+	tokenURL := t.tokenURL
+	t.metadataMu.RUnlock()
+
+	req, err := http.NewRequestWithContext(ctx, "POST", tokenURL, strings.NewReader(data.Encode()))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create token request: %w", err)
 	}
@@ -135,13 +140,13 @@ func (t *TraefikOidc) exchangeTokens(ctx context.Context, grantType string, code
 		return nil, fmt.Errorf("failed to exchange tokens: %w", err)
 	}
 	defer func() {
-		io.Copy(io.Discard, resp.Body)
-		resp.Body.Close()
+		_, _ = io.Copy(io.Discard, resp.Body) // Safe to ignore: draining response body on defer
+		_ = resp.Body.Close()                 // Safe to ignore: closing body on defer
 	}()
 
 	if resp.StatusCode != http.StatusOK {
 		limitReader := io.LimitReader(resp.Body, 1024*10)
-		bodyBytes, _ := io.ReadAll(limitReader)
+		bodyBytes, _ := io.ReadAll(limitReader) // Safe to ignore: reading error body for diagnostics
 		return nil, fmt.Errorf("token endpoint returned status %d: %s", resp.StatusCode, string(bodyBytes))
 	}
 
@@ -232,7 +237,7 @@ func NewTokenCache() *TokenCache {
 //   - expiration: The duration for which the cache entry should be valid
 func (tc *TokenCache) Set(token string, claims map[string]interface{}, expiration time.Duration) {
 	token = "t-" + token
-	tc.cache.Set(token, claims, expiration)
+	_ = tc.cache.Set(token, claims, expiration) // Safe to ignore: cache failures are non-critical
 }
 
 // Get retrieves cached claims for a token.
@@ -355,8 +360,13 @@ func (t *TraefikOidc) handleLogout(rw http.ResponseWriter, req *http.Request) {
 		postLogoutRedirectURI = fmt.Sprintf("%s%s", baseURL, postLogoutRedirectURI)
 	}
 
-	if t.endSessionURL != "" && idToken != "" {
-		logoutURL, err := BuildLogoutURL(t.endSessionURL, idToken, postLogoutRedirectURI)
+	// Read endSessionURL with RLock
+	t.metadataMu.RLock()
+	endSessionURL := t.endSessionURL
+	t.metadataMu.RUnlock()
+
+	if endSessionURL != "" && idToken != "" {
+		logoutURL, err := BuildLogoutURL(endSessionURL, idToken, postLogoutRedirectURI)
 		if err != nil {
 			t.logger.Errorf("Failed to build logout URL: %v", err)
 			http.Error(rw, "Logout error", http.StatusInternalServerError)

http_client_factory.go

@@ -245,7 +245,7 @@ func (f *HTTPClientFactory) CreateHTTPClient(config HTTPClientConfig) *http.Clie
 
 	// Add cookie jar if requested
 	if config.UseCookieJar {
-		jar, _ := cookiejar.New(nil)
+		jar, _ := cookiejar.New(nil) // Safe to ignore: cookiejar creation with nil options rarely fails
 		client.Jar = jar
 	}
 

http_client_factory_unit_test.go

@@ -0,0 +1,210 @@
+package traefikoidc
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestOIDCProviderHTTPClientConfigUnit tests OIDCProviderHTTPClientConfig function
+func TestOIDCProviderHTTPClientConfigUnit(t *testing.T) {
+	config := OIDCProviderHTTPClientConfig()
+
+	// Verify OIDC-specific settings
+	assert.Equal(t, 15*time.Second, config.Timeout, "OIDC provider should have 15s timeout")
+	assert.Equal(t, 100, config.MaxIdleConns, "OIDC provider should have 100 max idle conns")
+	assert.Equal(t, 25, config.MaxIdleConnsPerHost, "OIDC provider should have 25 max idle conns per host")
+	assert.Equal(t, 50, config.MaxConnsPerHost, "OIDC provider should have 50 max conns per host")
+	assert.Equal(t, 90*time.Second, config.IdleConnTimeout, "OIDC provider should have 90s idle conn timeout")
+	assert.True(t, config.UseCookieJar, "OIDC provider should have cookie jar enabled")
+}
+
+// TestCreateDefaultClientUnit tests CreateDefaultClient function
+func TestCreateDefaultClientUnit(t *testing.T) {
+	factory := NewHTTPClientFactory()
+	client := factory.CreateDefaultClient()
+
+	require.NotNil(t, client)
+	assert.NotNil(t, client.Transport, "client should have transport")
+	assert.Equal(t, 10*time.Second, client.Timeout, "default client should have 10s timeout")
+}
+
+// TestCreateTokenClientUnit tests CreateTokenClient function
+func TestCreateTokenClientUnit(t *testing.T) {
+	factory := NewHTTPClientFactory()
+	client := factory.CreateTokenClient()
+
+	require.NotNil(t, client)
+	assert.NotNil(t, client.Transport, "client should have transport")
+	assert.NotNil(t, client.Jar, "token client should have cookie jar")
+	assert.Equal(t, 10*time.Second, client.Timeout, "token client should have 10s timeout")
+}
+
+// TestCreateHTTPClientWithConfigUnit tests CreateHTTPClientWithConfig function
+func TestCreateHTTPClientWithConfigUnit(t *testing.T) {
+	config := HTTPClientConfig{
+		Timeout:             5 * time.Second,
+		MaxIdleConns:        20,
+		MaxIdleConnsPerHost: 5,
+		UseCookieJar:        true,
+	}
+
+	client := CreateHTTPClientWithConfig(config)
+
+	require.NotNil(t, client)
+	assert.Equal(t, 5*time.Second, client.Timeout)
+	assert.NotNil(t, client.Jar, "client should have cookie jar when configured")
+}
+
+// TestHTTPClientFactoryCreateHTTPClientValidation tests validation in CreateHTTPClient
+func TestHTTPClientFactoryCreateHTTPClientValidation(t *testing.T) {
+	factory := NewHTTPClientFactory()
+
+	t.Run("zero values get defaults", func(t *testing.T) {
+		config := HTTPClientConfig{
+			// All zero values
+		}
+
+		client := factory.CreateHTTPClient(config)
+
+		require.NotNil(t, client)
+		// Verify defaults were applied
+		assert.Equal(t, 30*time.Second, client.Timeout)
+	})
+
+	t.Run("custom values preserved", func(t *testing.T) {
+		config := HTTPClientConfig{
+			Timeout:           15 * time.Second,
+			MaxIdleConns:      50,
+			MaxRedirects:      3,
+			UseCookieJar:      true,
+			ForceHTTP2:        true,
+			DisableKeepAlives: true,
+		}
+
+		client := factory.CreateHTTPClient(config)
+
+		require.NotNil(t, client)
+		assert.Equal(t, 15*time.Second, client.Timeout)
+		assert.NotNil(t, client.Jar)
+	})
+
+	t.Run("invalid timeout gets default", func(t *testing.T) {
+		config := HTTPClientConfig{
+			Timeout: -1 * time.Second, // Invalid
+		}
+
+		client := factory.CreateHTTPClient(config)
+
+		require.NotNil(t, client)
+		// Should get default due to validation failure
+		assert.Equal(t, 30*time.Second, client.Timeout)
+	})
+}
+
+// TestHTTPClientFactoryValidateHTTPClientConfig tests ValidateHTTPClientConfig
+func TestHTTPClientFactoryValidateHTTPClientConfig(t *testing.T) {
+	factory := NewHTTPClientFactory()
+
+	tests := []struct {
+		name      string
+		config    HTTPClientConfig
+		wantError bool
+		errorMsg  string
+	}{
+		{
+			name: "valid config",
+			config: HTTPClientConfig{
+				Timeout:             10 * time.Second,
+				DialTimeout:         5 * time.Second,
+				TLSHandshakeTimeout: 2 * time.Second,
+				MaxIdleConns:        50,
+				MaxIdleConnsPerHost: 10,
+				MaxConnsPerHost:     20,
+			},
+			wantError: false,
+		},
+		{
+			name: "negative MaxIdleConns",
+			config: HTTPClientConfig{
+				Timeout:             10 * time.Second,
+				DialTimeout:         5 * time.Second,
+				TLSHandshakeTimeout: 2 * time.Second,
+				MaxIdleConns:        -1,
+			},
+			wantError: true,
+			errorMsg:  "MaxIdleConns cannot be negative",
+		},
+		{
+			name: "MaxIdleConns too high",
+			config: HTTPClientConfig{
+				Timeout:             10 * time.Second,
+				DialTimeout:         5 * time.Second,
+				TLSHandshakeTimeout: 2 * time.Second,
+				MaxIdleConns:        1500,
+			},
+			wantError: true,
+			errorMsg:  "MaxIdleConns too high",
+		},
+		{
+			name: "negative MaxIdleConnsPerHost",
+			config: HTTPClientConfig{
+				Timeout:             10 * time.Second,
+				DialTimeout:         5 * time.Second,
+				TLSHandshakeTimeout: 2 * time.Second,
+				MaxIdleConnsPerHost: -1,
+			},
+			wantError: true,
+			errorMsg:  "MaxIdleConnsPerHost cannot be negative",
+		},
+		{
+			name: "timeout too high",
+			config: HTTPClientConfig{
+				Timeout:             10 * time.Minute,
+				DialTimeout:         5 * time.Second,
+				TLSHandshakeTimeout: 2 * time.Second,
+			},
+			wantError: true,
+			errorMsg:  "timeout too high",
+		},
+		{
+			name: "negative timeout",
+			config: HTTPClientConfig{
+				Timeout:             -1 * time.Second,
+				DialTimeout:         5 * time.Second,
+				TLSHandshakeTimeout: 2 * time.Second,
+			},
+			wantError: true,
+			errorMsg:  "timeout must be positive",
+		},
+		{
+			name: "MaxIdleConnsPerHost exceeds MaxConnsPerHost",
+			config: HTTPClientConfig{
+				Timeout:             10 * time.Second,
+				DialTimeout:         5 * time.Second,
+				TLSHandshakeTimeout: 2 * time.Second,
+				MaxIdleConnsPerHost: 50,
+				MaxConnsPerHost:     10,
+			},
+			wantError: true,
+			errorMsg:  "MaxIdleConnsPerHost (50) cannot exceed MaxConnsPerHost (10)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := factory.ValidateHTTPClientConfig(&tt.config)
+
+			if tt.wantError {
+				assert.Error(t, err)
+				if tt.errorMsg != "" {
+					assert.Contains(t, err.Error(), tt.errorMsg)
+				}
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}

http_client_pool_test.go

@@ -0,0 +1,691 @@
+package traefikoidc
+
+import (
+	"context"
+	"net/http"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSharedTransportPoolGetOrCreateTransport tests transport creation and reuse
+func TestSharedTransportPoolGetOrCreateTransport(t *testing.T) {
+	t.Run("create new transport", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+		}
+
+		config := DefaultHTTPClientConfig()
+		transport := pool.GetOrCreateTransport(config)
+
+		require.NotNil(t, transport)
+		assert.Equal(t, int32(1), atomic.LoadInt32(&pool.clientCount))
+		assert.Len(t, pool.transports, 1)
+	})
+
+	t.Run("reuse existing transport", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+		}
+
+		config := DefaultHTTPClientConfig()
+		transport1 := pool.GetOrCreateTransport(config)
+		transport2 := pool.GetOrCreateTransport(config)
+
+		assert.Equal(t, transport1, transport2, "should reuse same transport")
+		assert.Equal(t, int32(1), atomic.LoadInt32(&pool.clientCount), "client count should not increase")
+
+		// Check ref count
+		pool.mu.RLock()
+		key := pool.configKey(config)
+		shared := pool.transports[key]
+		pool.mu.RUnlock()
+
+		assert.Equal(t, 2, shared.refCount, "ref count should be 2")
+	})
+
+	t.Run("client limit enforcement", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 5, // Already at max
+			maxClients:  5,
+		}
+
+		config := DefaultHTTPClientConfig()
+		transport := pool.GetOrCreateTransport(config)
+
+		assert.Nil(t, transport, "should return nil when at client limit")
+	})
+
+	t.Run("client limit with existing transport", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+		}
+
+		// Create first transport
+		config1 := DefaultHTTPClientConfig()
+		transport1 := pool.GetOrCreateTransport(config1)
+		require.NotNil(t, transport1)
+
+		// Set client count to max
+		atomic.StoreInt32(&pool.clientCount, 5)
+
+		// Try to create with different config
+		config2 := DefaultHTTPClientConfig()
+		config2.MaxConnsPerHost = 15 // Different config
+		transport2 := pool.GetOrCreateTransport(config2)
+
+		// Should return existing transport since at limit
+		assert.NotNil(t, transport2)
+		assert.Equal(t, transport1, transport2)
+	})
+
+	t.Run("updates last used time", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+		}
+
+		config := DefaultHTTPClientConfig()
+		transport := pool.GetOrCreateTransport(config)
+		require.NotNil(t, transport)
+
+		pool.mu.RLock()
+		key := pool.configKey(config)
+		firstTime := pool.transports[key].lastUsed
+		pool.mu.RUnlock()
+
+		time.Sleep(10 * time.Millisecond)
+
+		// Get again
+		transport2 := pool.GetOrCreateTransport(config)
+		require.NotNil(t, transport2)
+
+		pool.mu.RLock()
+		secondTime := pool.transports[key].lastUsed
+		pool.mu.RUnlock()
+
+		assert.True(t, secondTime.After(firstTime), "lastUsed should be updated")
+	})
+}
+
+// TestSharedTransportPoolReleaseTransport tests transport release
+func TestSharedTransportPoolReleaseTransport(t *testing.T) {
+	t.Run("decrement ref count", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+		}
+
+		config := DefaultHTTPClientConfig()
+		transport := pool.GetOrCreateTransport(config)
+		require.NotNil(t, transport)
+
+		// Get again to increase ref count
+		pool.GetOrCreateTransport(config)
+
+		pool.mu.RLock()
+		key := pool.configKey(config)
+		refCount := pool.transports[key].refCount
+		pool.mu.RUnlock()
+		assert.Equal(t, 2, refCount)
+
+		// Release
+		pool.ReleaseTransport(transport)
+
+		pool.mu.RLock()
+		newRefCount := pool.transports[key].refCount
+		pool.mu.RUnlock()
+		assert.Equal(t, 1, newRefCount)
+	})
+
+	t.Run("ref count reaches zero", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+		}
+
+		config := DefaultHTTPClientConfig()
+		transport := pool.GetOrCreateTransport(config)
+		require.NotNil(t, transport)
+
+		pool.mu.RLock()
+		key := pool.configKey(config)
+		pool.mu.RUnlock()
+
+		// Release to zero
+		pool.ReleaseTransport(transport)
+
+		pool.mu.RLock()
+		shared := pool.transports[key]
+		pool.mu.RUnlock()
+
+		assert.Equal(t, 0, shared.refCount)
+		assert.NotZero(t, shared.lastUsed, "lastUsed should be set")
+	})
+
+	t.Run("release non-existent transport", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+		}
+
+		// Create a transport not in the pool
+		fakeTransport := &http.Transport{}
+
+		// Should not panic
+		assert.NotPanics(t, func() {
+			pool.ReleaseTransport(fakeTransport)
+		})
+	})
+
+	t.Run("release updates last used", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+		}
+
+		config := DefaultHTTPClientConfig()
+		transport := pool.GetOrCreateTransport(config)
+		require.NotNil(t, transport)
+
+		time.Sleep(10 * time.Millisecond)
+
+		beforeRelease := time.Now()
+		pool.ReleaseTransport(transport)
+
+		pool.mu.RLock()
+		key := pool.configKey(config)
+		lastUsed := pool.transports[key].lastUsed
+		pool.mu.RUnlock()
+
+		assert.True(t, lastUsed.After(beforeRelease) || lastUsed.Equal(beforeRelease))
+	})
+}
+
+// TestSharedTransportPoolCleanup tests cleanup functionality
+func TestSharedTransportPoolCleanup(t *testing.T) {
+	t.Run("cleanup all transports", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+			ctx:         ctx,
+			cancel:      cancel,
+		}
+
+		// Create multiple transports
+		config1 := DefaultHTTPClientConfig()
+		pool.GetOrCreateTransport(config1)
+
+		config2 := DefaultHTTPClientConfig()
+		config2.MaxConnsPerHost = 15
+		pool.GetOrCreateTransport(config2)
+
+		assert.Greater(t, len(pool.transports), 0)
+
+		// Cleanup
+		pool.Cleanup()
+
+		assert.Len(t, pool.transports, 0, "all transports should be removed")
+	})
+
+	t.Run("cleanup cancels context", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+			ctx:         ctx,
+			cancel:      cancel,
+		}
+
+		pool.Cleanup()
+
+		select {
+		case <-pool.ctx.Done():
+			// Context was canceled
+		case <-time.After(100 * time.Millisecond):
+			t.Error("context should be canceled")
+		}
+	})
+
+	t.Run("cleanup with no transports", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+			ctx:         ctx,
+			cancel:      cancel,
+		}
+
+		assert.NotPanics(t, func() {
+			pool.Cleanup()
+		})
+	})
+
+	t.Run("cleanup closes idle connections", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+			ctx:         ctx,
+			cancel:      cancel,
+		}
+
+		config := DefaultHTTPClientConfig()
+		transport := pool.GetOrCreateTransport(config)
+		require.NotNil(t, transport)
+
+		// Cleanup should call CloseIdleConnections on each transport
+		pool.Cleanup()
+
+		// Verify transports map is cleared
+		assert.Empty(t, pool.transports)
+	})
+}
+
+// TestSharedTransportPoolCleanupIdleTransports tests periodic cleanup
+func TestSharedTransportPoolCleanupIdleTransports(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping cleanup goroutine test in short mode")
+	}
+
+	t.Run("cleanup removes idle transports", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+			ctx:         ctx,
+			cancel:      cancel,
+		}
+
+		// Create transport and release it
+		config := DefaultHTTPClientConfig()
+		transport := pool.GetOrCreateTransport(config)
+		require.NotNil(t, transport)
+
+		pool.ReleaseTransport(transport)
+
+		// Set lastUsed to old time
+		pool.mu.Lock()
+		key := pool.configKey(config)
+		pool.transports[key].lastUsed = time.Now().Add(-3 * time.Minute)
+		pool.mu.Unlock()
+
+		// Start cleanup in background (simulating what would happen)
+		// Note: We're testing the cleanup logic manually here
+		pool.mu.Lock()
+		now := time.Now()
+		for transportKey, shared := range pool.transports {
+			if shared.refCount <= 0 && now.Sub(shared.lastUsed) > 2*time.Minute {
+				shared.transport.CloseIdleConnections()
+				delete(pool.transports, transportKey)
+				atomic.AddInt32(&pool.clientCount, -1)
+			}
+		}
+		pool.mu.Unlock()
+
+		// Transport should be removed
+		pool.mu.RLock()
+		_, exists := pool.transports[key]
+		pool.mu.RUnlock()
+
+		assert.False(t, exists, "old idle transport should be removed")
+	})
+
+	t.Run("cleanup preserves active transports", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+			ctx:         ctx,
+			cancel:      cancel,
+		}
+
+		// Create transport with refs
+		config := DefaultHTTPClientConfig()
+		transport := pool.GetOrCreateTransport(config)
+		require.NotNil(t, transport)
+
+		// Keep ref count > 0, but set old lastUsed
+		pool.mu.Lock()
+		key := pool.configKey(config)
+		pool.transports[key].lastUsed = time.Now().Add(-3 * time.Minute)
+		pool.mu.Unlock()
+
+		// Run cleanup logic
+		pool.mu.Lock()
+		now := time.Now()
+		for transportKey, shared := range pool.transports {
+			if shared.refCount <= 0 && now.Sub(shared.lastUsed) > 2*time.Minute {
+				shared.transport.CloseIdleConnections()
+				delete(pool.transports, transportKey)
+			}
+		}
+		pool.mu.Unlock()
+
+		// Transport should still exist (has ref count)
+		pool.mu.RLock()
+		_, exists := pool.transports[key]
+		pool.mu.RUnlock()
+
+		assert.True(t, exists, "transport with references should be preserved")
+	})
+
+	t.Run("cleanup respects context cancellation", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+			ctx:         ctx,
+			cancel:      cancel,
+		}
+
+		// Start cleanup goroutine
+		done := make(chan bool)
+		go func() {
+			pool.cleanupIdleTransports(ctx)
+			done <- true
+		}()
+
+		// Cancel context
+		cancel()
+
+		// Should exit quickly
+		select {
+		case <-done:
+			// Success
+		case <-time.After(2 * time.Second):
+			t.Error("cleanup goroutine should exit on context cancellation")
+		}
+	})
+}
+
+// TestCreatePooledHTTPClient tests pooled client creation
+func TestCreatePooledHTTPClient(t *testing.T) {
+	t.Run("create client with default config", func(t *testing.T) {
+		config := DefaultHTTPClientConfig()
+		client := CreatePooledHTTPClient(config)
+
+		require.NotNil(t, client)
+		assert.NotNil(t, client.Transport)
+		assert.Equal(t, config.Timeout, client.Timeout)
+	})
+
+	t.Run("create multiple clients reuse transport", func(t *testing.T) {
+		// Reset global pool for clean test
+		globalTransportPoolOnce = sync.Once{}
+		globalTransportPool = nil
+
+		config := DefaultHTTPClientConfig()
+		client1 := CreatePooledHTTPClient(config)
+		client2 := CreatePooledHTTPClient(config)
+
+		require.NotNil(t, client1)
+		require.NotNil(t, client2)
+
+		// Should use same transport
+		assert.Equal(t, client1.Transport, client2.Transport)
+	})
+
+	t.Run("redirect policy is set", func(t *testing.T) {
+		config := DefaultHTTPClientConfig()
+		config.MaxRedirects = 3
+
+		client := CreatePooledHTTPClient(config)
+
+		require.NotNil(t, client)
+		assert.NotNil(t, client.CheckRedirect)
+
+		// Test redirect limit
+		var redirects []*http.Request
+		for i := 0; i < 3; i++ {
+			redirects = append(redirects, &http.Request{})
+		}
+
+		err := client.CheckRedirect(nil, redirects)
+		assert.Error(t, err, "should error after max redirects")
+	})
+
+	t.Run("default redirect limit", func(t *testing.T) {
+		config := DefaultHTTPClientConfig()
+		config.MaxRedirects = 0 // Should default to 10
+
+		client := CreatePooledHTTPClient(config)
+
+		require.NotNil(t, client)
+
+		// Test default redirect limit (10)
+		var redirects []*http.Request
+		for i := 0; i < 10; i++ {
+			redirects = append(redirects, &http.Request{})
+		}
+
+		err := client.CheckRedirect(nil, redirects)
+		assert.Error(t, err, "should error after 10 redirects")
+	})
+}
+
+// TestGetGlobalTransportPool tests singleton pattern
+func TestGetGlobalTransportPool(t *testing.T) {
+	t.Run("returns same instance", func(t *testing.T) {
+		pool1 := GetGlobalTransportPool()
+		pool2 := GetGlobalTransportPool()
+
+		assert.Equal(t, pool1, pool2, "should return same singleton instance")
+	})
+
+	t.Run("pool is initialized", func(t *testing.T) {
+		pool := GetGlobalTransportPool()
+
+		require.NotNil(t, pool)
+		assert.NotNil(t, pool.transports)
+		assert.Equal(t, 20, pool.maxConns)
+		assert.Equal(t, int32(5), pool.maxClients)
+		assert.NotNil(t, pool.ctx)
+		assert.NotNil(t, pool.cancel)
+	})
+}
+
+// TestSharedTransportPoolConcurrency tests thread safety
+func TestSharedTransportPoolConcurrency(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping concurrency test in short mode")
+	}
+
+	t.Run("concurrent GetOrCreateTransport", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  10, // Allow more for concurrency test
+		}
+
+		config := DefaultHTTPClientConfig()
+		const numGoroutines = 20
+
+		var wg sync.WaitGroup
+		transports := make([]*http.Transport, numGoroutines)
+
+		for i := 0; i < numGoroutines; i++ {
+			wg.Add(1)
+			go func(idx int) {
+				defer wg.Done()
+				transports[idx] = pool.GetOrCreateTransport(config)
+			}(i)
+		}
+
+		wg.Wait()
+
+		// All should get same transport
+		firstTransport := transports[0]
+		for i := 1; i < numGoroutines; i++ {
+			if transports[i] != nil {
+				assert.Equal(t, firstTransport, transports[i])
+			}
+		}
+	})
+
+	t.Run("concurrent ReleaseTransport", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  10,
+		}
+
+		config := DefaultHTTPClientConfig()
+		transport := pool.GetOrCreateTransport(config)
+
+		// Increase ref count
+		for i := 0; i < 20; i++ {
+			pool.GetOrCreateTransport(config)
+		}
+
+		const numReleases = 20
+		var wg sync.WaitGroup
+
+		for i := 0; i < numReleases; i++ {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				pool.ReleaseTransport(transport)
+			}()
+		}
+
+		wg.Wait()
+
+		// Should not panic and ref count should be decremented
+		pool.mu.RLock()
+		key := pool.configKey(config)
+		refCount := pool.transports[key].refCount
+		pool.mu.RUnlock()
+
+		assert.Equal(t, 1, refCount, "ref count should be 1 after 20 releases from initial 21")
+	})
+}
+
+// TestSharedTransportPoolEdgeCases tests edge cases
+func TestSharedTransportPoolEdgeCases(t *testing.T) {
+	t.Run("config key generation", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports: make(map[string]*sharedTransport),
+		}
+
+		config1 := DefaultHTTPClientConfig()
+		config1.MaxConnsPerHost = 10
+		config1.MaxIdleConnsPerHost = 5
+
+		config2 := DefaultHTTPClientConfig()
+		config2.MaxConnsPerHost = 10
+		config2.MaxIdleConnsPerHost = 5
+
+		key1 := pool.configKey(config1)
+		key2 := pool.configKey(config2)
+
+		assert.Equal(t, key1, key2, "same config should produce same key")
+	})
+
+	t.Run("different configs produce different keys", func(t *testing.T) {
+		pool := &SharedTransportPool{
+			transports: make(map[string]*sharedTransport),
+		}
+
+		config1 := DefaultHTTPClientConfig()
+		config1.MaxConnsPerHost = 10
+
+		config2 := DefaultHTTPClientConfig()
+		config2.MaxConnsPerHost = 20
+
+		key1 := pool.configKey(config1)
+		key2 := pool.configKey(config2)
+
+		assert.NotEqual(t, key1, key2, "different configs should produce different keys")
+	})
+
+	t.Run("client count decrements on cleanup", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		pool := &SharedTransportPool{
+			transports:  make(map[string]*sharedTransport),
+			maxConns:    20,
+			clientCount: 0,
+			maxClients:  5,
+			ctx:         ctx,
+			cancel:      cancel,
+		}
+
+		config := DefaultHTTPClientConfig()
+		transport := pool.GetOrCreateTransport(config)
+		require.NotNil(t, transport)
+
+		initialCount := atomic.LoadInt32(&pool.clientCount)
+		assert.Equal(t, int32(1), initialCount)
+
+		// Release and mark as old
+		pool.ReleaseTransport(transport)
+		pool.mu.Lock()
+		key := pool.configKey(config)
+		pool.transports[key].lastUsed = time.Now().Add(-3 * time.Minute)
+		pool.mu.Unlock()
+
+		// Run cleanup
+		pool.mu.Lock()
+		now := time.Now()
+		for transportKey, shared := range pool.transports {
+			if shared.refCount <= 0 && now.Sub(shared.lastUsed) > 2*time.Minute {
+				shared.transport.CloseIdleConnections()
+				delete(pool.transports, transportKey)
+				atomic.AddInt32(&pool.clientCount, -1)
+			}
+		}
+		pool.mu.Unlock()
+
+		finalCount := atomic.LoadInt32(&pool.clientCount)
+		assert.Equal(t, int32(0), finalCount, "client count should decrement on cleanup")
+	})
+}

internal/cache/backends/config.go

@@ -0,0 +1,90 @@
+package backends
+
+import "time"
+
+// BackendType represents the type of cache backend
+type BackendType string
+
+const (
+	BackendTypeMemory BackendType = "memory"
+	BackendTypeRedis  BackendType = "redis"
+	BackendTypeHybrid BackendType = "hybrid"
+
+	// Aliases for backward compatibility
+	TypeMemory BackendType = "memory"
+	TypeRedis  BackendType = "redis"
+	TypeHybrid BackendType = "hybrid"
+)
+
+// Config provides common configuration for cache backends
+type Config struct {
+	// Type specifies the backend type
+	Type BackendType
+
+	// Memory backend settings
+	MaxSize         int
+	MaxMemoryBytes  int64
+	CleanupInterval time.Duration
+
+	// Redis backend settings
+	RedisAddr     string
+	RedisPassword string
+	RedisDB       int
+	RedisPrefix   string
+	PoolSize      int
+
+	// Hybrid backend settings
+	L1Config    *Config // Memory cache (L1)
+	L2Config    *Config // Redis cache (L2)
+	AsyncWrites bool    // Write to L2 asynchronously
+
+	// Resilience settings
+	EnableCircuitBreaker bool
+	EnableHealthCheck    bool
+	HealthCheckInterval  time.Duration
+
+	// Metrics
+	EnableMetrics bool
+}
+
+// DefaultConfig returns a default configuration for in-memory caching
+func DefaultConfig() *Config {
+	return &Config{
+		Type:            BackendTypeMemory,
+		MaxSize:         1000,
+		MaxMemoryBytes:  50 * 1024 * 1024, // 50MB
+		CleanupInterval: 5 * time.Minute,
+		EnableMetrics:   true,
+	}
+}
+
+// DefaultRedisConfig returns a default configuration for Redis caching
+func DefaultRedisConfig(addr string) *Config {
+	return &Config{
+		Type:                 BackendTypeRedis,
+		RedisAddr:            addr,
+		RedisDB:              0,
+		RedisPrefix:          "traefikoidc:",
+		PoolSize:             10,
+		EnableCircuitBreaker: true,
+		EnableHealthCheck:    true,
+		HealthCheckInterval:  30 * time.Second,
+		EnableMetrics:        true,
+	}
+}
+
+// DefaultHybridConfig returns a default configuration for hybrid caching
+func DefaultHybridConfig(redisAddr string) *Config {
+	return &Config{
+		Type: BackendTypeHybrid,
+		L1Config: &Config{
+			Type:            BackendTypeMemory,
+			MaxSize:         500,
+			MaxMemoryBytes:  10 * 1024 * 1024, // 10MB for L1
+			CleanupInterval: 1 * time.Minute,
+		},
+		L2Config:      DefaultRedisConfig(redisAddr),
+		AsyncWrites:   true,
+		EnableMetrics: true,
+	}
+}

internal/cache/backends/config_test.go

@@ -0,0 +1,59 @@
+//go:build !yaegi
+
+package backends
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestDefaultHybridConfig verifies the default hybrid configuration
+func TestDefaultHybridConfig(t *testing.T) {
+	redisAddr := "localhost:6379"
+
+	config := DefaultHybridConfig(redisAddr)
+
+	require.NotNil(t, config)
+
+	// Verify top-level config
+	assert.Equal(t, BackendTypeHybrid, config.Type)
+	assert.True(t, config.AsyncWrites)
+	assert.True(t, config.EnableMetrics)
+
+	// Verify L1 (memory) config
+	require.NotNil(t, config.L1Config)
+	assert.Equal(t, BackendTypeMemory, config.L1Config.Type)
+	assert.Equal(t, 500, config.L1Config.MaxSize)
+	assert.Equal(t, int64(10*1024*1024), config.L1Config.MaxMemoryBytes) // 10MB
+	assert.Equal(t, 1*time.Minute, config.L1Config.CleanupInterval)
+
+	// Verify L2 (Redis) config exists
+	require.NotNil(t, config.L2Config)
+	assert.Equal(t, BackendTypeRedis, config.L2Config.Type)
+}
+
+func TestDefaultHybridConfig_DifferentRedisAddr(t *testing.T) {
+	tests := []struct {
+		name      string
+		redisAddr string
+	}{
+		{"localhost", "localhost:6379"},
+		{"remote host", "redis.example.com:6379"},
+		{"IP address", "192.168.1.100:6379"},
+		{"custom port", "localhost:6380"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := DefaultHybridConfig(tt.redisAddr)
+
+			require.NotNil(t, config)
+			assert.Equal(t, BackendTypeHybrid, config.Type)
+			assert.NotNil(t, config.L1Config)
+			assert.NotNil(t, config.L2Config)
+		})
+	}
+}

internal/cache/backends/errors.go

@@ -0,0 +1,38 @@
+package backends
+
+import "errors"
+
+var (
+	// ErrBackendClosed is returned when operating on a closed backend
+	ErrBackendClosed = errors.New("cache backend is closed")
+
+	// ErrKeyNotFound is returned when a key doesn't exist
+	ErrKeyNotFound = errors.New("key not found")
+
+	// ErrCacheMiss indicates the requested key was not found in the cache
+	ErrCacheMiss = errors.New("cache miss")
+
+	// ErrBackendUnavailable indicates the cache backend is not available
+	ErrBackendUnavailable = errors.New("cache backend unavailable")
+
+	// ErrInvalidValue indicates the cached value is invalid or corrupted
+	ErrInvalidValue = errors.New("invalid cached value")
+
+	// ErrInvalidTTL is returned when TTL is invalid
+	ErrInvalidTTL = errors.New("invalid TTL")
+
+	// ErrConnectionFailed is returned when connection fails
+	ErrConnectionFailed = errors.New("connection failed")
+
+	// ErrCircuitOpen is returned when circuit breaker is open
+	ErrCircuitOpen = errors.New("circuit breaker is open")
+
+	// ErrTimeout is returned when operation times out
+	ErrTimeout = errors.New("operation timeout")
+
+	// ErrSerializationFailed is returned when serialization fails
+	ErrSerializationFailed = errors.New("serialization failed")
+
+	// ErrDeserializationFailed is returned when deserialization fails
+	ErrDeserializationFailed = errors.New("deserialization failed")
+)

internal/cache/backends/hybrid.go

@@ -0,0 +1,695 @@
+// Package backend provides cache backend implementations for the Traefik OIDC plugin.
+package backends
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// HybridBackend implements a two-tier cache with L1 (memory) and L2 (Redis) backends
+// It provides automatic failover, async writes for non-critical data, and optimized read paths
+type HybridBackend struct {
+	primary   CacheBackend // L1: Memory cache for fast access
+	secondary CacheBackend // L2: Redis cache for distributed access
+
+	// Configuration
+	syncWriteCacheTypes map[string]bool // Which cache types require synchronous writes
+	asyncWriteBuffer    chan *asyncWriteItem
+
+	// Metrics
+	l1Hits   atomic.Int64
+	l2Hits   atomic.Int64
+	misses   atomic.Int64
+	l1Writes atomic.Int64
+	l2Writes atomic.Int64
+	errors   atomic.Int64
+
+	// Fallback tracking
+	fallbackMode atomic.Bool  // True when operating in degraded mode (L1 only)
+	lastL2Error  atomic.Value // Stores last L2 error timestamp
+
+	// Lifecycle
+	ctx    context.Context
+	cancel context.CancelFunc
+	wg     sync.WaitGroup
+
+	// Logging
+	logger Logger
+}
+
+// asyncWriteItem represents an async write operation
+type asyncWriteItem struct {
+	key   string
+	value []byte
+	ttl   time.Duration
+	ctx   context.Context
+}
+
+// Logger interface for structured logging
+type Logger interface {
+	Debugf(format string, args ...interface{})
+	Infof(format string, args ...interface{})
+	Warnf(format string, args ...interface{})
+	Errorf(format string, args ...interface{})
+}
+
+// defaultLogger provides a basic logger implementation
+type defaultLogger struct {
+	*log.Logger
+}
+
+func (l *defaultLogger) Debugf(format string, args ...interface{}) {
+	l.Printf("[DEBUG] "+format, args...)
+}
+
+func (l *defaultLogger) Infof(format string, args ...interface{}) {
+	l.Printf("[INFO] "+format, args...)
+}
+
+func (l *defaultLogger) Warnf(format string, args ...interface{}) {
+	l.Printf("[WARN] "+format, args...)
+}
+
+func (l *defaultLogger) Errorf(format string, args ...interface{}) {
+	l.Printf("[ERROR] "+format, args...)
+}
+
+// HybridConfig provides configuration for the hybrid backend
+type HybridConfig struct {
+	Primary             CacheBackend
+	Secondary           CacheBackend
+	SyncWriteCacheTypes map[string]bool // Cache types requiring synchronous L2 writes
+	AsyncBufferSize     int
+	Logger              Logger
+}
+
+// NewHybridBackend creates a new hybrid cache backend with L1 (memory) and L2 (Redis) tiers
+func NewHybridBackend(config *HybridConfig) (*HybridBackend, error) {
+	if config == nil {
+		return nil, fmt.Errorf("config is required")
+	}
+
+	if config.Primary == nil {
+		return nil, fmt.Errorf("primary (L1) backend is required")
+	}
+
+	if config.Secondary == nil {
+		return nil, fmt.Errorf("secondary (L2) backend is required")
+	}
+
+	if config.Logger == nil {
+		config.Logger = &defaultLogger{Logger: log.New(log.Writer(), "[HybridCache] ", log.LstdFlags)}
+	}
+
+	if config.AsyncBufferSize <= 0 {
+		config.AsyncBufferSize = 1000
+	}
+
+	// Default critical cache types that require synchronous writes
+	if config.SyncWriteCacheTypes == nil {
+		config.SyncWriteCacheTypes = map[string]bool{
+			"blacklist": true, // Token blacklist must be immediately consistent
+			"token":     true, // Token validation is critical
+		}
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	h := &HybridBackend{
+		primary:             config.Primary,
+		secondary:           config.Secondary,
+		syncWriteCacheTypes: config.SyncWriteCacheTypes,
+		asyncWriteBuffer:    make(chan *asyncWriteItem, config.AsyncBufferSize),
+		ctx:                 ctx,
+		cancel:              cancel,
+		logger:              config.Logger,
+	}
+
+	// Start async write worker
+	h.wg.Add(1)
+	go h.asyncWriteWorker()
+
+	// Start health monitoring
+	h.wg.Add(1)
+	go h.healthMonitor()
+
+	h.logger.Infof("HybridBackend initialized with L1 (memory) and L2 (Redis) tiers")
+	h.logger.Infof("Sync write cache types: %v", config.SyncWriteCacheTypes)
+	h.logger.Infof("Async write buffer size: %d", config.AsyncBufferSize)
+
+	return h, nil
+}
+
+// Set stores a value in both L1 and L2 caches
+func (h *HybridBackend) Set(ctx context.Context, key string, value []byte, ttl time.Duration) error {
+	// Always write to L1 first (synchronous)
+	if err := h.primary.Set(ctx, key, value, ttl); err != nil {
+		h.errors.Add(1)
+		h.logger.Warnf("Failed to write to L1 cache: %v", err)
+		// Continue to try L2 even if L1 fails
+	} else {
+		h.l1Writes.Add(1)
+	}
+
+	// Check if we're in fallback mode
+	if h.fallbackMode.Load() {
+		h.logger.Debugf("Operating in fallback mode, skipping L2 write for key: %s", key)
+		return nil // Don't fail the operation if L2 is down
+	}
+
+	// Determine if this should be a sync or async write based on cache type
+	cacheType := h.extractCacheType(key)
+	requiresSync := h.syncWriteCacheTypes[cacheType]
+
+	if requiresSync {
+		// Synchronous write for critical cache types
+		if err := h.secondary.Set(ctx, key, value, ttl); err != nil {
+			h.errors.Add(1)
+			h.logger.Warnf("Failed to write to L2 cache (sync) for key %s: %v", key, err)
+			h.recordL2Error()
+			// Don't fail the operation - L1 write succeeded
+			return nil
+		}
+		h.l2Writes.Add(1)
+		h.logger.Debugf("Synchronous write to L2 completed for critical key: %s", key)
+	} else {
+		// Asynchronous write for non-critical cache types
+		select {
+		case h.asyncWriteBuffer <- &asyncWriteItem{
+			key:   key,
+			value: value,
+			ttl:   ttl,
+			ctx:   ctx,
+		}:
+			h.logger.Debugf("Queued async write to L2 for key: %s", key)
+		default:
+			// Buffer is full, log and continue
+			h.logger.Warnf("Async write buffer full, dropping L2 write for key: %s", key)
+			h.errors.Add(1)
+		}
+	}
+
+	return nil
+}
+
+// Get retrieves a value from cache, checking L1 first, then L2
+func (h *HybridBackend) Get(ctx context.Context, key string) ([]byte, time.Duration, bool, error) {
+	// Try L1 first
+	value, ttl, exists, err := h.primary.Get(ctx, key)
+	if err != nil {
+		h.errors.Add(1)
+		h.logger.Debugf("L1 get error for key %s: %v", key, err)
+	}
+
+	if exists {
+		h.l1Hits.Add(1)
+		return value, ttl, true, nil
+	}
+
+	// Check if we're in fallback mode
+	if h.fallbackMode.Load() {
+		h.misses.Add(1)
+		return nil, 0, false, nil
+	}
+
+	// Try L2
+	value, ttl, exists, err = h.secondary.Get(ctx, key)
+	if err != nil {
+		h.errors.Add(1)
+		h.logger.Debugf("L2 get error for key %s: %v", key, err)
+		h.recordL2Error()
+		h.misses.Add(1)
+		return nil, 0, false, nil // Don't propagate L2 errors
+	}
+
+	if !exists {
+		h.misses.Add(1)
+		return nil, 0, false, nil
+	}
+
+	h.l2Hits.Add(1)
+
+	// Populate L1 cache with value from L2 (write-through on read)
+	// Use goroutine to avoid blocking the read path
+	go func() {
+		writeCtx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+		defer cancel()
+
+		if err := h.primary.Set(writeCtx, key, value, ttl); err != nil {
+			h.logger.Debugf("Failed to populate L1 cache from L2 for key %s: %v", key, err)
+		} else {
+			h.logger.Debugf("Populated L1 cache from L2 for key: %s", key)
+		}
+	}()
+
+	return value, ttl, true, nil
+}
+
+// Delete removes a key from both L1 and L2 caches
+func (h *HybridBackend) Delete(ctx context.Context, key string) (bool, error) {
+	var deleted bool
+
+	// Delete from L1
+	if d, err := h.primary.Delete(ctx, key); err != nil {
+		h.logger.Debugf("Failed to delete from L1 cache: %v", err)
+	} else if d {
+		deleted = true
+	}
+
+	// Delete from L2 if not in fallback mode
+	if !h.fallbackMode.Load() {
+		if d, err := h.secondary.Delete(ctx, key); err != nil {
+			h.logger.Debugf("Failed to delete from L2 cache: %v", err)
+			h.recordL2Error()
+		} else if d {
+			deleted = true
+		}
+	}
+
+	return deleted, nil
+}
+
+// Exists checks if a key exists in either cache
+func (h *HybridBackend) Exists(ctx context.Context, key string) (bool, error) {
+	// Check L1 first
+	if exists, err := h.primary.Exists(ctx, key); err == nil && exists {
+		return true, nil
+	}
+
+	// Check L2 if not in fallback mode
+	if !h.fallbackMode.Load() {
+		if exists, err := h.secondary.Exists(ctx, key); err == nil && exists {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+// Clear removes all keys from both caches
+func (h *HybridBackend) Clear(ctx context.Context) error {
+	var lastErr error
+
+	// Clear L1
+	if err := h.primary.Clear(ctx); err != nil {
+		h.logger.Errorf("Failed to clear L1 cache: %v", err)
+		lastErr = err
+	}
+
+	// Clear L2 if not in fallback mode
+	if !h.fallbackMode.Load() {
+		if err := h.secondary.Clear(ctx); err != nil {
+			h.logger.Errorf("Failed to clear L2 cache: %v", err)
+			h.recordL2Error()
+			lastErr = err
+		}
+	}
+
+	return lastErr
+}
+
+// GetStats returns statistics for the hybrid cache
+func (h *HybridBackend) GetStats() map[string]interface{} {
+	l1Hits := h.l1Hits.Load()
+	l2Hits := h.l2Hits.Load()
+	misses := h.misses.Load()
+	total := l1Hits + l2Hits + misses
+
+	stats := map[string]interface{}{
+		"type":          TypeHybrid,
+		"l1_hits":       l1Hits,
+		"l2_hits":       l2Hits,
+		"misses":        misses,
+		"total":         total,
+		"l1_writes":     h.l1Writes.Load(),
+		"l2_writes":     h.l2Writes.Load(),
+		"errors":        h.errors.Load(),
+		"fallback_mode": h.fallbackMode.Load(),
+	}
+
+	if total > 0 {
+		stats["l1_hit_rate"] = float64(l1Hits) / float64(total)
+		stats["l2_hit_rate"] = float64(l2Hits) / float64(total)
+		stats["overall_hit_rate"] = float64(l1Hits+l2Hits) / float64(total)
+	}
+
+	// Add sub-backend stats
+	stats["l1_stats"] = h.primary.GetStats()
+	stats["l2_stats"] = h.secondary.GetStats()
+
+	// Add last L2 error time if available
+	if lastErr := h.lastL2Error.Load(); lastErr != nil {
+		if t, ok := lastErr.(time.Time); ok {
+			stats["last_l2_error"] = t.Format(time.RFC3339)
+			stats["seconds_since_l2_error"] = time.Since(t).Seconds()
+		}
+	}
+
+	return stats
+}
+
+// Ping checks if both backends are healthy
+func (h *HybridBackend) Ping(ctx context.Context) error {
+	// Check L1
+	if err := h.primary.Ping(ctx); err != nil {
+		return fmt.Errorf("L1 ping failed: %w", err)
+	}
+
+	// Check L2 (but don't fail if it's down)
+	if err := h.secondary.Ping(ctx); err != nil {
+		h.logger.Warnf("L2 ping failed: %v", err)
+		h.recordL2Error()
+		// Don't return error - we can operate with L1 only
+	} else {
+		// L2 is healthy, clear fallback mode if it was set
+		if h.fallbackMode.CompareAndSwap(true, false) {
+			h.logger.Infof("L2 backend recovered, exiting fallback mode")
+		}
+	}
+
+	return nil
+}
+
+// Close shuts down the hybrid backend
+func (h *HybridBackend) Close() error {
+	// Cancel context to stop workers
+	h.cancel()
+
+	// Close async write channel
+	close(h.asyncWriteBuffer)
+
+	// Wait for workers to finish with timeout
+	done := make(chan struct{})
+	go func() {
+		h.wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// Workers finished
+	case <-time.After(5 * time.Second):
+		h.logger.Warnf("Timeout waiting for workers to finish")
+	}
+
+	var lastErr error
+
+	// Close backends
+	if err := h.primary.Close(); err != nil {
+		h.logger.Errorf("Failed to close L1 backend: %v", err)
+		lastErr = err
+	}
+
+	if err := h.secondary.Close(); err != nil {
+		h.logger.Errorf("Failed to close L2 backend: %v", err)
+		lastErr = err
+	}
+
+	h.logger.Infof("HybridBackend closed")
+
+	return lastErr
+}
+
+// GetMany retrieves multiple values efficiently
+func (h *HybridBackend) GetMany(ctx context.Context, keys []string) (map[string][]byte, error) {
+	if len(keys) == 0 {
+		return make(map[string][]byte), nil
+	}
+
+	results := make(map[string][]byte, len(keys))
+	missingKeys := make([]string, 0)
+
+	// Try L1 first for all keys
+	for _, key := range keys {
+		if value, _, exists, _ := h.primary.Get(ctx, key); exists {
+			results[key] = value
+			h.l1Hits.Add(1)
+		} else {
+			missingKeys = append(missingKeys, key)
+		}
+	}
+
+	// If all found in L1 or in fallback mode, return
+	if len(missingKeys) == 0 || h.fallbackMode.Load() {
+		return results, nil
+	}
+
+	// Try L2 for missing keys using batch operation if available
+	if batcher, ok := h.secondary.(interface {
+		GetMany(context.Context, []string) (map[string][]byte, error)
+	}); ok {
+		l2Results, err := batcher.GetMany(ctx, missingKeys)
+		if err != nil {
+			h.logger.Debugf("L2 batch get error: %v", err)
+			h.recordL2Error()
+		} else {
+			for key, value := range l2Results {
+				results[key] = value
+				h.l2Hits.Add(1)
+
+				// Asynchronously populate L1
+				go func(k string, v []byte) {
+					writeCtx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+					defer cancel()
+					_ = h.primary.Set(writeCtx, k, v, 0) // Use default TTL
+				}(key, value)
+			}
+		}
+	} else {
+		// Fallback to individual gets
+		for _, key := range missingKeys {
+			if value, ttl, exists, err := h.secondary.Get(ctx, key); err == nil && exists {
+				results[key] = value
+				h.l2Hits.Add(1)
+
+				// Asynchronously populate L1
+				go func(k string, v []byte, t time.Duration) {
+					writeCtx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+					defer cancel()
+					_ = h.primary.Set(writeCtx, k, v, t)
+				}(key, value, ttl)
+			}
+		}
+	}
+
+	// Count misses for keys not found anywhere
+	for _, key := range keys {
+		if _, found := results[key]; !found {
+			h.misses.Add(1)
+		}
+	}
+
+	return results, nil
+}
+
+// SetMany stores multiple key-value pairs efficiently
+func (h *HybridBackend) SetMany(ctx context.Context, items map[string][]byte, ttl time.Duration) error {
+	if len(items) == 0 {
+		return nil
+	}
+
+	// Write to L1 first
+	for key, value := range items {
+		if err := h.primary.Set(ctx, key, value, ttl); err != nil {
+			h.logger.Debugf("Failed to write to L1 in batch: %v", err)
+		} else {
+			h.l1Writes.Add(1)
+		}
+	}
+
+	// Skip L2 if in fallback mode
+	if h.fallbackMode.Load() {
+		return nil
+	}
+
+	// Check if L2 supports batch operations
+	if batcher, ok := h.secondary.(interface {
+		SetMany(context.Context, map[string][]byte, time.Duration) error
+	}); ok {
+		if err := batcher.SetMany(ctx, items, ttl); err != nil {
+			h.logger.Warnf("Failed to batch write to L2: %v", err)
+			h.recordL2Error()
+		} else {
+			h.l2Writes.Add(int64(len(items)))
+		}
+	} else {
+		// Fallback to individual sets
+		for key, value := range items {
+			cacheType := h.extractCacheType(key)
+			if h.syncWriteCacheTypes[cacheType] {
+				// Sync write for critical types
+				if err := h.secondary.Set(ctx, key, value, ttl); err != nil {
+					h.logger.Debugf("Failed to write to L2: %v", err)
+					h.recordL2Error()
+				} else {
+					h.l2Writes.Add(1)
+				}
+			} else {
+				// Async write for non-critical types
+				select {
+				case h.asyncWriteBuffer <- &asyncWriteItem{
+					key:   key,
+					value: value,
+					ttl:   ttl,
+					ctx:   ctx,
+				}:
+					// Queued
+				default:
+					h.logger.Warnf("Async buffer full for batch write")
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+// asyncWriteWorker processes asynchronous writes to L2
+func (h *HybridBackend) asyncWriteWorker() {
+	defer h.wg.Done()
+
+	for {
+		select {
+		case <-h.ctx.Done():
+			// Drain remaining items with best effort
+			for len(h.asyncWriteBuffer) > 0 {
+				select {
+				case item := <-h.asyncWriteBuffer:
+					ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+					_ = h.secondary.Set(ctx, item.key, item.value, item.ttl)
+					cancel()
+				default:
+					return
+				}
+			}
+			return
+
+		case item, ok := <-h.asyncWriteBuffer:
+			if !ok {
+				return
+			}
+
+			// Skip if in fallback mode
+			if h.fallbackMode.Load() {
+				continue
+			}
+
+			// Perform the write with a timeout
+			writeCtx, cancel := context.WithTimeout(item.ctx, 500*time.Millisecond)
+			if err := h.secondary.Set(writeCtx, item.key, item.value, item.ttl); err != nil {
+				h.errors.Add(1)
+				h.logger.Debugf("Async write to L2 failed for key %s: %v", item.key, err)
+				h.recordL2Error()
+			} else {
+				h.l2Writes.Add(1)
+				h.logger.Debugf("Async write to L2 completed for key: %s", item.key)
+			}
+			cancel()
+		}
+	}
+}
+
+// healthMonitor periodically checks L2 health and manages fallback mode
+func (h *HybridBackend) healthMonitor() {
+	defer h.wg.Done()
+
+	ticker := time.NewTicker(30 * time.Second)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-h.ctx.Done():
+			return
+
+		case <-ticker.C:
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+
+			if err := h.secondary.Ping(ctx); err != nil {
+				if !h.fallbackMode.Load() {
+					h.fallbackMode.Store(true)
+					h.logger.Warnf("L2 backend unhealthy, entering fallback mode: %v", err)
+				}
+			} else {
+				if h.fallbackMode.CompareAndSwap(true, false) {
+					h.logger.Infof("L2 backend healthy, exiting fallback mode")
+				}
+			}
+
+			cancel()
+		}
+	}
+}
+
+// recordL2Error records the timestamp of an L2 error
+func (h *HybridBackend) recordL2Error() {
+	h.lastL2Error.Store(time.Now())
+
+	// Check if we should enter fallback mode based on recent errors
+	if !h.fallbackMode.Load() {
+		// Simple heuristic: if we've had an error in the last second, consider L2 unhealthy
+		if lastErr := h.lastL2Error.Load(); lastErr != nil {
+			if t, ok := lastErr.(time.Time); ok && time.Since(t) < time.Second {
+				h.fallbackMode.Store(true)
+				h.logger.Warnf("Multiple L2 errors detected, entering fallback mode")
+			}
+		}
+	}
+}
+
+// extractCacheType attempts to determine the cache type from the key
+func (h *HybridBackend) extractCacheType(key string) string {
+	// Simple heuristic based on key prefixes
+	// This should match the actual cache type strategy in the main application
+
+	if len(key) > 10 {
+		prefix := key[:10]
+		switch {
+		case contains(prefix, "blacklist"):
+			return "blacklist"
+		case contains(prefix, "token"):
+			return "token"
+		case contains(prefix, "metadata"):
+			return "metadata"
+		case contains(prefix, "jwk"):
+			return "jwk"
+		case contains(prefix, "session"):
+			return "session"
+		case contains(prefix, "introspect"):
+			return "introspection"
+		}
+	}
+
+	return "general"
+}
+
+// contains checks if a string contains a substring (case-insensitive)
+func contains(s, substr string) bool {
+	if len(substr) > len(s) {
+		return false
+	}
+	for i := 0; i <= len(s)-len(substr); i++ {
+		match := true
+		for j := 0; j < len(substr); j++ {
+			if toLower(s[i+j]) != toLower(substr[j]) {
+				match = false
+				break
+			}
+		}
+		if match {
+			return true
+		}
+	}
+	return false
+}
+
+// toLower converts a byte to lowercase
+func toLower(b byte) byte {
+	if b >= 'A' && b <= 'Z' {
+		return b + 32
+	}
+	return b
+}

internal/cache/backends/interface.go

@@ -0,0 +1,133 @@
+// Package backend provides cache backend implementations for the Traefik OIDC plugin.
+package backends
+
+import (
+	"context"
+	"time"
+)
+
+// CacheBackend defines the interface for all cache backend implementations
+// Implementations include: MemoryBackend, RedisBackend, and HybridBackend
+type CacheBackend interface {
+	// Set stores a value in the cache with the specified TTL
+	// Returns an error if the operation fails
+	Set(ctx context.Context, key string, value []byte, ttl time.Duration) error
+
+	// Get retrieves a value from the cache
+	// Returns: value, remaining TTL, exists flag, and error
+	// If the key doesn't exist, exists will be false
+	Get(ctx context.Context, key string) (value []byte, ttl time.Duration, exists bool, err error)
+
+	// Delete removes a key from the cache
+	// Returns true if the key was deleted, false if it didn't exist
+	Delete(ctx context.Context, key string) (bool, error)
+
+	// Exists checks if a key exists in the cache
+	Exists(ctx context.Context, key string) (bool, error)
+
+	// Clear removes all keys from the cache
+	Clear(ctx context.Context) error
+
+	// GetStats returns cache statistics
+	// Stats include: hits, misses, size, memory usage, etc.
+	GetStats() map[string]interface{}
+
+	// Close shuts down the cache backend and releases resources
+	Close() error
+
+	// Ping checks if the backend is healthy and responsive
+	Ping(ctx context.Context) error
+}
+
+// BackendStats represents statistics for a cache backend
+type BackendStats struct {
+	// Type is the backend type
+	Type BackendType
+
+	// Hits is the number of cache hits
+	Hits int64
+
+	// Misses is the number of cache misses
+	Misses int64
+
+	// Sets is the number of set operations
+	Sets int64
+
+	// Deletes is the number of delete operations
+	Deletes int64
+
+	// Errors is the number of errors
+	Errors int64
+
+	// Evictions is the number of evicted items
+	Evictions int64
+
+	// CurrentSize is the current number of items in cache
+	CurrentSize int64
+
+	// MaxSize is the maximum number of items (0 means unlimited)
+	MaxSize int64
+
+	// MemoryUsage is the approximate memory usage in bytes
+	MemoryUsage int64
+
+	// AverageGetLatency is the average latency for get operations
+	AverageGetLatency time.Duration
+
+	// AverageSetLatency is the average latency for set operations
+	AverageSetLatency time.Duration
+
+	// LastError is the last error encountered
+	LastError string
+
+	// LastErrorTime is when the last error occurred
+	LastErrorTime time.Time
+
+	// Uptime is how long the backend has been running
+	Uptime time.Duration
+
+	// StartTime is when the backend was started
+	StartTime time.Time
+}
+
+// BackendCapabilities describes the capabilities of a cache backend
+type BackendCapabilities struct {
+	// Distributed indicates if the backend is distributed across multiple instances
+	Distributed bool
+
+	// Persistent indicates if the backend persists data across restarts
+	Persistent bool
+
+	// Eviction indicates if the backend supports automatic eviction
+	Eviction bool
+
+	// TTL indicates if the backend supports TTL (time-to-live)
+	TTL bool
+
+	// MaxKeySize is the maximum size of a key in bytes (0 = unlimited)
+	MaxKeySize int64
+
+	// MaxValueSize is the maximum size of a value in bytes (0 = unlimited)
+	MaxValueSize int64
+
+	// MaxKeys is the maximum number of keys (0 = unlimited)
+	MaxKeys int64
+
+	// SupportsExpire indicates if the backend supports expiration
+	SupportsExpire bool
+
+	// SupportsMultiGet indicates if the backend supports batch get operations
+	SupportsMultiGet bool
+
+	// SupportsTransaction indicates if the backend supports transactions
+	SupportsTransaction bool
+
+	// SupportsCompression indicates if the backend supports compression
+	SupportsCompression bool
+
+	// RequiresSerialize indicates if values must be serialized
+	RequiresSerialize bool
+
+	// AtomicOperations indicates if the backend supports atomic operations
+	AtomicOperations bool
+}

internal/cache/backends/interface_test.go

@@ -0,0 +1,421 @@
+package backends
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestCacheBackendContract defines a set of tests that all CacheBackend implementations must pass
+// This ensures that Memory, Redis, and Hybrid backends all behave consistently
+func TestCacheBackendContract(t *testing.T) {
+	// Test suite will be run against each backend type
+	t.Run("MemoryBackend", func(t *testing.T) {
+		backend := setupMemoryBackend(t)
+		runContractTests(t, backend)
+	})
+
+	t.Run("RedisBackend", func(t *testing.T) {
+		backend := setupRedisBackend(t)
+		runContractTests(t, backend)
+	})
+
+	t.Run("HybridBackend", func(t *testing.T) {
+		backend := setupHybridBackend(t)
+		runContractTests(t, backend)
+	})
+}
+
+// runContractTests executes all contract tests against a backend
+func runContractTests(t *testing.T, backend CacheBackend) {
+	t.Helper()
+
+	ctx := context.Background()
+
+	t.Run("BasicSetGet", func(t *testing.T) {
+		testBasicSetGet(t, ctx, backend)
+	})
+
+	t.Run("GetNonExistent", func(t *testing.T) {
+		testGetNonExistent(t, ctx, backend)
+	})
+
+	t.Run("UpdateExisting", func(t *testing.T) {
+		testUpdateExisting(t, ctx, backend)
+	})
+
+	t.Run("Delete", func(t *testing.T) {
+		testDelete(t, ctx, backend)
+	})
+
+	t.Run("DeleteNonExistent", func(t *testing.T) {
+		testDeleteNonExistent(t, ctx, backend)
+	})
+
+	t.Run("Exists", func(t *testing.T) {
+		testExists(t, ctx, backend)
+	})
+
+	t.Run("TTLExpiration", func(t *testing.T) {
+		testTTLExpiration(t, ctx, backend)
+	})
+
+	t.Run("Clear", func(t *testing.T) {
+		testClear(t, ctx, backend)
+	})
+
+	t.Run("Ping", func(t *testing.T) {
+		testPing(t, ctx, backend)
+	})
+
+	t.Run("Stats", func(t *testing.T) {
+		testStats(t, ctx, backend)
+	})
+
+	t.Run("ConcurrentAccess", func(t *testing.T) {
+		testConcurrentAccess(t, ctx, backend)
+	})
+
+	t.Run("LargeValues", func(t *testing.T) {
+		testLargeValues(t, ctx, backend)
+	})
+
+	t.Run("EmptyValues", func(t *testing.T) {
+		testEmptyValues(t, ctx, backend)
+	})
+
+	t.Run("SpecialCharactersInKeys", func(t *testing.T) {
+		testSpecialCharactersInKeys(t, ctx, backend)
+	})
+}
+
+// testBasicSetGet verifies basic set and get operations
+func testBasicSetGet(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	key := "test-key-1"
+	value := []byte("test-value-1")
+	ttl := 1 * time.Minute
+
+	// Set value
+	err := backend.Set(ctx, key, value, ttl)
+	require.NoError(t, err, "Set should not return error")
+
+	// Get value
+	retrieved, remainingTTL, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err, "Get should not return error")
+	assert.True(t, exists, "Key should exist")
+	assert.Equal(t, value, retrieved, "Retrieved value should match")
+	assert.Greater(t, remainingTTL, 50*time.Second, "TTL should be close to original")
+	assert.LessOrEqual(t, remainingTTL, ttl, "TTL should not exceed original")
+}
+
+// testGetNonExistent verifies behavior when getting non-existent keys
+func testGetNonExistent(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	key := "non-existent-key"
+
+	retrieved, ttl, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err, "Get should not return error for non-existent key")
+	assert.False(t, exists, "Key should not exist")
+	assert.Nil(t, retrieved, "Value should be nil")
+	assert.Equal(t, time.Duration(0), ttl, "TTL should be zero")
+}
+
+// testUpdateExisting verifies updating an existing key
+func testUpdateExisting(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	key := "update-key"
+	value1 := []byte("original-value")
+	value2 := []byte("updated-value")
+	ttl := 1 * time.Minute
+
+	// Set initial value
+	err := backend.Set(ctx, key, value1, ttl)
+	require.NoError(t, err)
+
+	// Update value
+	err = backend.Set(ctx, key, value2, ttl)
+	require.NoError(t, err)
+
+	// Verify updated value
+	retrieved, _, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, value2, retrieved, "Value should be updated")
+}
+
+// testDelete verifies delete operation
+func testDelete(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	key := "delete-key"
+	value := []byte("delete-value")
+
+	// Set value
+	err := backend.Set(ctx, key, value, 1*time.Minute)
+	require.NoError(t, err)
+
+	// Verify exists
+	exists, err := backend.Exists(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+
+	// Delete
+	deleted, err := backend.Delete(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, deleted, "Delete should return true for existing key")
+
+	// Verify deleted
+	exists, err = backend.Exists(ctx, key)
+	require.NoError(t, err)
+	assert.False(t, exists, "Key should not exist after delete")
+}
+
+// testDeleteNonExistent verifies deleting non-existent keys
+func testDeleteNonExistent(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	key := "non-existent-delete-key"
+
+	deleted, err := backend.Delete(ctx, key)
+	require.NoError(t, err)
+	assert.False(t, deleted, "Delete should return false for non-existent key")
+}
+
+// testExists verifies the Exists operation
+func testExists(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	key := "exists-key"
+	value := []byte("exists-value")
+
+	// Check non-existent key
+	exists, err := backend.Exists(ctx, key)
+	require.NoError(t, err)
+	assert.False(t, exists, "Key should not exist initially")
+
+	// Set value
+	err = backend.Set(ctx, key, value, 1*time.Minute)
+	require.NoError(t, err)
+
+	// Check existing key
+	exists, err = backend.Exists(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists, "Key should exist after Set")
+}
+
+// testTTLExpiration verifies TTL expiration behavior
+func testTTLExpiration(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	key := "ttl-key"
+	value := []byte("ttl-value")
+	shortTTL := 100 * time.Millisecond
+
+	// Set with short TTL
+	err := backend.Set(ctx, key, value, shortTTL)
+	require.NoError(t, err)
+
+	// Verify exists immediately
+	exists, err := backend.Exists(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists, "Key should exist immediately after Set")
+
+	// Wait for expiration
+	time.Sleep(200 * time.Millisecond)
+
+	// Verify expired
+	exists, err = backend.Exists(ctx, key)
+	require.NoError(t, err)
+	assert.False(t, exists, "Key should not exist after TTL expiration")
+}
+
+// testClear verifies Clear operation
+func testClear(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	// Set multiple keys
+	for i := 0; i < 5; i++ {
+		key := fmt.Sprintf("clear-key-%d", i)
+		value := []byte(fmt.Sprintf("clear-value-%d", i))
+		err := backend.Set(ctx, key, value, 1*time.Minute)
+		require.NoError(t, err)
+	}
+
+	// Give async writes time to complete before clearing
+	// This prevents race conditions with async write workers
+	time.Sleep(50 * time.Millisecond)
+
+	// Clear all
+	err := backend.Clear(ctx)
+	require.NoError(t, err)
+
+	// Verify all keys are gone
+	for i := 0; i < 5; i++ {
+		key := fmt.Sprintf("clear-key-%d", i)
+		exists, err := backend.Exists(ctx, key)
+		require.NoError(t, err)
+		assert.False(t, exists, "Key should not exist after Clear")
+	}
+}
+
+// testPing verifies Ping operation
+func testPing(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	err := backend.Ping(ctx)
+	assert.NoError(t, err, "Ping should succeed on healthy backend")
+}
+
+// testStats verifies GetStats operation
+func testStats(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	stats := backend.GetStats()
+	assert.NotNil(t, stats, "Stats should not be nil")
+
+	// Stats should contain basic metrics
+	_, hasHits := stats["hits"]
+	_, hasMisses := stats["misses"]
+	assert.True(t, hasHits || hasMisses, "Stats should contain hits or misses")
+}
+
+// testConcurrentAccess verifies thread safety
+func testConcurrentAccess(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	var wg sync.WaitGroup
+	goroutines := 10
+	iterations := 20
+
+	// Concurrent writes
+	for i := 0; i < goroutines; i++ {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+			for j := 0; j < iterations; j++ {
+				key := fmt.Sprintf("concurrent-key-%d-%d", id, j)
+				value := []byte(fmt.Sprintf("concurrent-value-%d-%d", id, j))
+				err := backend.Set(ctx, key, value, 1*time.Minute)
+				assert.NoError(t, err)
+
+				// Read back
+				retrieved, _, exists, err := backend.Get(ctx, key)
+				assert.NoError(t, err)
+				if exists {
+					assert.Equal(t, value, retrieved)
+				}
+			}
+		}(i)
+	}
+
+	wg.Wait()
+}
+
+// testLargeValues verifies handling of large values
+func testLargeValues(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	key := "large-value-key"
+	value := GenerateLargeValue(1024 * 1024) // 1MB
+
+	err := backend.Set(ctx, key, value, 1*time.Minute)
+	require.NoError(t, err, "Should handle large values")
+
+	retrieved, _, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, len(value), len(retrieved), "Large value should be retrieved intact")
+}
+
+// testEmptyValues verifies handling of empty values
+func testEmptyValues(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	key := "empty-value-key"
+	value := []byte{}
+
+	err := backend.Set(ctx, key, value, 1*time.Minute)
+	require.NoError(t, err, "Should handle empty values")
+
+	retrieved, _, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists, "Empty value should exist")
+	assert.Equal(t, 0, len(retrieved), "Retrieved value should be empty")
+}
+
+// testSpecialCharactersInKeys verifies handling of special characters in keys
+func testSpecialCharactersInKeys(t *testing.T, ctx context.Context, backend CacheBackend) {
+	t.Helper()
+
+	specialKeys := []string{
+		"key:with:colons",
+		"key/with/slashes",
+		"key-with-dashes",
+		"key_with_underscores",
+		"key.with.dots",
+		"key|with|pipes",
+	}
+
+	for _, key := range specialKeys {
+		value := []byte(fmt.Sprintf("value-for-%s", key))
+
+		err := backend.Set(ctx, key, value, 1*time.Minute)
+		require.NoError(t, err, "Should handle special character in key: %s", key)
+
+		retrieved, _, exists, err := backend.Get(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, exists, "Key with special characters should exist: %s", key)
+		assert.Equal(t, value, retrieved)
+	}
+}
+
+// Helper functions to setup different backend types
+// These will be implemented in respective test files
+
+func setupMemoryBackend(t *testing.T) CacheBackend {
+	t.Helper()
+	// This will be implemented in memory_test.go
+	// For now, return nil to allow compilation
+	t.Skip("MemoryBackend implementation pending")
+	return nil
+}
+
+func setupRedisBackend(t *testing.T) CacheBackend {
+	t.Helper()
+	// This will be implemented in redis_test.go
+	// For now, return nil to allow compilation
+	t.Skip("RedisBackend implementation pending")
+	return nil
+}
+
+func setupHybridBackend(t *testing.T) CacheBackend {
+	t.Helper()
+
+	primary := newMockBackend()
+	secondary := newMockBackend()
+
+	config := &HybridConfig{
+		Primary:         primary,
+		Secondary:       secondary,
+		AsyncBufferSize: 100,
+		Logger:          NewTestLogger(t),
+	}
+
+	hybrid, err := NewHybridBackend(config)
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		hybrid.Close()
+	})
+
+	return hybrid
+}

internal/cache/backends/memory.go

@@ -0,0 +1,516 @@
+// Package backend provides cache backend implementations for the Traefik OIDC plugin.
+package backends
+
+import (
+	"container/list"
+	"context"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// memoryCacheItem represents an item in the memory cache
+type memoryCacheItem struct {
+	key         string
+	value       interface{}
+	expiresAt   time.Time
+	createdAt   time.Time
+	accessedAt  time.Time
+	accessCount int64
+	size        int64
+	element     *list.Element // for LRU tracking
+}
+
+// isExpired checks if the item is expired
+func (item *memoryCacheItem) isExpired() bool {
+	if item.expiresAt.IsZero() {
+		return false
+	}
+	return time.Now().After(item.expiresAt)
+}
+
+// MemoryCacheBackend implements the CacheBackend interface using in-memory storage
+type MemoryCacheBackend struct {
+	mu            sync.RWMutex
+	items         map[string]*memoryCacheItem
+	lruList       *list.List
+	maxSize       int64
+	maxMemory     int64
+	currentSize   int64
+	currentMemory int64
+
+	// Statistics
+	hits      atomic.Int64
+	misses    atomic.Int64
+	sets      atomic.Int64
+	deletes   atomic.Int64
+	evictions atomic.Int64
+	errors    atomic.Int64
+
+	// Latency tracking
+	totalGetTime atomic.Int64
+	totalSetTime atomic.Int64
+	getCount     atomic.Int64
+	setCount     atomic.Int64
+
+	// Status
+	startTime     time.Time
+	lastError     string
+	lastErrorTime time.Time
+	cleanupTicker *time.Ticker
+	cleanupDone   chan bool
+	closed        atomic.Bool
+
+	// Configuration
+	cleanupInterval time.Duration
+	evictionPolicy  string // "lru", "lfu", "fifo"
+}
+
+// NewMemoryCacheBackend creates a new memory cache backend
+func NewMemoryCacheBackend(maxSize int64, maxMemory int64, cleanupInterval time.Duration) *MemoryCacheBackend {
+	if maxSize <= 0 {
+		maxSize = 10000 // Default to 10k items
+	}
+	if maxMemory <= 0 {
+		maxMemory = 100 * 1024 * 1024 // Default to 100MB
+	}
+	if cleanupInterval <= 0 {
+		cleanupInterval = 5 * time.Minute
+	}
+
+	m := &MemoryCacheBackend{
+		items:           make(map[string]*memoryCacheItem),
+		lruList:         list.New(),
+		maxSize:         maxSize,
+		maxMemory:       maxMemory,
+		startTime:       time.Now(),
+		cleanupInterval: cleanupInterval,
+		evictionPolicy:  "lru",
+		cleanupDone:     make(chan bool),
+	}
+
+	// Start cleanup goroutine
+	m.cleanupTicker = time.NewTicker(cleanupInterval)
+	go m.cleanupLoop()
+
+	return m
+}
+
+// cleanupLoop runs periodic cleanup of expired items
+func (m *MemoryCacheBackend) cleanupLoop() {
+	for {
+		select {
+		case <-m.cleanupTicker.C:
+			m.cleanupExpired()
+		case <-m.cleanupDone:
+			return
+		}
+	}
+}
+
+// cleanupExpired removes all expired items from the cache
+func (m *MemoryCacheBackend) cleanupExpired() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	var keysToDelete []string
+	for key, item := range m.items {
+		if item.isExpired() {
+			keysToDelete = append(keysToDelete, key)
+		}
+	}
+
+	for _, key := range keysToDelete {
+		m.deleteItemLocked(key)
+	}
+}
+
+// Get retrieves a value from the cache
+func (m *MemoryCacheBackend) Get(ctx context.Context, key string) (interface{}, error) {
+	if m.closed.Load() {
+		return nil, ErrBackendUnavailable
+	}
+
+	start := time.Now()
+	defer func() {
+		duration := time.Since(start).Nanoseconds()
+		m.totalGetTime.Add(duration)
+		m.getCount.Add(1)
+	}()
+
+	m.mu.RLock()
+	item, exists := m.items[key]
+	m.mu.RUnlock()
+
+	if !exists {
+		m.misses.Add(1)
+		return nil, ErrCacheMiss
+	}
+
+	if item.isExpired() {
+		m.mu.Lock()
+		m.deleteItemLocked(key)
+		m.mu.Unlock()
+		m.misses.Add(1)
+		return nil, ErrCacheMiss
+	}
+
+	// Update access time and count
+	m.mu.Lock()
+	item.accessedAt = time.Now()
+	item.accessCount++
+	// Move to front of LRU list
+	if m.evictionPolicy == "lru" && item.element != nil {
+		m.lruList.MoveToFront(item.element)
+	}
+	m.mu.Unlock()
+
+	m.hits.Add(1)
+	return item.value, nil
+}
+
+// Set stores a value in the cache with optional TTL
+func (m *MemoryCacheBackend) Set(ctx context.Context, key string, value interface{}, ttl time.Duration) error {
+	if m.closed.Load() {
+		return ErrBackendUnavailable
+	}
+
+	start := time.Now()
+	defer func() {
+		duration := time.Since(start).Nanoseconds()
+		m.totalSetTime.Add(duration)
+		m.setCount.Add(1)
+	}()
+
+	// Calculate item size (simplified estimation)
+	itemSize := int64(len(key)) + estimateValueSize(value)
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	// Check if we need to evict items
+	if m.currentSize >= m.maxSize || m.currentMemory+itemSize > m.maxMemory {
+		m.evictLocked()
+	}
+
+	// Check if key exists
+	if oldItem, exists := m.items[key]; exists {
+		m.currentMemory -= oldItem.size
+		if oldItem.element != nil {
+			m.lruList.Remove(oldItem.element)
+		}
+	} else {
+		m.currentSize++
+	}
+
+	now := time.Now()
+	var expiresAt time.Time
+	if ttl > 0 {
+		expiresAt = now.Add(ttl)
+	}
+
+	item := &memoryCacheItem{
+		key:         key,
+		value:       value,
+		expiresAt:   expiresAt,
+		createdAt:   now,
+		accessedAt:  now,
+		accessCount: 0,
+		size:        itemSize,
+	}
+
+	// Add to LRU list
+	if m.evictionPolicy == "lru" {
+		item.element = m.lruList.PushFront(item)
+	}
+
+	m.items[key] = item
+	m.currentMemory += itemSize
+	m.sets.Add(1)
+
+	return nil
+}
+
+// Delete removes a key from the cache
+func (m *MemoryCacheBackend) Delete(ctx context.Context, key string) error {
+	if m.closed.Load() {
+		return ErrBackendUnavailable
+	}
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if _, exists := m.items[key]; !exists {
+		return nil
+	}
+
+	m.deleteItemLocked(key)
+	m.deletes.Add(1)
+	return nil
+}
+
+// deleteItemLocked deletes an item without acquiring the lock (must be called with lock held)
+func (m *MemoryCacheBackend) deleteItemLocked(key string) {
+	if item, exists := m.items[key]; exists {
+		m.currentMemory -= item.size
+		m.currentSize--
+		if item.element != nil {
+			m.lruList.Remove(item.element)
+		}
+		delete(m.items, key)
+	}
+}
+
+// evictLocked evicts items based on the eviction policy (must be called with lock held)
+func (m *MemoryCacheBackend) evictLocked() {
+	if m.evictionPolicy == "lru" && m.lruList.Len() > 0 {
+		// Evict least recently used item
+		element := m.lruList.Back()
+		if element != nil {
+			item := element.Value.(*memoryCacheItem)
+			m.deleteItemLocked(item.key)
+			m.evictions.Add(1)
+		}
+	}
+}
+
+// Exists checks if a key exists in the cache
+func (m *MemoryCacheBackend) Exists(ctx context.Context, key string) (bool, error) {
+	if m.closed.Load() {
+		return false, ErrBackendUnavailable
+	}
+
+	m.mu.RLock()
+	item, exists := m.items[key]
+	m.mu.RUnlock()
+
+	if !exists {
+		return false, nil
+	}
+
+	return !item.isExpired(), nil
+}
+
+// Clear removes all items from the cache
+func (m *MemoryCacheBackend) Clear(ctx context.Context) error {
+	if m.closed.Load() {
+		return ErrBackendUnavailable
+	}
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.items = make(map[string]*memoryCacheItem)
+	m.lruList = list.New()
+	m.currentSize = 0
+	m.currentMemory = 0
+
+	return nil
+}
+
+// Keys returns all keys matching the pattern (use "*" for all keys)
+func (m *MemoryCacheBackend) Keys(ctx context.Context, pattern string) ([]string, error) {
+	if m.closed.Load() {
+		return nil, ErrBackendUnavailable
+	}
+
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	var keys []string
+	for key, item := range m.items {
+		if !item.isExpired() && matchPattern(pattern, key) {
+			keys = append(keys, key)
+		}
+	}
+
+	return keys, nil
+}
+
+// Size returns the number of items in the cache
+func (m *MemoryCacheBackend) Size(ctx context.Context) (int64, error) {
+	if m.closed.Load() {
+		return 0, ErrBackendUnavailable
+	}
+
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	return m.currentSize, nil
+}
+
+// TTL returns the remaining time-to-live for a key
+func (m *MemoryCacheBackend) TTL(ctx context.Context, key string) (time.Duration, error) {
+	if m.closed.Load() {
+		return 0, ErrBackendUnavailable
+	}
+
+	m.mu.RLock()
+	item, exists := m.items[key]
+	m.mu.RUnlock()
+
+	if !exists || item.isExpired() {
+		return 0, ErrCacheMiss
+	}
+
+	if item.expiresAt.IsZero() {
+		return 0, nil // No expiration
+	}
+
+	remaining := time.Until(item.expiresAt)
+	if remaining < 0 {
+		return 0, nil
+	}
+
+	return remaining, nil
+}
+
+// Expire updates the TTL for an existing key
+func (m *MemoryCacheBackend) Expire(ctx context.Context, key string, ttl time.Duration) error {
+	if m.closed.Load() {
+		return ErrBackendUnavailable
+	}
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	item, exists := m.items[key]
+	if !exists || item.isExpired() {
+		return ErrCacheMiss
+	}
+
+	if ttl > 0 {
+		item.expiresAt = time.Now().Add(ttl)
+	} else {
+		item.expiresAt = time.Time{} // Remove expiration
+	}
+
+	return nil
+}
+
+// GetStats returns statistics about the cache backend
+func (m *MemoryCacheBackend) GetStats(ctx context.Context) (*BackendStats, error) {
+	if m.closed.Load() {
+		return nil, ErrBackendUnavailable
+	}
+
+	m.mu.RLock()
+	lastError := m.lastError
+	lastErrorTime := m.lastErrorTime
+	m.mu.RUnlock()
+
+	avgGetLatency := time.Duration(0)
+	if getCount := m.getCount.Load(); getCount > 0 {
+		avgGetLatency = time.Duration(m.totalGetTime.Load() / getCount)
+	}
+
+	avgSetLatency := time.Duration(0)
+	if setCount := m.setCount.Load(); setCount > 0 {
+		avgSetLatency = time.Duration(m.totalSetTime.Load() / setCount)
+	}
+
+	return &BackendStats{
+		Type:              TypeMemory,
+		Hits:              m.hits.Load(),
+		Misses:            m.misses.Load(),
+		Sets:              m.sets.Load(),
+		Deletes:           m.deletes.Load(),
+		Errors:            m.errors.Load(),
+		Evictions:         m.evictions.Load(),
+		CurrentSize:       m.currentSize,
+		MaxSize:           m.maxSize,
+		MemoryUsage:       m.currentMemory,
+		AverageGetLatency: avgGetLatency,
+		AverageSetLatency: avgSetLatency,
+		LastError:         lastError,
+		LastErrorTime:     lastErrorTime,
+		Uptime:            time.Since(m.startTime),
+		StartTime:         m.startTime,
+	}, nil
+}
+
+// Ping checks if the backend is healthy
+func (m *MemoryCacheBackend) Ping(ctx context.Context) error {
+	if m.closed.Load() {
+		return ErrBackendUnavailable
+	}
+	return nil
+}
+
+// Close closes the backend and releases resources
+func (m *MemoryCacheBackend) Close() error {
+	if m.closed.Swap(true) {
+		return nil // Already closed
+	}
+
+	m.cleanupTicker.Stop()
+	close(m.cleanupDone)
+
+	m.mu.Lock()
+	m.items = nil
+	m.lruList = nil
+	m.mu.Unlock()
+
+	return nil
+}
+
+// IsHealthy returns true if the backend is healthy
+func (m *MemoryCacheBackend) IsHealthy() bool {
+	return !m.closed.Load()
+}
+
+// Type returns the backend type
+func (m *MemoryCacheBackend) Type() BackendType {
+	return TypeMemory
+}
+
+// Capabilities returns the backend capabilities
+func (m *MemoryCacheBackend) Capabilities() *BackendCapabilities {
+	return &BackendCapabilities{
+		Distributed:         false,
+		Persistent:          false,
+		Eviction:            true,
+		TTL:                 true,
+		MaxKeySize:          1024,     // 1KB
+		MaxValueSize:        10485760, // 10MB
+		MaxKeys:             m.maxSize,
+		SupportsExpire:      true,
+		SupportsMultiGet:    true,
+		SupportsTransaction: false,
+		SupportsCompression: false,
+		RequiresSerialize:   false,
+	}
+}
+
+// Helper functions
+
+// estimateValueSize estimates the size of a value in bytes
+func estimateValueSize(value interface{}) int64 {
+	// This is a simplified estimation
+	// In production, you might want to use a more accurate method
+	switch v := value.(type) {
+	case string:
+		return int64(len(v))
+	case []byte:
+		return int64(len(v))
+	case int, int32, int64, uint, uint32, uint64:
+		return 8
+	case float32, float64:
+		return 8
+	case bool:
+		return 1
+	default:
+		// For complex types, use a default estimate
+		return 256
+	}
+}
+
+// matchPattern checks if a key matches a pattern (simplified glob matching)
+func matchPattern(pattern, key string) bool {
+	if pattern == "*" {
+		return true
+	}
+	// Simplified pattern matching - in production, use a proper glob library
+	return key == pattern || (len(pattern) > 0 && pattern[0] == '*' &&
+		len(key) >= len(pattern)-1 && key[len(key)-len(pattern)+1:] == pattern[1:])
+}

internal/cache/backends/memory_bench_test.go

@@ -0,0 +1,182 @@
+package backends
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+)
+
+// setupBenchmarkRedis creates a miniredis instance for benchmarking
+func setupBenchmarkRedis(b *testing.B) string {
+	b.Helper()
+	mr, err := miniredis.Run()
+	if err != nil {
+		b.Fatal(err)
+	}
+	b.Cleanup(func() {
+		mr.Close()
+	})
+	return mr.Addr()
+}
+
+// BenchmarkRedisOperations_WithPooling benchmarks memory allocations with object pooling
+func BenchmarkRedisOperations_WithPooling(b *testing.B) {
+	addr := setupBenchmarkRedis(b)
+
+	config := &PoolConfig{
+		Address:        addr,
+		MaxConnections: 10,
+		ConnectTimeout: 5 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	if err != nil {
+		b.Fatal(err)
+	}
+	defer pool.Close()
+
+	ctx := context.Background()
+
+	b.ReportAllocs()
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		conn, err := pool.Get(ctx)
+		if err != nil {
+			b.Fatal(err)
+		}
+
+		// Perform various operations
+		_, _ = conn.Do("SET", "bench-key", "bench-value")
+		_, _ = conn.Do("GET", "bench-key")
+		_, _ = conn.Do("EXISTS", "bench-key")
+		_, _ = conn.Do("DEL", "bench-key")
+
+		pool.Put(conn)
+	}
+}
+
+// BenchmarkRedisBackend_SetGet benchmarks the full backend with pooling
+func BenchmarkRedisBackend_SetGet(b *testing.B) {
+	addr := setupBenchmarkRedis(b)
+
+	backend, err := NewRedisBackend(&Config{
+		RedisAddr: addr,
+		PoolSize:  10,
+	})
+	if err != nil {
+		b.Fatal(err)
+	}
+	defer backend.Close()
+
+	ctx := context.Background()
+	testData := []byte("benchmark test data with some content")
+
+	b.ReportAllocs()
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		// Set operation
+		err := backend.Set(ctx, "bench-key", testData, 0)
+		if err != nil {
+			b.Fatal(err)
+		}
+
+		// Get operation
+		_, _, _, err = backend.Get(ctx, "bench-key")
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+// BenchmarkRedisBackend_ConcurrentAccess benchmarks concurrent operations with pooling
+func BenchmarkRedisBackend_ConcurrentAccess(b *testing.B) {
+	addr := setupBenchmarkRedis(b)
+
+	backend, err := NewRedisBackend(&Config{
+		RedisAddr: addr,
+		PoolSize:  10,
+	})
+	if err != nil {
+		b.Fatal(err)
+	}
+	defer backend.Close()
+
+	ctx := context.Background()
+	testData := []byte("concurrent benchmark data")
+
+	b.ReportAllocs()
+	b.ResetTimer()
+
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			_ = backend.Set(ctx, "concurrent-key", testData, 0)
+			_, _, _, _ = backend.Get(ctx, "concurrent-key")
+		}
+	})
+}
+
+// BenchmarkRESPProtocol_WriteRead benchmarks RESP protocol encoding/decoding
+func BenchmarkRESPProtocol_WriteRead(b *testing.B) {
+	addr := setupBenchmarkRedis(b)
+
+	config := &PoolConfig{
+		Address:        addr,
+		MaxConnections: 10,
+		ConnectTimeout: 5 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	if err != nil {
+		b.Fatal(err)
+	}
+	defer pool.Close()
+
+	ctx := context.Background()
+	conn, err := pool.Get(ctx)
+	if err != nil {
+		b.Fatal(err)
+	}
+	defer pool.Put(conn)
+
+	b.ReportAllocs()
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		// This tests the pooling of RESPReader/RESPWriter
+		_, _ = conn.Do("PING")
+	}
+}
+
+// BenchmarkConnectionPool_GetPut benchmarks connection pool operations
+func BenchmarkConnectionPool_GetPut(b *testing.B) {
+	addr := setupBenchmarkRedis(b)
+
+	config := &PoolConfig{
+		Address:        addr,
+		MaxConnections: 10,
+		ConnectTimeout: 5 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	if err != nil {
+		b.Fatal(err)
+	}
+	defer pool.Close()
+
+	ctx := context.Background()
+
+	b.ReportAllocs()
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		conn, err := pool.Get(ctx)
+		if err != nil {
+			b.Fatal(err)
+		}
+		pool.Put(conn)
+	}
+}

internal/cache/backends/memory_test.go

@@ -0,0 +1,783 @@
+package backends
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestMemoryBackend_BasicOperations tests basic CRUD operations
+func TestMemoryBackend_BasicOperations(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	t.Run("SetAndGet", func(t *testing.T) {
+		key := "test-key"
+		value := []byte("test-value")
+		ttl := 1 * time.Minute
+
+		err := backend.Set(ctx, key, value, ttl)
+		require.NoError(t, err)
+
+		retrieved, remainingTTL, exists, err := backend.Get(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, exists)
+		assert.Equal(t, value, retrieved)
+		assert.Greater(t, remainingTTL, 50*time.Second)
+		assert.LessOrEqual(t, remainingTTL, ttl)
+	})
+
+	t.Run("GetNonExistent", func(t *testing.T) {
+		_, _, exists, err := backend.Get(ctx, "non-existent")
+		require.NoError(t, err)
+		assert.False(t, exists)
+	})
+
+	t.Run("Delete", func(t *testing.T) {
+		key := "delete-key"
+		value := []byte("delete-value")
+
+		err := backend.Set(ctx, key, value, 1*time.Minute)
+		require.NoError(t, err)
+
+		deleted, err := backend.Delete(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, deleted)
+
+		exists, err := backend.Exists(ctx, key)
+		require.NoError(t, err)
+		assert.False(t, exists)
+	})
+
+	t.Run("DeleteNonExistent", func(t *testing.T) {
+		deleted, err := backend.Delete(ctx, "non-existent-delete")
+		require.NoError(t, err)
+		assert.False(t, deleted)
+	})
+
+	t.Run("Exists", func(t *testing.T) {
+		key := "exists-key"
+		value := []byte("exists-value")
+
+		exists, err := backend.Exists(ctx, key)
+		require.NoError(t, err)
+		assert.False(t, exists)
+
+		err = backend.Set(ctx, key, value, 1*time.Minute)
+		require.NoError(t, err)
+
+		exists, err = backend.Exists(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, exists)
+	})
+
+	t.Run("Clear", func(t *testing.T) {
+		// Add multiple items
+		for i := 0; i < 10; i++ {
+			key := fmt.Sprintf("clear-key-%d", i)
+			value := []byte(fmt.Sprintf("clear-value-%d", i))
+			err := backend.Set(ctx, key, value, 1*time.Minute)
+			require.NoError(t, err)
+		}
+
+		err := backend.Clear(ctx)
+		require.NoError(t, err)
+
+		stats := backend.GetStats()
+		size := stats["size"].(int64)
+		assert.Equal(t, int64(0), size)
+	})
+}
+
+// TestMemoryBackend_TTLExpiration tests TTL and expiration
+func TestMemoryBackend_TTLExpiration(t *testing.T) {
+	t.Parallel()
+
+	config := DefaultConfig()
+	config.CleanupInterval = 50 * time.Millisecond
+	backend, err := NewMemoryBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	t.Run("ShortTTL", func(t *testing.T) {
+		key := "short-ttl-key"
+		value := []byte("short-ttl-value")
+		shortTTL := 100 * time.Millisecond
+
+		err := backend.Set(ctx, key, value, shortTTL)
+		require.NoError(t, err)
+
+		// Verify exists immediately
+		exists, err := backend.Exists(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, exists)
+
+		// Wait for expiration
+		time.Sleep(150 * time.Millisecond)
+
+		// Should be expired
+		_, _, exists, err = backend.Get(ctx, key)
+		require.NoError(t, err)
+		assert.False(t, exists)
+	})
+
+	t.Run("TTLDecrement", func(t *testing.T) {
+		key := "ttl-decrement-key"
+		value := []byte("ttl-decrement-value")
+		ttl := 2 * time.Second
+
+		err := backend.Set(ctx, key, value, ttl)
+		require.NoError(t, err)
+
+		// Check TTL immediately
+		_, ttl1, exists, err := backend.Get(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, exists)
+
+		// Wait a bit
+		time.Sleep(500 * time.Millisecond)
+
+		// Check TTL again - should be less
+		_, ttl2, exists, err := backend.Get(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, exists)
+		assert.Less(t, ttl2, ttl1, "TTL should decrease over time")
+	})
+
+	t.Run("CleanupExpiredItems", func(t *testing.T) {
+		// Set multiple items with short TTL
+		for i := 0; i < 5; i++ {
+			key := fmt.Sprintf("cleanup-key-%d", i)
+			value := []byte(fmt.Sprintf("cleanup-value-%d", i))
+			err := backend.Set(ctx, key, value, 50*time.Millisecond)
+			require.NoError(t, err)
+		}
+
+		// Wait for cleanup to run
+		time.Sleep(200 * time.Millisecond)
+
+		// All items should be cleaned up
+		for i := 0; i < 5; i++ {
+			key := fmt.Sprintf("cleanup-key-%d", i)
+			exists, err := backend.Exists(ctx, key)
+			require.NoError(t, err)
+			assert.False(t, exists, "Expired items should be cleaned up")
+		}
+	})
+}
+
+// TestMemoryBackend_LRUEviction tests LRU eviction
+func TestMemoryBackend_LRUEviction(t *testing.T) {
+	t.Parallel()
+
+	config := DefaultConfig()
+	config.MaxSize = 5
+	backend, err := NewMemoryBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	// Fill cache to max size
+	for i := 0; i < 5; i++ {
+		key := fmt.Sprintf("lru-key-%d", i)
+		value := []byte(fmt.Sprintf("lru-value-%d", i))
+		err := backend.Set(ctx, key, value, 1*time.Minute)
+		require.NoError(t, err)
+	}
+
+	// Access first item to make it most recently used
+	_, _, exists, err := backend.Get(ctx, "lru-key-0")
+	require.NoError(t, err)
+	assert.True(t, exists)
+
+	// Add a new item - should evict lru-key-1 (least recently used)
+	err = backend.Set(ctx, "lru-key-new", []byte("new-value"), 1*time.Minute)
+	require.NoError(t, err)
+
+	// lru-key-0 should still exist (was accessed recently)
+	exists, err = backend.Exists(ctx, "lru-key-0")
+	require.NoError(t, err)
+	assert.True(t, exists, "Recently accessed item should not be evicted")
+
+	// lru-key-1 should be evicted
+	exists, err = backend.Exists(ctx, "lru-key-1")
+	require.NoError(t, err)
+	assert.False(t, exists, "Least recently used item should be evicted")
+
+	// Check eviction count
+	stats := backend.GetStats()
+	evictions := stats["evictions"].(int64)
+	assert.Greater(t, evictions, int64(0), "Should have evictions")
+}
+
+// TestMemoryBackend_MemoryLimit tests memory-based eviction
+func TestMemoryBackend_MemoryLimit(t *testing.T) {
+	t.Parallel()
+
+	config := DefaultConfig()
+	config.MaxSize = 100
+	config.MaxMemoryBytes = 1024 // 1KB limit
+	backend, err := NewMemoryBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	// Add items until memory limit is reached
+	largeValue := make([]byte, 512) // 512 bytes each
+	for i := 0; i < 5; i++ {
+		key := fmt.Sprintf("mem-key-%d", i)
+		err := backend.Set(ctx, key, largeValue, 1*time.Minute)
+		require.NoError(t, err)
+	}
+
+	stats := backend.GetStats()
+	memory := stats["memory"].(int64)
+	assert.LessOrEqual(t, memory, config.MaxMemoryBytes, "Memory should not exceed limit")
+
+	evictions := stats["evictions"].(int64)
+	assert.Greater(t, evictions, int64(0), "Should have memory-based evictions")
+}
+
+// TestMemoryBackend_ConcurrentAccess tests thread safety
+func TestMemoryBackend_ConcurrentAccess(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+	var wg sync.WaitGroup
+	goroutines := 20
+	iterations := 50
+
+	// Concurrent writes
+	for i := 0; i < goroutines; i++ {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+			for j := 0; j < iterations; j++ {
+				key := fmt.Sprintf("concurrent-key-%d-%d", id, j)
+				value := []byte(fmt.Sprintf("concurrent-value-%d-%d", id, j))
+
+				err := backend.Set(ctx, key, value, 1*time.Minute)
+				assert.NoError(t, err)
+
+				// Read back
+				retrieved, _, exists, err := backend.Get(ctx, key)
+				assert.NoError(t, err)
+				if exists {
+					assert.Equal(t, value, retrieved)
+				}
+
+				// Random deletes
+				if j%5 == 0 {
+					backend.Delete(ctx, key)
+				}
+			}
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Verify stats are consistent
+	stats := backend.GetStats()
+	hits := stats["hits"].(int64)
+	misses := stats["misses"].(int64)
+	assert.Greater(t, hits+misses, int64(0), "Should have cache operations")
+}
+
+// TestMemoryBackend_UpdateExisting tests updating existing keys
+func TestMemoryBackend_UpdateExisting(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	key := "update-key"
+	value1 := []byte("original-value")
+	value2 := []byte("updated-value")
+
+	// Set original
+	err = backend.Set(ctx, key, value1, 1*time.Minute)
+	require.NoError(t, err)
+
+	// Update
+	err = backend.Set(ctx, key, value2, 2*time.Minute)
+	require.NoError(t, err)
+
+	// Verify updated
+	retrieved, ttl, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, value2, retrieved)
+	assert.Greater(t, ttl, 1*time.Minute, "TTL should be updated")
+
+	// Size should not increase (same key)
+	stats := backend.GetStats()
+	size := stats["size"].(int64)
+	assert.Equal(t, int64(1), size, "Size should be 1 for one key")
+}
+
+// TestMemoryBackend_Stats tests statistics tracking
+func TestMemoryBackend_Stats(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	// Initial stats
+	stats := backend.GetStats()
+	assert.Equal(t, int64(0), stats["hits"].(int64))
+	assert.Equal(t, int64(0), stats["misses"].(int64))
+
+	// Add items and track hits/misses
+	backend.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+	backend.Set(ctx, "key2", []byte("value2"), 1*time.Minute)
+
+	// Hit
+	backend.Get(ctx, "key1")
+	// Miss
+	backend.Get(ctx, "non-existent")
+
+	stats = backend.GetStats()
+	assert.Equal(t, int64(1), stats["hits"].(int64))
+	assert.Equal(t, int64(1), stats["misses"].(int64))
+
+	hitRate := stats["hit_rate"].(float64)
+	assert.InDelta(t, 0.5, hitRate, 0.01)
+}
+
+// TestMemoryBackend_EmptyValues tests handling of empty values
+func TestMemoryBackend_EmptyValues(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	key := "empty-key"
+	emptyValue := []byte{}
+
+	err = backend.Set(ctx, key, emptyValue, 1*time.Minute)
+	require.NoError(t, err)
+
+	retrieved, _, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, 0, len(retrieved))
+}
+
+// TestMemoryBackend_LargeValues tests handling of large values
+func TestMemoryBackend_LargeValues(t *testing.T) {
+	t.Parallel()
+
+	config := DefaultConfig()
+	config.MaxMemoryBytes = 10 * 1024 * 1024 // 10MB
+	backend, err := NewMemoryBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	key := "large-key"
+	largeValue := make([]byte, 1024*1024) // 1MB
+
+	err = backend.Set(ctx, key, largeValue, 1*time.Minute)
+	require.NoError(t, err)
+
+	retrieved, _, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, len(largeValue), len(retrieved))
+}
+
+// TestMemoryBackend_Close tests proper cleanup on close
+func TestMemoryBackend_Close(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+
+	ctx := context.Background()
+
+	// Add some items
+	for i := 0; i < 10; i++ {
+		key := fmt.Sprintf("close-key-%d", i)
+		value := []byte(fmt.Sprintf("close-value-%d", i))
+		backend.Set(ctx, key, value, 1*time.Minute)
+	}
+
+	// Close
+	err = backend.Close()
+	require.NoError(t, err)
+
+	// Operations after close should fail
+	err = backend.Set(ctx, "after-close", []byte("value"), 1*time.Minute)
+	assert.Error(t, err)
+	assert.Equal(t, ErrBackendClosed, err)
+
+	_, _, _, err = backend.Get(ctx, "close-key-0")
+	assert.Error(t, err)
+	assert.Equal(t, ErrBackendClosed, err)
+
+	// Closing again should be safe
+	err = backend.Close()
+	assert.NoError(t, err)
+}
+
+// TestMemoryBackend_Ping tests ping operation
+func TestMemoryBackend_Ping(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	err = backend.Ping(ctx)
+	assert.NoError(t, err)
+
+	// Close and ping should fail
+	backend.Close()
+	err = backend.Ping(ctx)
+	assert.Error(t, err)
+}
+
+// TestMemoryBackend_ValueIsolation tests that returned values are isolated
+func TestMemoryBackend_ValueIsolation(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	key := "isolation-key"
+	originalValue := []byte("original-value")
+
+	err = backend.Set(ctx, key, originalValue, 1*time.Minute)
+	require.NoError(t, err)
+
+	// Get value and modify it
+	retrieved, _, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+
+	// Modify retrieved value
+	if len(retrieved) > 0 {
+		retrieved[0] = 'X'
+	}
+
+	// Get again - should be unchanged
+	retrieved2, _, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, originalValue, retrieved2, "Original value should not be modified")
+}
+
+// TestMemoryBackend_Keys tests the Keys method with pattern matching
+func TestMemoryBackend_Keys(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	// Add test data
+	testKeys := []string{"user:1", "user:2", "session:abc", "session:def", "token:xyz"}
+	for _, key := range testKeys {
+		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
+		require.NoError(t, err)
+	}
+
+	t.Run("AllKeys", func(t *testing.T) {
+		keys, err := backend.Keys(ctx, "*")
+		require.NoError(t, err)
+		assert.Len(t, keys, 5)
+	})
+
+	t.Run("SpecificPattern", func(t *testing.T) {
+		// Simple exact match
+		keys, err := backend.Keys(ctx, "user:1")
+		require.NoError(t, err)
+		assert.Len(t, keys, 1)
+		assert.Contains(t, keys, "user:1")
+	})
+
+	t.Run("ExcludesExpired", func(t *testing.T) {
+		// Add an expired key
+		expiredKey := "expired:key"
+		err := backend.Set(ctx, expiredKey, []byte("value"), 1*time.Millisecond)
+		require.NoError(t, err)
+
+		// Wait for expiration
+		time.Sleep(10 * time.Millisecond)
+
+		keys, err := backend.Keys(ctx, "*")
+		require.NoError(t, err)
+		assert.NotContains(t, keys, expiredKey, "Expired keys should not be returned")
+	})
+
+	t.Run("AfterClose", func(t *testing.T) {
+		closedBackend, _ := NewMemoryBackend(DefaultConfig())
+		closedBackend.Close()
+
+		_, err := closedBackend.Keys(ctx, "*")
+		assert.Error(t, err)
+		assert.Equal(t, ErrBackendUnavailable, err)
+	})
+}
+
+// TestMemoryBackend_Size tests the Size method
+func TestMemoryBackend_Size(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	// Initially empty
+	size, err := backend.Size(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, int64(0), size)
+
+	// Add items
+	for i := 0; i < 5; i++ {
+		key := fmt.Sprintf("key-%d", i)
+		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
+		require.NoError(t, err)
+	}
+
+	size, err = backend.Size(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, int64(5), size)
+
+	// Delete one
+	backend.Delete(ctx, "key-0")
+
+	size, err = backend.Size(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, int64(4), size)
+
+	// After close
+	backend.Close()
+	_, err = backend.Size(ctx)
+	assert.Error(t, err)
+	assert.Equal(t, ErrBackendUnavailable, err)
+}
+
+// TestMemoryBackend_TTL tests the TTL method
+func TestMemoryBackend_TTL(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	t.Run("ExistingKey", func(t *testing.T) {
+		key := "ttl-key"
+		ttl := 1 * time.Minute
+
+		err := backend.Set(ctx, key, []byte("value"), ttl)
+		require.NoError(t, err)
+
+		remaining, err := backend.TTL(ctx, key)
+		require.NoError(t, err)
+		assert.Greater(t, remaining, 50*time.Second)
+		assert.LessOrEqual(t, remaining, ttl)
+	})
+
+	t.Run("NonExistentKey", func(t *testing.T) {
+		_, err := backend.TTL(ctx, "non-existent")
+		assert.Error(t, err)
+		assert.Equal(t, ErrCacheMiss, err)
+	})
+
+	t.Run("NoExpiration", func(t *testing.T) {
+		key := "no-expiry"
+		// TTL of 0 typically means no expiration
+		err := backend.Set(ctx, key, []byte("value"), 0)
+		require.NoError(t, err)
+
+		remaining, err := backend.TTL(ctx, key)
+		require.NoError(t, err)
+		// No expiration returns 0
+		assert.Equal(t, time.Duration(0), remaining)
+	})
+
+	t.Run("AfterClose", func(t *testing.T) {
+		closedBackend, _ := NewMemoryBackend(DefaultConfig())
+		closedBackend.Close()
+
+		_, err := closedBackend.TTL(ctx, "key")
+		assert.Error(t, err)
+		assert.Equal(t, ErrBackendUnavailable, err)
+	})
+}
+
+// TestMemoryBackend_Expire tests the Expire method
+func TestMemoryBackend_Expire(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	t.Run("UpdateTTL", func(t *testing.T) {
+		key := "expire-key"
+		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
+		require.NoError(t, err)
+
+		// Update to shorter TTL
+		err = backend.Expire(ctx, key, 5*time.Second)
+		require.NoError(t, err)
+
+		// Check new TTL
+		remaining, err := backend.TTL(ctx, key)
+		require.NoError(t, err)
+		assert.LessOrEqual(t, remaining, 5*time.Second)
+	})
+
+	t.Run("NonExistentKey", func(t *testing.T) {
+		err := backend.Expire(ctx, "non-existent", 1*time.Minute)
+		assert.Error(t, err)
+		assert.Equal(t, ErrCacheMiss, err)
+	})
+
+	t.Run("RemoveExpiration", func(t *testing.T) {
+		key := "no-expire-key"
+		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
+		require.NoError(t, err)
+
+		// Set TTL to 0 to remove expiration
+		err = backend.Expire(ctx, key, 0)
+		require.NoError(t, err)
+
+		// TTL should now be 0
+		remaining, err := backend.TTL(ctx, key)
+		require.NoError(t, err)
+		assert.Equal(t, time.Duration(0), remaining)
+	})
+
+	t.Run("AfterClose", func(t *testing.T) {
+		closedBackend, _ := NewMemoryBackend(DefaultConfig())
+		closedBackend.Close()
+
+		err := closedBackend.Expire(ctx, "key", 1*time.Minute)
+		assert.Error(t, err)
+		assert.Equal(t, ErrBackendUnavailable, err)
+	})
+}
+
+// TestMemoryBackend_IsHealthy tests the IsHealthy method
+func TestMemoryBackend_IsHealthy(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+
+	// Should be healthy when open
+	assert.True(t, backend.IsHealthy())
+
+	// Should be unhealthy after close
+	backend.Close()
+	assert.False(t, backend.IsHealthy())
+}
+
+// TestMemoryBackend_Type tests the Type method
+func TestMemoryBackend_Type(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	backendType := backend.Type()
+	assert.Equal(t, TypeMemory, backendType)
+}
+
+// TestMemoryBackend_Capabilities tests the Capabilities method
+func TestMemoryBackend_Capabilities(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	caps := backend.Capabilities()
+	require.NotNil(t, caps)
+
+	// Memory backend should not be distributed or persistent
+	assert.False(t, caps.Distributed)
+	assert.False(t, caps.Persistent)
+
+	// Should support eviction and TTL
+	assert.True(t, caps.Eviction)
+	assert.True(t, caps.TTL)
+	assert.True(t, caps.SupportsExpire)
+	assert.True(t, caps.SupportsMultiGet)
+
+	// Check limits
+	assert.Greater(t, caps.MaxKeySize, int64(0))
+	assert.Greater(t, caps.MaxValueSize, int64(0))
+}
+
+// TestMatchPattern tests the matchPattern helper function
+func TestMatchPattern(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		pattern string
+		key     string
+		matches bool
+	}{
+		{"*", "any-key", true},
+		{"*", "another", true},
+		{"user:1", "user:1", true},
+		{"user:1", "user:2", false},
+		{"*:suffix", "prefix:suffix", true},
+		{"*suffix", "prefix-suffix", true},
+		{"*abc", "xyzabc", true},
+		{"*abc", "xyz", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(fmt.Sprintf("%s-%s", tt.pattern, tt.key), func(t *testing.T) {
+			result := matchPattern(tt.pattern, tt.key)
+			assert.Equal(t, tt.matches, result)
+		})
+	}
+}

internal/cache/backends/memory_wrapper.go

@@ -0,0 +1,153 @@
+package backends
+
+import (
+	"context"
+	"time"
+)
+
+// MemoryBackend wraps MemoryCacheBackend to implement the CacheBackend interface
+type MemoryBackend struct {
+	*MemoryCacheBackend
+}
+
+// NewMemoryBackend creates a new memory backend from a config
+func NewMemoryBackend(config *Config) (*MemoryBackend, error) {
+	maxSize := int64(config.MaxSize)
+	if maxSize <= 0 {
+		maxSize = 1000
+	}
+
+	cacheBackend := NewMemoryCacheBackend(maxSize, config.MaxMemoryBytes, config.CleanupInterval)
+	return &MemoryBackend{
+		MemoryCacheBackend: cacheBackend,
+	}, nil
+}
+
+// Set stores a value in the cache with the specified TTL
+func (m *MemoryBackend) Set(ctx context.Context, key string, value []byte, ttl time.Duration) error {
+	err := m.MemoryCacheBackend.Set(ctx, key, value, ttl)
+	if err == ErrBackendUnavailable {
+		return ErrBackendClosed
+	}
+	return err
+}
+
+// Get retrieves a value from the cache
+func (m *MemoryBackend) Get(ctx context.Context, key string) ([]byte, time.Duration, bool, error) {
+	val, err := m.MemoryCacheBackend.Get(ctx, key)
+	if err != nil {
+		if err == ErrCacheMiss {
+			return nil, 0, false, nil
+		}
+		if err == ErrBackendUnavailable {
+			return nil, 0, false, ErrBackendClosed
+		}
+		return nil, 0, false, err
+	}
+
+	// Get the item directly to check TTL
+	m.MemoryCacheBackend.mu.RLock()
+	item, exists := m.MemoryCacheBackend.items[key]
+	m.MemoryCacheBackend.mu.RUnlock()
+
+	if !exists {
+		return nil, 0, false, nil
+	}
+
+	var ttl time.Duration
+	if !item.expiresAt.IsZero() {
+		ttl = time.Until(item.expiresAt)
+		if ttl < 0 {
+			ttl = 0
+		}
+	}
+
+	// Convert interface{} to []byte
+	var valueBytes []byte
+	if val != nil {
+		if bytes, ok := val.([]byte); ok {
+			valueBytes = bytes
+		} else {
+			// If it's not already []byte, we might need to handle other types
+			// For now, we'll just return an error
+			return nil, 0, false, ErrInvalidValue
+		}
+	}
+
+	return valueBytes, ttl, true, nil
+}
+
+// Delete removes a key from the cache
+func (m *MemoryBackend) Delete(ctx context.Context, key string) (bool, error) {
+	// Check if key exists first
+	exists, err := m.MemoryCacheBackend.Exists(ctx, key)
+	if err != nil {
+		return false, err
+	}
+
+	if !exists {
+		return false, nil
+	}
+
+	err = m.MemoryCacheBackend.Delete(ctx, key)
+	if err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+// Exists checks if a key exists in the cache
+func (m *MemoryBackend) Exists(ctx context.Context, key string) (bool, error) {
+	return m.MemoryCacheBackend.Exists(ctx, key)
+}
+
+// Clear removes all keys from the cache
+func (m *MemoryBackend) Clear(ctx context.Context) error {
+	return m.MemoryCacheBackend.Clear(ctx)
+}
+
+// GetStats returns cache statistics
+func (m *MemoryBackend) GetStats() map[string]interface{} {
+	stats, err := m.MemoryCacheBackend.GetStats(context.Background())
+	if err != nil {
+		return map[string]interface{}{
+			"error": err.Error(),
+		}
+	}
+
+	// Convert BackendStats to map
+	hitRate := float64(0)
+	total := stats.Hits + stats.Misses
+	if total > 0 {
+		hitRate = float64(stats.Hits) / float64(total)
+	}
+
+	return map[string]interface{}{
+		"type":       stats.Type,
+		"hits":       stats.Hits,
+		"misses":     stats.Misses,
+		"sets":       stats.Sets,
+		"deletes":    stats.Deletes,
+		"errors":     stats.Errors,
+		"evictions":  stats.Evictions,
+		"size":       stats.CurrentSize,
+		"max_size":   stats.MaxSize,
+		"memory":     stats.MemoryUsage,
+		"hit_rate":   hitRate,
+		"uptime":     stats.Uptime,
+		"start_time": stats.StartTime,
+	}
+}
+
+// Close shuts down the cache backend and releases resources
+func (m *MemoryBackend) Close() error {
+	return m.MemoryCacheBackend.Close()
+}
+
+// Ping checks if the backend is healthy and responsive
+func (m *MemoryBackend) Ping(ctx context.Context) error {
+	return m.MemoryCacheBackend.Ping(ctx)
+}
+
+// Ensure MemoryBackend implements CacheBackend
+var _ CacheBackend = (*MemoryBackend)(nil)

internal/cache/backends/redis.go

@@ -0,0 +1,455 @@
+package backends
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// Pure-Go Redis client implementation
+// Compatible with Yaegi interpreter (no unsafe package)
+// Implements RESP protocol for basic Redis operations
+
+var (
+	ErrPoolExhausted = errors.New("connection pool exhausted")
+)
+
+// RedisBackend implements a Redis-based cache backend using pure Go
+type RedisBackend struct {
+	config        *Config
+	pool          *ConnectionPool
+	healthMonitor *HealthMonitor
+
+	// Metrics
+	hits   atomic.Int64
+	misses atomic.Int64
+
+	// Lifecycle
+	closed atomic.Bool
+	mu     sync.Mutex
+}
+
+// NewRedisBackend creates a new Redis cache backend with pure-Go implementation
+func NewRedisBackend(config *Config) (*RedisBackend, error) {
+	if config == nil {
+		return nil, fmt.Errorf("config is required")
+	}
+
+	if config.RedisAddr == "" {
+		return nil, fmt.Errorf("redis address is required")
+	}
+
+	// Create connection pool with health checks enabled
+	poolConfig := &PoolConfig{
+		Address:           config.RedisAddr,
+		Password:          config.RedisPassword,
+		DB:                config.RedisDB,
+		MaxConnections:    config.PoolSize,
+		ConnectTimeout:    5 * time.Second,
+		ReadTimeout:       3 * time.Second,
+		WriteTimeout:      3 * time.Second,
+		EnableHealthCheck: true,
+		MaxRetries:        3,
+		RetryDelay:        100 * time.Millisecond,
+	}
+
+	pool, err := NewConnectionPool(poolConfig)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create connection pool: %w", err)
+	}
+
+	// Create health monitor
+	healthConfig := DefaultHealthMonitorConfig()
+	healthMonitor := NewHealthMonitor(pool, healthConfig)
+
+	backend := &RedisBackend{
+		config:        config,
+		pool:          pool,
+		healthMonitor: healthMonitor,
+	}
+
+	// Test connectivity
+	if err := backend.Ping(context.Background()); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("failed to ping Redis: %w", err)
+	}
+
+	// Start health monitoring
+	healthMonitor.Start()
+
+	return backend, nil
+}
+
+// Set stores a value in Redis with TTL
+func (r *RedisBackend) Set(ctx context.Context, key string, value []byte, ttl time.Duration) error {
+	if r.closed.Load() {
+		return ErrBackendClosed
+	}
+
+	prefixedKey := r.prefixKey(key)
+
+	// Execute with retry logic
+	return r.executeWithRetry(ctx, func(conn *RedisConn) error {
+		var err error
+
+		// Use PSETEX for millisecond precision, SETEX for second precision
+		if ttl > 0 {
+			ttlMillis := ttl.Milliseconds()
+			if ttlMillis < 1000 {
+				// Use PSETEX for sub-second TTLs (millisecond precision)
+				_, err = conn.Do("PSETEX", prefixedKey, fmt.Sprintf("%d", ttlMillis), string(value))
+			} else {
+				// Use SETEX for larger TTLs (second precision)
+				ttlSeconds := int(ttl.Seconds())
+				_, err = conn.Do("SETEX", prefixedKey, fmt.Sprintf("%d", ttlSeconds), string(value))
+			}
+		} else {
+			_, err = conn.Do("SET", prefixedKey, string(value))
+		}
+
+		return err
+	})
+}
+
+// Get retrieves a value from Redis
+func (r *RedisBackend) Get(ctx context.Context, key string) ([]byte, time.Duration, bool, error) {
+	if r.closed.Load() {
+		return nil, 0, false, ErrBackendClosed
+	}
+
+	prefixedKey := r.prefixKey(key)
+	var resultValue []byte
+	var resultTTL time.Duration
+	var resultExists bool
+
+	// Execute with retry logic
+	err := r.executeWithRetry(ctx, func(conn *RedisConn) error {
+		// Get value
+		resp, err := conn.Do("GET", prefixedKey)
+		if err != nil {
+			if errors.Is(err, ErrNilResponse) {
+				r.misses.Add(1)
+				resultExists = false
+				return nil // Not an error, key just doesn't exist
+			}
+			return err
+		}
+
+		value, err := RESPString(resp)
+		if err != nil {
+			return err
+		}
+
+		// Get TTL
+		ttlResp, err := conn.Do("TTL", prefixedKey)
+		if err != nil {
+			// If TTL fails, still return the value
+			r.hits.Add(1)
+			resultValue = []byte(value)
+			resultTTL = 0
+			resultExists = true
+			return nil
+		}
+
+		ttlSeconds, _ := RESPInt(ttlResp)
+		var ttl time.Duration
+		if ttlSeconds > 0 {
+			ttl = time.Duration(ttlSeconds) * time.Second
+		}
+
+		r.hits.Add(1)
+		resultValue = []byte(value)
+		resultTTL = ttl
+		resultExists = true
+		return nil
+	})
+
+	return resultValue, resultTTL, resultExists, err
+}
+
+// Delete removes a key from Redis
+func (r *RedisBackend) Delete(ctx context.Context, key string) (bool, error) {
+	if r.closed.Load() {
+		return false, ErrBackendClosed
+	}
+
+	conn, err := r.pool.Get(ctx)
+	if err != nil {
+		return false, err
+	}
+	defer r.pool.Put(conn)
+
+	prefixedKey := r.prefixKey(key)
+	resp, err := conn.Do("DEL", prefixedKey)
+	if err != nil {
+		return false, err
+	}
+
+	count, err := RESPInt(resp)
+	if err != nil {
+		return false, err
+	}
+
+	return count > 0, nil
+}
+
+// Exists checks if a key exists in Redis
+func (r *RedisBackend) Exists(ctx context.Context, key string) (bool, error) {
+	if r.closed.Load() {
+		return false, ErrBackendClosed
+	}
+
+	conn, err := r.pool.Get(ctx)
+	if err != nil {
+		return false, err
+	}
+	defer r.pool.Put(conn)
+
+	prefixedKey := r.prefixKey(key)
+	resp, err := conn.Do("EXISTS", prefixedKey)
+	if err != nil {
+		return false, err
+	}
+
+	count, err := RESPInt(resp)
+	if err != nil {
+		return false, err
+	}
+
+	return count > 0, nil
+}
+
+// Clear removes all keys with the configured prefix
+func (r *RedisBackend) Clear(ctx context.Context) error {
+	if r.closed.Load() {
+		return ErrBackendClosed
+	}
+
+	conn, err := r.pool.Get(ctx)
+	if err != nil {
+		return err
+	}
+	defer r.pool.Put(conn)
+
+	// Use FLUSHDB if no prefix (clear entire DB)
+	if r.config.RedisPrefix == "" {
+		_, err := conn.Do("FLUSHDB")
+		return err
+	}
+
+	// With prefix, we need to scan and delete keys
+	// For simplicity in this implementation, we'll use KEYS pattern (not recommended for production at scale)
+	pattern := r.config.RedisPrefix + "*"
+	resp, err := conn.Do("KEYS", pattern)
+	if err != nil {
+		return err
+	}
+
+	// Extract keys from array response
+	keys, ok := resp.([]interface{})
+	if !ok || len(keys) == 0 {
+		return nil
+	}
+
+	// Delete each key
+	for _, keyInterface := range keys {
+		key, err := RESPString(keyInterface)
+		if err != nil {
+			continue
+		}
+		conn.Do("DEL", key) // Best effort, ignore errors
+	}
+
+	return nil
+}
+
+// GetStats returns backend statistics
+func (r *RedisBackend) GetStats() map[string]interface{} {
+	hits := r.hits.Load()
+	misses := r.misses.Load()
+	total := hits + misses
+
+	hitRate := float64(0)
+	if total > 0 {
+		hitRate = float64(hits) / float64(total)
+	}
+
+	stats := map[string]interface{}{
+		"backend":  "redis-pure-go",
+		"address":  r.config.RedisAddr,
+		"hits":     hits,
+		"misses":   misses,
+		"hit_rate": hitRate,
+		"pool":     r.pool.Stats(),
+	}
+
+	// Add health monitor stats if available
+	if r.healthMonitor != nil {
+		stats["health"] = r.healthMonitor.GetStats()
+	}
+
+	return stats
+}
+
+// Ping checks Redis connectivity
+func (r *RedisBackend) Ping(ctx context.Context) error {
+	if r.closed.Load() {
+		return ErrBackendClosed
+	}
+
+	conn, err := r.pool.Get(ctx)
+	if err != nil {
+		return err
+	}
+	defer r.pool.Put(conn)
+
+	_, err = conn.Do("PING")
+	return err
+}
+
+// Close closes the Redis backend and all connections
+func (r *RedisBackend) Close() error {
+	if r.closed.Swap(true) {
+		return nil // Already closed
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	// Stop health monitor
+	if r.healthMonitor != nil {
+		r.healthMonitor.Stop()
+	}
+
+	// Close connection pool
+	if r.pool != nil {
+		return r.pool.Close()
+	}
+
+	return nil
+}
+
+// prefixKey adds the configured prefix to a key
+func (r *RedisBackend) prefixKey(key string) string {
+	if r.config.RedisPrefix == "" {
+		return key
+	}
+	return r.config.RedisPrefix + key
+}
+
+// executeWithRetry executes a Redis operation with exponential backoff retry logic
+func (r *RedisBackend) executeWithRetry(ctx context.Context, operation func(*RedisConn) error) error {
+	maxRetries := 3
+	baseDelay := 100 * time.Millisecond
+
+	for attempt := 0; attempt < maxRetries; attempt++ {
+		conn, err := r.pool.Get(ctx)
+		if err != nil {
+			// If we can't get a connection and this is the last attempt, fail
+			if attempt == maxRetries-1 {
+				return fmt.Errorf("failed to get connection after %d attempts: %w", maxRetries, err)
+			}
+
+			// Wait with exponential backoff before retrying
+			delay := baseDelay * time.Duration(1<<uint(attempt))
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case <-time.After(delay):
+				continue
+			}
+		}
+
+		// Execute the operation
+		err = operation(conn)
+		r.pool.Put(conn)
+
+		// If successful, return
+		if err == nil {
+			return nil
+		}
+
+		// If error is not retryable or last attempt, fail
+		if attempt == maxRetries-1 || !isRetryableError(err) {
+			return err
+		}
+
+		// Wait with exponential backoff before retrying
+		delay := baseDelay * time.Duration(1<<uint(attempt))
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(delay):
+			continue
+		}
+	}
+
+	return fmt.Errorf("operation failed after %d attempts", maxRetries)
+}
+
+// isRetryableError determines if an error is worth retrying
+func isRetryableError(err error) bool {
+	if err == nil {
+		return false
+	}
+
+	// Retry on connection errors, timeouts, etc.
+	// Don't retry on application-level errors like wrong type
+	errMsg := err.Error()
+	retryablePatterns := []string{
+		"connection",
+		"timeout",
+		"EOF",
+		"broken pipe",
+		"reset by peer",
+	}
+
+	for _, pattern := range retryablePatterns {
+		if contains(errMsg, pattern) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// SetMany stores multiple values in Redis (batch operation)
+func (r *RedisBackend) SetMany(ctx context.Context, items map[string][]byte, ttl time.Duration) error {
+	if r.closed.Load() {
+		return ErrBackendClosed
+	}
+
+	// For simplicity, execute sequentially (can be optimized with pipelining later)
+	for key, value := range items {
+		if err := r.Set(ctx, key, value, ttl); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// GetMany retrieves multiple values from Redis
+func (r *RedisBackend) GetMany(ctx context.Context, keys []string) (map[string][]byte, error) {
+	if r.closed.Load() {
+		return nil, ErrBackendClosed
+	}
+
+	result := make(map[string][]byte)
+
+	// For simplicity, execute sequentially
+	for _, key := range keys {
+		value, _, exists, err := r.Get(ctx, key)
+		if err != nil {
+			return nil, err
+		}
+		if exists {
+			result[key] = value
+		}
+	}
+
+	return result, nil
+}

internal/cache/backends/redis_health.go

@@ -0,0 +1,176 @@
+package backends
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// HealthMonitor continuously monitors Redis connection health and triggers reconnections
+type HealthMonitor struct {
+	pool   *ConnectionPool
+	config *HealthMonitorConfig
+
+	// State
+	healthy       atomic.Bool
+	running       atomic.Bool
+	lastCheckTime atomic.Int64 // Unix timestamp
+
+	// Metrics
+	consecutiveFailures atomic.Int64
+	totalChecks         atomic.Int64
+	totalFailures       atomic.Int64
+
+	// Lifecycle
+	stopChan chan struct{}
+	wg       sync.WaitGroup
+}
+
+// HealthMonitorConfig configures the health monitor
+type HealthMonitorConfig struct {
+	CheckInterval      time.Duration // How often to check health
+	Timeout            time.Duration // Timeout for health check
+	UnhealthyThreshold int           // Consecutive failures before marking unhealthy
+	OnHealthChange     func(healthy bool)
+}
+
+// DefaultHealthMonitorConfig returns default health monitor configuration
+func DefaultHealthMonitorConfig() *HealthMonitorConfig {
+	return &HealthMonitorConfig{
+		CheckInterval:      5 * time.Second,
+		Timeout:            3 * time.Second,
+		UnhealthyThreshold: 3,
+	}
+}
+
+// NewHealthMonitor creates a new health monitor
+func NewHealthMonitor(pool *ConnectionPool, config *HealthMonitorConfig) *HealthMonitor {
+	if config == nil {
+		config = DefaultHealthMonitorConfig()
+	}
+
+	hm := &HealthMonitor{
+		pool:     pool,
+		config:   config,
+		stopChan: make(chan struct{}),
+	}
+
+	hm.healthy.Store(true) // Assume healthy initially
+	return hm
+}
+
+// Start begins health monitoring
+func (hm *HealthMonitor) Start() {
+	if hm.running.Swap(true) {
+		return // Already running
+	}
+
+	hm.wg.Add(1)
+	go hm.monitorLoop()
+}
+
+// Stop stops health monitoring
+func (hm *HealthMonitor) Stop() {
+	if !hm.running.Swap(false) {
+		return // Not running
+	}
+
+	close(hm.stopChan)
+	hm.wg.Wait()
+}
+
+// IsHealthy returns the current health status
+func (hm *HealthMonitor) IsHealthy() bool {
+	return hm.healthy.Load()
+}
+
+// GetStats returns health monitor statistics
+func (hm *HealthMonitor) GetStats() map[string]interface{} {
+	lastCheck := time.Unix(hm.lastCheckTime.Load(), 0)
+
+	return map[string]interface{}{
+		"healthy":              hm.healthy.Load(),
+		"consecutive_failures": hm.consecutiveFailures.Load(),
+		"total_checks":         hm.totalChecks.Load(),
+		"total_failures":       hm.totalFailures.Load(),
+		"last_check":           lastCheck,
+	}
+}
+
+// monitorLoop runs the health check loop
+func (hm *HealthMonitor) monitorLoop() {
+	defer hm.wg.Done()
+
+	ticker := time.NewTicker(hm.config.CheckInterval)
+	defer ticker.Stop()
+
+	// Perform initial check immediately
+	hm.performHealthCheck()
+
+	for {
+		select {
+		case <-hm.stopChan:
+			return
+		case <-ticker.C:
+			hm.performHealthCheck()
+		}
+	}
+}
+
+// performHealthCheck executes a health check
+func (hm *HealthMonitor) performHealthCheck() {
+	hm.totalChecks.Add(1)
+	hm.lastCheckTime.Store(time.Now().Unix())
+
+	ctx, cancel := context.WithTimeout(context.Background(), hm.config.Timeout)
+	defer cancel()
+
+	// Try to get a connection and ping Redis
+	conn, err := hm.pool.Get(ctx)
+	if err != nil {
+		hm.recordFailure()
+		return
+	}
+	defer hm.pool.Put(conn)
+
+	// Ping Redis
+	_, err = conn.Do("PING")
+	if err != nil {
+		hm.recordFailure()
+		return
+	}
+
+	// Success!
+	hm.recordSuccess()
+}
+
+// recordSuccess records a successful health check
+func (hm *HealthMonitor) recordSuccess() {
+	wasHealthy := hm.healthy.Load()
+	hm.consecutiveFailures.Store(0)
+	hm.healthy.Store(true)
+
+	// Trigger callback if health changed
+	if !wasHealthy && hm.config.OnHealthChange != nil {
+		hm.config.OnHealthChange(true)
+	}
+}
+
+// recordFailure records a failed health check
+func (hm *HealthMonitor) recordFailure() {
+	hm.totalFailures.Add(1)
+	failures := hm.consecutiveFailures.Add(1)
+
+	wasHealthy := hm.healthy.Load()
+
+	// Mark unhealthy if threshold exceeded
+	if failures >= int64(hm.config.UnhealthyThreshold) {
+		hm.healthy.Store(false)
+
+		// Trigger callback if health changed
+		if wasHealthy && hm.config.OnHealthChange != nil {
+			hm.config.OnHealthChange(false)
+		}
+	}
+}

internal/cache/backends/redis_health_test.go

@@ -0,0 +1,421 @@
+package backends
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestHealthMonitor_BasicOperation tests basic health monitoring
+func TestHealthMonitor_BasicOperation(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 5,
+		ConnectTimeout: 5 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	// Create health monitor with fast check interval for testing
+	hmConfig := &HealthMonitorConfig{
+		CheckInterval:      100 * time.Millisecond,
+		Timeout:            1 * time.Second,
+		UnhealthyThreshold: 2,
+	}
+
+	hm := NewHealthMonitor(pool, hmConfig)
+	require.NotNil(t, hm)
+
+	// Initially should be healthy
+	assert.True(t, hm.IsHealthy())
+
+	// Start monitoring
+	hm.Start()
+	defer hm.Stop()
+
+	// Wait for a few checks
+	time.Sleep(500 * time.Millisecond)
+
+	// Should still be healthy
+	assert.True(t, hm.IsHealthy())
+
+	// Check stats
+	stats := hm.GetStats()
+	require.NotNil(t, stats)
+	assert.True(t, stats["healthy"].(bool))
+	assert.Greater(t, stats["total_checks"].(int64), int64(0))
+	assert.Equal(t, int64(0), stats["consecutive_failures"].(int64))
+}
+
+// TestHealthMonitor_HealthyToUnhealthy tests transition to unhealthy state
+func TestHealthMonitor_HealthyToUnhealthy(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 5,
+		ConnectTimeout: 100 * time.Millisecond,
+		ReadTimeout:    100 * time.Millisecond,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	var healthChangedCalled atomic.Bool
+	hmConfig := &HealthMonitorConfig{
+		CheckInterval:      50 * time.Millisecond,
+		Timeout:            100 * time.Millisecond,
+		UnhealthyThreshold: 2,
+		OnHealthChange: func(healthy bool) {
+			if !healthy {
+				healthChangedCalled.Store(true)
+			}
+		},
+	}
+
+	hm := NewHealthMonitor(pool, hmConfig)
+	hm.Start()
+	defer hm.Stop()
+
+	// Initially healthy
+	assert.True(t, hm.IsHealthy())
+
+	// Simulate Redis errors
+	mr.SetError("ERR server is down")
+
+	// Wait for health checks to detect failure (2 failures * 50ms + buffer)
+	time.Sleep(350 * time.Millisecond)
+
+	// Should now be unhealthy
+	assert.False(t, hm.IsHealthy(), "Health monitor should detect server failure")
+	assert.True(t, healthChangedCalled.Load(), "OnHealthChange callback should be called")
+
+	// Check stats
+	stats := hm.GetStats()
+	assert.False(t, stats["healthy"].(bool))
+	assert.GreaterOrEqual(t, stats["consecutive_failures"].(int64), int64(2))
+	assert.Greater(t, stats["total_failures"].(int64), int64(0))
+}
+
+// TestHealthMonitor_UnhealthyToHealthy tests recovery to healthy state
+func TestHealthMonitor_UnhealthyToHealthy(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 5,
+		ConnectTimeout: 100 * time.Millisecond,
+		ReadTimeout:    100 * time.Millisecond,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	var recoveryDetected atomic.Bool
+	hmConfig := &HealthMonitorConfig{
+		CheckInterval:      50 * time.Millisecond,
+		Timeout:            100 * time.Millisecond,
+		UnhealthyThreshold: 2,
+		OnHealthChange: func(healthy bool) {
+			if healthy {
+				recoveryDetected.Store(true)
+			}
+		},
+	}
+
+	hm := NewHealthMonitor(pool, hmConfig)
+	hm.Start()
+	defer hm.Stop()
+
+	// Initially healthy
+	assert.True(t, hm.IsHealthy())
+
+	// Simulate Redis errors
+	mr.SetError("ERR server is down")
+
+	// Wait for health checks to detect failure
+	time.Sleep(350 * time.Millisecond)
+
+	// Should now be unhealthy
+	assert.False(t, hm.IsHealthy(), "Should detect server failure")
+
+	// Clear error to simulate recovery
+	mr.ClearError()
+
+	// Wait for recovery
+	time.Sleep(350 * time.Millisecond)
+
+	// Should be healthy again
+	assert.True(t, hm.IsHealthy(), "Should recover after server restart")
+	assert.True(t, recoveryDetected.Load(), "Recovery callback should be called")
+
+	// Consecutive failures should be reset
+	stats := hm.GetStats()
+	assert.True(t, stats["healthy"].(bool))
+	assert.Equal(t, int64(0), stats["consecutive_failures"].(int64))
+}
+
+// TestHealthMonitor_StartStop tests start/stop behavior
+func TestHealthMonitor_StartStop(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 5,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	hm := NewHealthMonitor(pool, DefaultHealthMonitorConfig())
+
+	// Start monitoring
+	hm.Start()
+	assert.True(t, hm.running.Load())
+
+	// Starting again should be no-op
+	hm.Start()
+	assert.True(t, hm.running.Load())
+
+	// Stop monitoring
+	hm.Stop()
+	assert.False(t, hm.running.Load())
+
+	// Stopping again should be no-op
+	hm.Stop()
+	assert.False(t, hm.running.Load())
+}
+
+// TestHealthMonitor_MultipleMonitors tests multiple health monitors
+func TestHealthMonitor_MultipleMonitors(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 10,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	// Create multiple monitors
+	hm1 := NewHealthMonitor(pool, &HealthMonitorConfig{
+		CheckInterval:      100 * time.Millisecond,
+		Timeout:            1 * time.Second,
+		UnhealthyThreshold: 2,
+	})
+
+	hm2 := NewHealthMonitor(pool, &HealthMonitorConfig{
+		CheckInterval:      150 * time.Millisecond,
+		Timeout:            1 * time.Second,
+		UnhealthyThreshold: 3,
+	})
+
+	// Start both
+	hm1.Start()
+	hm2.Start()
+
+	// Both should be healthy
+	time.Sleep(200 * time.Millisecond)
+	assert.True(t, hm1.IsHealthy())
+	assert.True(t, hm2.IsHealthy())
+
+	// Stop both
+	hm1.Stop()
+	hm2.Stop()
+
+	// Verify they stopped
+	assert.False(t, hm1.running.Load())
+	assert.False(t, hm2.running.Load())
+}
+
+// TestHealthMonitor_StatsAccuracy tests stats tracking
+func TestHealthMonitor_StatsAccuracy(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 5,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	hm := NewHealthMonitor(pool, &HealthMonitorConfig{
+		CheckInterval:      100 * time.Millisecond,
+		Timeout:            1 * time.Second,
+		UnhealthyThreshold: 2,
+	})
+
+	hm.Start()
+	defer hm.Stop()
+
+	// Wait for some checks
+	time.Sleep(550 * time.Millisecond)
+
+	stats := hm.GetStats()
+
+	// Should have performed multiple checks
+	totalChecks := stats["total_checks"].(int64)
+	assert.GreaterOrEqual(t, totalChecks, int64(4))
+
+	// All checks should succeed
+	assert.Equal(t, int64(0), stats["total_failures"].(int64))
+	assert.Equal(t, int64(0), stats["consecutive_failures"].(int64))
+
+	// Last check time should be recent (within check interval + buffer)
+	// Use 2s tolerance to account for CI runner load and timing variance
+	lastCheck := stats["last_check"].(time.Time)
+	assert.WithinDuration(t, time.Now(), lastCheck, 2*time.Second)
+}
+
+// TestHealthMonitor_DefaultConfig tests default configuration
+func TestHealthMonitor_DefaultConfig(t *testing.T) {
+	config := DefaultHealthMonitorConfig()
+
+	assert.Equal(t, 5*time.Second, config.CheckInterval)
+	assert.Equal(t, 3*time.Second, config.Timeout)
+	assert.Equal(t, 3, config.UnhealthyThreshold)
+	assert.Nil(t, config.OnHealthChange)
+}
+
+// TestHealthMonitor_PoolExhaustion tests behavior when pool is exhausted
+func TestHealthMonitor_PoolExhaustion(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 1, // Very small pool
+		ConnectTimeout: 100 * time.Millisecond,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	hm := NewHealthMonitor(pool, &HealthMonitorConfig{
+		CheckInterval:      100 * time.Millisecond,
+		Timeout:            50 * time.Millisecond, // Short timeout
+		UnhealthyThreshold: 2,
+	})
+
+	hm.Start()
+	defer hm.Stop()
+
+	// Get the only connection, blocking health checks
+	ctx := context.Background()
+	conn, err := pool.Get(ctx)
+	require.NoError(t, err)
+
+	// Wait for health check attempts
+	time.Sleep(350 * time.Millisecond)
+
+	// Health monitor might mark as unhealthy due to timeouts
+	stats := hm.GetStats()
+	t.Logf("Stats with blocked pool: %+v", stats)
+
+	// Return connection
+	pool.Put(conn)
+
+	// Wait for recovery
+	time.Sleep(300 * time.Millisecond)
+
+	// Should recover
+	assert.True(t, hm.IsHealthy())
+}
+
+// TestConnectionPool_WithHealthChecks tests pool with health checks enabled
+func TestConnectionPool_WithHealthChecks(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:           mr.GetAddr(),
+		MaxConnections:    5,
+		ConnectTimeout:    5 * time.Second,
+		EnableHealthCheck: true,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	ctx := context.Background()
+
+	// Get a connection
+	conn, err := pool.Get(ctx)
+	require.NoError(t, err)
+	require.NotNil(t, conn)
+
+	// Connection should be healthy
+	assert.True(t, pool.isConnectionHealthy(conn))
+
+	// Use connection
+	resp, err := conn.Do("PING")
+	require.NoError(t, err)
+	assert.Equal(t, "PONG", resp)
+
+	// Return to pool
+	pool.Put(conn)
+
+	// Get again - should reuse and validate
+	conn2, err := pool.Get(ctx)
+	require.NoError(t, err)
+	require.NotNil(t, conn2)
+
+	pool.Put(conn2)
+}
+
+// TestConnectionPool_StaleConnectionRemoval tests stale connection handling
+func TestConnectionPool_StaleConnectionRemoval(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:           mr.GetAddr(),
+		MaxConnections:    3,
+		ConnectTimeout:    5 * time.Second,
+		EnableHealthCheck: true,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	ctx := context.Background()
+
+	// Get and return a connection
+	conn, err := pool.Get(ctx)
+	require.NoError(t, err)
+	pool.Put(conn)
+
+	initialTotal := pool.totalConns.Load()
+
+	// Close the connection manually to make it stale
+	conn.Close()
+
+	// Get another connection - should detect stale and create new
+	conn2, err := pool.Get(ctx)
+	require.NoError(t, err)
+	require.NotNil(t, conn2)
+
+	// Connection should be healthy
+	assert.True(t, pool.isConnectionHealthy(conn2))
+
+	pool.Put(conn2)
+
+	// Total connections might be same or less (stale removed)
+	finalTotal := pool.totalConns.Load()
+	assert.LessOrEqual(t, finalTotal, initialTotal+1)
+}

internal/cache/backends/redis_pool.go

@@ -0,0 +1,325 @@
+package backends
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// ConnectionPool manages a pool of Redis connections
+// Pure-Go implementation compatible with Yaegi
+type ConnectionPool struct {
+	config *PoolConfig
+
+	connections chan *RedisConn
+	mu          sync.Mutex
+	closed      atomic.Bool
+
+	// Metrics
+	activeConns atomic.Int32
+	totalConns  atomic.Int32
+	gets        atomic.Int64
+	puts        atomic.Int64
+	timeouts    atomic.Int64
+}
+
+// PoolConfig holds connection pool configuration
+type PoolConfig struct {
+	Address           string
+	Password          string
+	DB                int
+	MaxConnections    int
+	ConnectTimeout    time.Duration
+	ReadTimeout       time.Duration
+	WriteTimeout      time.Duration
+	EnableHealthCheck bool          // Enable connection health validation
+	MaxRetries        int           // Max retries for failed operations
+	RetryDelay        time.Duration // Initial delay between retries
+}
+
+// NewConnectionPool creates a new connection pool
+func NewConnectionPool(config *PoolConfig) (*ConnectionPool, error) {
+	if config == nil {
+		return nil, errors.New("config is required")
+	}
+
+	if config.MaxConnections <= 0 {
+		config.MaxConnections = 10
+	}
+
+	if config.ConnectTimeout == 0 {
+		config.ConnectTimeout = 5 * time.Second
+	}
+
+	pool := &ConnectionPool{
+		config:      config,
+		connections: make(chan *RedisConn, config.MaxConnections),
+	}
+
+	return pool, nil
+}
+
+// Get retrieves a connection from the pool or creates a new one
+func (p *ConnectionPool) Get(ctx context.Context) (*RedisConn, error) {
+	if p.closed.Load() {
+		return nil, ErrBackendClosed
+	}
+
+	p.gets.Add(1)
+
+	// Try to get a connection with validation
+	maxAttempts := 3
+	for attempt := 0; attempt < maxAttempts; attempt++ {
+		var conn *RedisConn
+		var err error
+
+		select {
+		case conn = <-p.connections:
+			// Reuse existing connection - validate if health check enabled
+			if p.config.EnableHealthCheck && !p.isConnectionHealthy(conn) {
+				// Connection is stale, close it and try again
+				conn.Close()
+				p.totalConns.Add(-1)
+				continue
+			}
+			p.activeConns.Add(1)
+			return conn, nil
+
+		case <-ctx.Done():
+			return nil, ctx.Err()
+
+		default:
+			// No available connection, create new one if under limit
+			if p.totalConns.Load() < int32(p.config.MaxConnections) {
+				conn, err = p.createConnection()
+				if err != nil {
+					// If this is the last attempt, return error
+					if attempt == maxAttempts-1 {
+						return nil, err
+					}
+					// Wait before retry with exponential backoff
+					time.Sleep(time.Duration(attempt+1) * 100 * time.Millisecond)
+					continue
+				}
+				p.activeConns.Add(1)
+				p.totalConns.Add(1)
+				return conn, nil
+			}
+
+			// Pool exhausted, wait for a connection with timeout
+			select {
+			case conn = <-p.connections:
+				// Validate connection if health check enabled
+				if p.config.EnableHealthCheck && !p.isConnectionHealthy(conn) {
+					conn.Close()
+					p.totalConns.Add(-1)
+					continue
+				}
+				p.activeConns.Add(1)
+				return conn, nil
+			case <-ctx.Done():
+				p.timeouts.Add(1)
+				return nil, ctx.Err()
+			case <-time.After(p.config.ConnectTimeout):
+				p.timeouts.Add(1)
+				return nil, ErrPoolExhausted
+			}
+		}
+	}
+
+	return nil, errors.New("failed to get healthy connection after retries")
+}
+
+// Put returns a connection to the pool
+func (p *ConnectionPool) Put(conn *RedisConn) {
+	if conn == nil {
+		return
+	}
+
+	p.puts.Add(1)
+	p.activeConns.Add(-1)
+
+	if p.closed.Load() || conn.closed.Load() {
+		conn.Close()
+		p.totalConns.Add(-1)
+		return
+	}
+
+	// Return to pool (non-blocking)
+	select {
+	case p.connections <- conn:
+		// Successfully returned to pool
+	default:
+		// Pool full, close connection
+		conn.Close()
+		p.totalConns.Add(-1)
+	}
+}
+
+// Close closes all connections in the pool
+func (p *ConnectionPool) Close() error {
+	if p.closed.Swap(true) {
+		return nil
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	close(p.connections)
+
+	// Close all pooled connections
+	for conn := range p.connections {
+		conn.Close()
+	}
+
+	return nil
+}
+
+// Stats returns pool statistics
+func (p *ConnectionPool) Stats() map[string]interface{} {
+	return map[string]interface{}{
+		"active_connections": p.activeConns.Load(),
+		"total_connections":  p.totalConns.Load(),
+		"max_connections":    p.config.MaxConnections,
+		"gets":               p.gets.Load(),
+		"puts":               p.puts.Load(),
+		"timeouts":           p.timeouts.Load(),
+	}
+}
+
+// createConnection creates a new Redis connection
+func (p *ConnectionPool) createConnection() (*RedisConn, error) {
+	// Connect with timeout
+	dialer := &net.Dialer{
+		Timeout: p.config.ConnectTimeout,
+	}
+
+	conn, err := dialer.Dial("tcp", p.config.Address)
+	if err != nil {
+		return nil, fmt.Errorf("failed to connect to Redis: %w", err)
+	}
+
+	redisConn := &RedisConn{
+		conn:         conn,
+		readTimeout:  p.config.ReadTimeout,
+		writeTimeout: p.config.WriteTimeout,
+	}
+
+	// Authenticate if password is provided
+	if p.config.Password != "" {
+		if _, err := redisConn.Do("AUTH", p.config.Password); err != nil {
+			redisConn.Close()
+			return nil, fmt.Errorf("authentication failed: %w", err)
+		}
+	}
+
+	// Select database
+	if p.config.DB != 0 {
+		if _, err := redisConn.Do("SELECT", fmt.Sprintf("%d", p.config.DB)); err != nil {
+			redisConn.Close()
+			return nil, fmt.Errorf("failed to select database: %w", err)
+		}
+	}
+
+	return redisConn, nil
+}
+
+// RedisConn represents a single Redis connection
+type RedisConn struct {
+	conn         net.Conn
+	readTimeout  time.Duration
+	writeTimeout time.Duration
+	closed       atomic.Bool
+	mu           sync.Mutex
+}
+
+// Do executes a Redis command and returns the response
+func (c *RedisConn) Do(command string, args ...string) (interface{}, error) {
+	if c.closed.Load() {
+		return nil, ErrBackendClosed
+	}
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	// Build command arguments
+	// Check for overflow: ensure len(args)+1 doesn't cause allocation overflow
+	// Limit to a safe value that prevents integer overflow in allocation size calculation
+	// (capacity * sizeof(string) must fit in int/size_t)
+	argsLen := len(args)
+	const maxSafeArgs = (1 << 20) - 1 // 1M args is already absurdly large for Redis commands
+	if argsLen < 0 || argsLen > maxSafeArgs {
+		return nil, errors.New("too many arguments")
+	}
+	cmdArgs := make([]string, 0, argsLen+1)
+	cmdArgs = append(cmdArgs, command)
+	cmdArgs = append(cmdArgs, args...)
+
+	// Set write timeout
+	if c.writeTimeout > 0 {
+		c.conn.SetWriteDeadline(time.Now().Add(c.writeTimeout))
+	}
+
+	// Write command (using pooled writer for memory efficiency)
+	writer := NewRESPWriter(c.conn)
+	err := writer.WriteCommand(cmdArgs...)
+	writer.Release() // Return to pool immediately after use
+	if err != nil {
+		c.closed.Store(true)
+		return nil, err
+	}
+
+	// Set read timeout
+	if c.readTimeout > 0 {
+		c.conn.SetReadDeadline(time.Now().Add(c.readTimeout))
+	}
+
+	// Read response (using pooled reader for memory efficiency)
+	reader := NewRESPReader(c.conn)
+	resp, err := reader.ReadResponse()
+	reader.Release() // Return to pool immediately after use
+	if err != nil {
+		if !errors.Is(err, ErrNilResponse) {
+			c.closed.Store(true)
+		}
+		return nil, err
+	}
+
+	return resp, nil
+}
+
+// Close closes the connection
+func (c *RedisConn) Close() error {
+	if c.closed.Swap(true) {
+		return nil
+	}
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.conn != nil {
+		return c.conn.Close()
+	}
+
+	return nil
+}
+
+// isConnectionHealthy validates a connection is still working
+func (p *ConnectionPool) isConnectionHealthy(conn *RedisConn) bool {
+	if conn == nil || conn.closed.Load() {
+		return false
+	}
+
+	// Set a read deadline for the ping
+	if conn.conn != nil {
+		conn.conn.SetReadDeadline(time.Now().Add(1 * time.Second))
+		defer conn.conn.SetReadDeadline(time.Time{}) // Clear deadline
+	}
+
+	_, err := conn.Do("PING")
+	return err == nil
+}

internal/cache/backends/redis_pool_test.go

@@ -0,0 +1,620 @@
+package backends
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestConnectionPool_BasicOperations tests basic pool operations
+func TestConnectionPool_BasicOperations(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 5,
+		ConnectTimeout: 5 * time.Second,
+		ReadTimeout:    3 * time.Second,
+		WriteTimeout:   3 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	t.Run("GetAndPutConnection", func(t *testing.T) {
+		ctx := context.Background()
+
+		// Get a connection
+		conn, err := pool.Get(ctx)
+		require.NoError(t, err)
+		require.NotNil(t, conn)
+
+		// Verify connection works
+		resp, err := conn.Do("PING")
+		require.NoError(t, err)
+		assert.Equal(t, "PONG", resp)
+
+		// Return to pool
+		pool.Put(conn)
+
+		// Get again - should reuse same connection
+		conn2, err := pool.Get(ctx)
+		require.NoError(t, err)
+		require.NotNil(t, conn2)
+
+		pool.Put(conn2)
+	})
+
+	t.Run("Stats", func(t *testing.T) {
+		stats := pool.Stats()
+		require.NotNil(t, stats)
+
+		assert.Contains(t, stats, "active_connections")
+		assert.Contains(t, stats, "total_connections")
+		assert.Contains(t, stats, "max_connections")
+		assert.Equal(t, 5, stats["max_connections"])
+	})
+}
+
+// TestConnectionPool_MaxConnections tests pool size limits
+func TestConnectionPool_MaxConnections(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	maxConns := 3
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: maxConns,
+		ConnectTimeout: 1 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	ctx := context.Background()
+
+	// Get max connections
+	conns := make([]*RedisConn, maxConns)
+	for i := 0; i < maxConns; i++ {
+		conn, err := pool.Get(ctx)
+		require.NoError(t, err)
+		conns[i] = conn
+	}
+
+	// Verify stats
+	stats := pool.Stats()
+	assert.Equal(t, int32(maxConns), stats["total_connections"])
+	assert.Equal(t, int32(maxConns), stats["active_connections"])
+
+	// Try to get one more - should block/timeout
+	ctx2, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+
+	conn, err := pool.Get(ctx2)
+	require.Error(t, err)
+	require.Nil(t, conn)
+
+	// Return one connection
+	pool.Put(conns[0])
+
+	// Now we should be able to get a connection
+	conn, err = pool.Get(context.Background())
+	require.NoError(t, err)
+	require.NotNil(t, conn)
+
+	// Cleanup
+	pool.Put(conn)
+	for i := 1; i < maxConns; i++ {
+		pool.Put(conns[i])
+	}
+}
+
+// TestConnectionPool_ConcurrentAccess tests concurrent pool usage
+func TestConnectionPool_ConcurrentAccess(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 10,
+		ConnectTimeout: 5 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	ctx := context.Background()
+	numGoroutines := 50
+	numOperations := 20
+
+	var wg sync.WaitGroup
+	errors := make(chan error, numGoroutines*numOperations)
+
+	// Spawn goroutines
+	for i := 0; i < numGoroutines; i++ {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+
+			for j := 0; j < numOperations; j++ {
+				conn, err := pool.Get(ctx)
+				if err != nil {
+					errors <- err
+					continue
+				}
+
+				// Do some work
+				_, err = conn.Do("PING")
+				if err != nil {
+					errors <- err
+				}
+
+				// Return to pool
+				pool.Put(conn)
+
+				// Small delay
+				time.Sleep(time.Millisecond)
+			}
+		}(i)
+	}
+
+	wg.Wait()
+	close(errors)
+
+	// Check for errors
+	errorCount := 0
+	for err := range errors {
+		t.Logf("Error: %v", err)
+		errorCount++
+	}
+
+	assert.Equal(t, 0, errorCount, "Expected no errors in concurrent access")
+
+	// Verify stats
+	stats := pool.Stats()
+	t.Logf("Final stats: %+v", stats)
+	assert.LessOrEqual(t, stats["total_connections"].(int32), int32(10))
+	assert.Equal(t, int32(0), stats["active_connections"])
+}
+
+// TestConnectionPool_ContextCancellation tests context cancellation
+func TestConnectionPool_ContextCancellation(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 1,
+		ConnectTimeout: 5 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	// Get the only connection
+	conn, err := pool.Get(context.Background())
+	require.NoError(t, err)
+
+	// Try to get another with cancelled context
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // Cancel immediately
+
+	conn2, err := pool.Get(ctx)
+	require.Error(t, err)
+	require.Nil(t, conn2)
+	assert.Contains(t, err.Error(), "context canceled")
+
+	// Cleanup
+	pool.Put(conn)
+}
+
+// TestConnectionPool_Authentication tests auth support
+func TestConnectionPool_Authentication(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	// Set password on miniredis
+	mr.server.RequireAuth("secret-password")
+
+	t.Run("CorrectPassword", func(t *testing.T) {
+		config := &PoolConfig{
+			Address:        mr.GetAddr(),
+			Password:       "secret-password",
+			MaxConnections: 2,
+			ConnectTimeout: 5 * time.Second,
+		}
+
+		pool, err := NewConnectionPool(config)
+		require.NoError(t, err)
+		defer pool.Close()
+
+		conn, err := pool.Get(context.Background())
+		require.NoError(t, err)
+
+		resp, err := conn.Do("PING")
+		require.NoError(t, err)
+		assert.Equal(t, "PONG", resp)
+
+		pool.Put(conn)
+	})
+
+	t.Run("WrongPassword", func(t *testing.T) {
+		t.Skip("Miniredis doesn't fully simulate AUTH errors like real Redis")
+
+		config := &PoolConfig{
+			Address:        mr.GetAddr(),
+			Password:       "wrong-password",
+			MaxConnections: 2,
+			ConnectTimeout: 5 * time.Second,
+		}
+
+		_, err := NewConnectionPool(config)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "authentication failed")
+	})
+}
+
+// TestConnectionPool_DatabaseSelection tests DB selection
+func TestConnectionPool_DatabaseSelection(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		DB:             5,
+		MaxConnections: 2,
+		ConnectTimeout: 5 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	conn, err := pool.Get(context.Background())
+	require.NoError(t, err)
+
+	// Connection should be on DB 5
+	resp, err := conn.Do("PING")
+	require.NoError(t, err)
+	assert.Equal(t, "PONG", resp)
+
+	pool.Put(conn)
+}
+
+// TestConnectionPool_ClosedConnection tests handling closed connections
+func TestConnectionPool_ClosedConnection(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 2,
+		ConnectTimeout: 5 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	// Get connection
+	conn, err := pool.Get(context.Background())
+	require.NoError(t, err)
+
+	// Close it manually
+	conn.Close()
+
+	// Try to use it
+	_, err = conn.Do("PING")
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, ErrBackendClosed))
+
+	// Return to pool (should be discarded)
+	pool.Put(conn)
+
+	// Get new connection - should create a new one
+	conn2, err := pool.Get(context.Background())
+	require.NoError(t, err)
+	require.NotNil(t, conn2)
+
+	resp, err := conn2.Do("PING")
+	require.NoError(t, err)
+	assert.Equal(t, "PONG", resp)
+
+	pool.Put(conn2)
+}
+
+// TestConnectionPool_Close tests pool closure
+func TestConnectionPool_Close(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 5,
+		ConnectTimeout: 5 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+
+	// Get some connections
+	conns := make([]*RedisConn, 3)
+	for i := 0; i < 3; i++ {
+		conn, err := pool.Get(context.Background())
+		require.NoError(t, err)
+		conns[i] = conn
+	}
+
+	// Return them
+	for _, conn := range conns {
+		pool.Put(conn)
+	}
+
+	// Close pool
+	err = pool.Close()
+	require.NoError(t, err)
+
+	// Try to get connection from closed pool
+	_, err = pool.Get(context.Background())
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, ErrBackendClosed))
+
+	// Close again should be no-op
+	err = pool.Close()
+	require.NoError(t, err)
+}
+
+// TestConnectionPool_Timeouts tests various timeout scenarios
+func TestConnectionPool_Timeouts(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 2,
+		ConnectTimeout: 100 * time.Millisecond,
+		ReadTimeout:    100 * time.Millisecond,
+		WriteTimeout:   100 * time.Millisecond,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	conn, err := pool.Get(context.Background())
+	require.NoError(t, err)
+
+	// Normal operation should work
+	resp, err := conn.Do("PING")
+	require.NoError(t, err)
+	assert.Equal(t, "PONG", resp)
+
+	pool.Put(conn)
+}
+
+// TestRedisConn_DoCommand tests the Do method
+func TestRedisConn_DoCommand(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 2,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	conn, err := pool.Get(context.Background())
+	require.NoError(t, err)
+	defer pool.Put(conn)
+
+	t.Run("SET and GET", func(t *testing.T) {
+		// SET
+		resp, err := conn.Do("SET", "testkey", "testvalue")
+		require.NoError(t, err)
+		assert.Equal(t, "OK", resp)
+
+		// GET
+		resp, err = conn.Do("GET", "testkey")
+		require.NoError(t, err)
+		assert.Equal(t, "testvalue", resp)
+	})
+
+	t.Run("DEL", func(t *testing.T) {
+		// SET key first
+		_, err := conn.Do("SET", "delkey", "delvalue")
+		require.NoError(t, err)
+
+		// DEL
+		resp, err := conn.Do("DEL", "delkey")
+		require.NoError(t, err)
+
+		count, err := RESPInt(resp)
+		require.NoError(t, err)
+		assert.Equal(t, int64(1), count)
+	})
+
+	t.Run("EXISTS", func(t *testing.T) {
+		// SET key first
+		_, err := conn.Do("SET", "existskey", "value")
+		require.NoError(t, err)
+
+		// EXISTS - key exists
+		resp, err := conn.Do("EXISTS", "existskey")
+		require.NoError(t, err)
+
+		count, err := RESPInt(resp)
+		require.NoError(t, err)
+		assert.Equal(t, int64(1), count)
+
+		// EXISTS - key doesn't exist
+		resp, err = conn.Do("EXISTS", "nonexistent")
+		require.NoError(t, err)
+
+		count, err = RESPInt(resp)
+		require.NoError(t, err)
+		assert.Equal(t, int64(0), count)
+	})
+
+	t.Run("TTL commands", func(t *testing.T) {
+		// SETEX
+		resp, err := conn.Do("SETEX", "ttlkey", "60", "ttlvalue")
+		require.NoError(t, err)
+		assert.Equal(t, "OK", resp)
+
+		// TTL
+		resp, err = conn.Do("TTL", "ttlkey")
+		require.NoError(t, err)
+
+		ttl, err := RESPInt(resp)
+		require.NoError(t, err)
+		assert.Greater(t, ttl, int64(0))
+		assert.LessOrEqual(t, ttl, int64(60))
+	})
+}
+
+// TestPoolConfig_Defaults tests default configuration values
+func TestPoolConfig_Defaults(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address: mr.GetAddr(),
+		// Leave other fields at zero values
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	// Should use defaults
+	assert.Equal(t, 10, pool.config.MaxConnections)
+	assert.Equal(t, 5*time.Second, pool.config.ConnectTimeout)
+
+	// Verify it works
+	conn, err := pool.Get(context.Background())
+	require.NoError(t, err)
+	pool.Put(conn)
+}
+
+// TestConnectionPool_NilConnection tests handling nil connections
+func TestConnectionPool_NilConnection(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 2,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	// Putting nil should be safe
+	pool.Put(nil)
+
+	// Pool should still work
+	conn, err := pool.Get(context.Background())
+	require.NoError(t, err)
+	require.NotNil(t, conn)
+	pool.Put(conn)
+}
+
+// TestConnectionPool_StatsTracking tests metrics tracking
+func TestConnectionPool_StatsTracking(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 5,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	ctx := context.Background()
+
+	// Initial stats
+	stats := pool.Stats()
+	initialGets := stats["gets"].(int64)
+	initialPuts := stats["puts"].(int64)
+
+	// Perform operations
+	numOps := 10
+	for i := 0; i < numOps; i++ {
+		conn, err := pool.Get(ctx)
+		require.NoError(t, err)
+		pool.Put(conn)
+	}
+
+	// Check updated stats
+	stats = pool.Stats()
+	assert.Equal(t, initialGets+int64(numOps), stats["gets"].(int64))
+	assert.Equal(t, initialPuts+int64(numOps), stats["puts"].(int64))
+	assert.Equal(t, int32(0), stats["active_connections"].(int32))
+}
+
+// TestRedisConn_TooManyArguments tests protection against allocation overflow
+func TestRedisConn_TooManyArguments(t *testing.T) {
+	mr := NewMiniredisServer(t)
+
+	config := &PoolConfig{
+		Address:        mr.GetAddr(),
+		MaxConnections: 1,
+		ConnectTimeout: 5 * time.Second,
+		ReadTimeout:    3 * time.Second,
+		WriteTimeout:   3 * time.Second,
+	}
+
+	pool, err := NewConnectionPool(config)
+	require.NoError(t, err)
+	defer pool.Close()
+
+	ctx := context.Background()
+	conn, err := pool.Get(ctx)
+	require.NoError(t, err)
+	defer pool.Put(conn)
+
+	t.Run("AcceptableArgumentCount", func(t *testing.T) {
+		// Should work with reasonable number of args
+		args := make([]string, 100)
+		for i := range args {
+			args[i] = "value"
+		}
+		_, err := conn.Do("MSET", args...)
+		// May fail due to Redis constraints, but shouldn't panic or error on overflow
+		// Just verify it doesn't trigger our overflow protection
+		if err != nil {
+			assert.NotContains(t, err.Error(), "too many arguments")
+		}
+	})
+
+	t.Run("RejectExcessiveArguments", func(t *testing.T) {
+		// Create an absurdly large number of arguments that would cause overflow
+		// Use 1M + 1 to exceed maxSafeArgs = (1<<20)-1 = 1048575
+		args := make([]string, 1<<20) // 1,048,576 args
+		for i := range args {
+			args[i] = "x"
+		}
+
+		_, err := conn.Do("MSET", args...)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "too many arguments")
+	})
+
+	t.Run("BoundaryCase", func(t *testing.T) {
+		// Test exactly at the boundary (maxSafeArgs)
+		args := make([]string, (1<<20)-1) // Exactly 1,048,575 args (max allowed)
+		for i := range args {
+			args[i] = "x"
+		}
+
+		_, err := conn.Do("ECHO", args...)
+		// Should not error due to overflow protection
+		if err != nil {
+			assert.NotContains(t, err.Error(), "too many arguments")
+		}
+	})
+}

internal/cache/backends/redis_test.go

@@ -0,0 +1,545 @@
+package backends
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRedisBackend_BasicOperations tests basic Redis operations
+func TestRedisBackend_BasicOperations(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	t.Run("SetAndGet", func(t *testing.T) {
+		key := "redis-test-key"
+		value := []byte("redis-test-value")
+		ttl := 1 * time.Minute
+
+		err := backend.Set(ctx, key, value, ttl)
+		require.NoError(t, err)
+
+		retrieved, remainingTTL, exists, err := backend.Get(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, exists)
+		assert.Equal(t, value, retrieved)
+		assert.Greater(t, remainingTTL, 50*time.Second)
+	})
+
+	t.Run("GetNonExistent", func(t *testing.T) {
+		_, _, exists, err := backend.Get(ctx, "non-existent-redis-key")
+		require.NoError(t, err)
+		assert.False(t, exists)
+	})
+
+	t.Run("Delete", func(t *testing.T) {
+		key := "redis-delete-key"
+		value := []byte("redis-delete-value")
+
+		err := backend.Set(ctx, key, value, 1*time.Minute)
+		require.NoError(t, err)
+
+		deleted, err := backend.Delete(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, deleted)
+
+		exists, err := backend.Exists(ctx, key)
+		require.NoError(t, err)
+		assert.False(t, exists)
+	})
+
+	t.Run("Exists", func(t *testing.T) {
+		key := "redis-exists-key"
+		value := []byte("redis-exists-value")
+
+		exists, err := backend.Exists(ctx, key)
+		require.NoError(t, err)
+		assert.False(t, exists)
+
+		err = backend.Set(ctx, key, value, 1*time.Minute)
+		require.NoError(t, err)
+
+		exists, err = backend.Exists(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, exists)
+	})
+}
+
+// TestRedisBackend_KeyPrefixing tests key namespace prefixing
+func TestRedisBackend_KeyPrefixing(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	config.RedisPrefix = "test:prefix:"
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	key := "my-key"
+	value := []byte("my-value")
+
+	err = backend.Set(ctx, key, value, 1*time.Minute)
+	require.NoError(t, err)
+
+	// Check that key is stored with prefix
+	keys := mr.CheckKeys()
+	require.Len(t, keys, 1)
+	assert.Equal(t, "test:prefix:my-key", keys[0])
+
+	// Get should work without prefix
+	retrieved, _, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, value, retrieved)
+}
+
+// TestRedisBackend_TTLExpiration tests TTL handling
+func TestRedisBackend_TTLExpiration(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	t.Run("ShortTTL", func(t *testing.T) {
+		key := "ttl-key"
+		value := []byte("ttl-value")
+		shortTTL := 100 * time.Millisecond
+
+		err := backend.Set(ctx, key, value, shortTTL)
+		require.NoError(t, err)
+
+		// Exists immediately
+		exists, err := backend.Exists(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, exists)
+
+		// Fast forward time in miniredis
+		mr.FastForward(150 * time.Millisecond)
+
+		// Should be expired
+		exists, err = backend.Exists(ctx, key)
+		require.NoError(t, err)
+		assert.False(t, exists)
+	})
+
+	t.Run("TTLRemaining", func(t *testing.T) {
+		key := "ttl-remaining-key"
+		value := []byte("ttl-remaining-value")
+		ttl := 10 * time.Second
+
+		err := backend.Set(ctx, key, value, ttl)
+		require.NoError(t, err)
+
+		// Get immediately
+		_, ttl1, exists, err := backend.Get(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, exists)
+
+		// Fast forward 2 seconds
+		mr.FastForward(2 * time.Second)
+
+		// Check TTL is less
+		_, ttl2, exists, err := backend.Get(ctx, key)
+		require.NoError(t, err)
+		assert.True(t, exists)
+		assert.Less(t, ttl2, ttl1)
+	})
+}
+
+// TestRedisBackend_Clear tests clearing all keys
+func TestRedisBackend_Clear(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	config.RedisPrefix = "clear-test:"
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	// Add multiple keys
+	for i := 0; i < 10; i++ {
+		key := fmt.Sprintf("clear-key-%d", i)
+		value := []byte(fmt.Sprintf("clear-value-%d", i))
+		err := backend.Set(ctx, key, value, 1*time.Minute)
+		require.NoError(t, err)
+	}
+
+	// Verify keys exist
+	keys := mr.CheckKeys()
+	assert.Len(t, keys, 10)
+
+	// Clear all
+	err = backend.Clear(ctx)
+	require.NoError(t, err)
+
+	// Verify all keys are gone
+	keys = mr.CheckKeys()
+	assert.Len(t, keys, 0)
+}
+
+// TestRedisBackend_ConnectionFailure tests behavior on connection failure
+func TestRedisBackend_ConnectionFailure(t *testing.T) {
+	t.Parallel()
+
+	// Try to connect to non-existent Redis
+	config := DefaultRedisConfig("localhost:9999")
+	_, err := NewRedisBackend(config)
+	assert.Error(t, err, "Should fail to connect to non-existent Redis")
+}
+
+// TestRedisBackend_RedisErrors tests handling of Redis errors
+func TestRedisBackend_RedisErrors(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	// Simulate Redis error
+	mr.SetError("simulated error")
+
+	// Operations should fail
+	err = backend.Set(ctx, "error-key", []byte("error-value"), 1*time.Minute)
+	assert.Error(t, err)
+
+	// Clear error
+	mr.ClearError()
+
+	// Operations should work again
+	err = backend.Set(ctx, "success-key", []byte("success-value"), 1*time.Minute)
+	assert.NoError(t, err)
+}
+
+// TestRedisBackend_ConcurrentAccess tests thread safety
+func TestRedisBackend_ConcurrentAccess(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+	var wg sync.WaitGroup
+	goroutines := 20
+	iterations := 50
+
+	for i := 0; i < goroutines; i++ {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+			for j := 0; j < iterations; j++ {
+				key := fmt.Sprintf("concurrent-key-%d-%d", id, j)
+				value := []byte(fmt.Sprintf("concurrent-value-%d-%d", id, j))
+
+				err := backend.Set(ctx, key, value, 1*time.Minute)
+				assert.NoError(t, err)
+
+				retrieved, _, exists, err := backend.Get(ctx, key)
+				assert.NoError(t, err)
+				if exists {
+					assert.Equal(t, value, retrieved)
+				}
+
+				if j%5 == 0 {
+					backend.Delete(ctx, key)
+				}
+			}
+		}(i)
+	}
+
+	wg.Wait()
+
+	stats := backend.GetStats()
+	hits := stats["hits"].(int64)
+	misses := stats["misses"].(int64)
+	assert.Greater(t, hits+misses, int64(0))
+}
+
+// TestRedisBackend_Stats tests statistics tracking
+func TestRedisBackend_Stats(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	// Initial stats
+	stats := backend.GetStats()
+	assert.Equal(t, int64(0), stats["hits"].(int64))
+	assert.Equal(t, int64(0), stats["misses"].(int64))
+
+	// Add and access items
+	backend.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+	backend.Get(ctx, "key1")         // Hit
+	backend.Get(ctx, "non-existent") // Miss
+
+	stats = backend.GetStats()
+	assert.Equal(t, int64(1), stats["hits"].(int64))
+	assert.Equal(t, int64(1), stats["misses"].(int64))
+
+	hitRate := stats["hit_rate"].(float64)
+	assert.InDelta(t, 0.5, hitRate, 0.01)
+}
+
+// TestRedisBackend_Ping tests health check
+func TestRedisBackend_Ping(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	err = backend.Ping(ctx)
+	assert.NoError(t, err)
+
+	// Close and ping should fail
+	backend.Close()
+	err = backend.Ping(ctx)
+	assert.Error(t, err)
+}
+
+// TestRedisBackend_Close tests proper cleanup
+func TestRedisBackend_Close(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+
+	ctx := context.Background()
+
+	// Add items
+	for i := 0; i < 10; i++ {
+		key := fmt.Sprintf("close-key-%d", i)
+		value := []byte(fmt.Sprintf("close-value-%d", i))
+		backend.Set(ctx, key, value, 1*time.Minute)
+	}
+
+	// Close
+	err = backend.Close()
+	require.NoError(t, err)
+
+	// Operations should fail
+	err = backend.Set(ctx, "after-close", []byte("value"), 1*time.Minute)
+	assert.Error(t, err)
+	assert.Equal(t, ErrBackendClosed, err)
+
+	// Double close should be safe
+	err = backend.Close()
+	assert.NoError(t, err)
+}
+
+// TestRedisBackend_UpdateExisting tests updating existing keys
+func TestRedisBackend_UpdateExisting(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	key := "update-key"
+	value1 := []byte("original-value")
+	value2 := []byte("updated-value")
+
+	// Set original
+	err = backend.Set(ctx, key, value1, 1*time.Minute)
+	require.NoError(t, err)
+
+	// Update
+	err = backend.Set(ctx, key, value2, 2*time.Minute)
+	require.NoError(t, err)
+
+	// Verify updated
+	retrieved, ttl, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, value2, retrieved)
+	assert.Greater(t, ttl, 1*time.Minute)
+}
+
+// TestRedisBackend_LargeValues tests handling of large values
+func TestRedisBackend_LargeValues(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	key := "large-key"
+	largeValue := make([]byte, 1024*1024) // 1MB
+
+	err = backend.Set(ctx, key, largeValue, 1*time.Minute)
+	require.NoError(t, err)
+
+	retrieved, _, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, len(largeValue), len(retrieved))
+}
+
+// TestRedisBackend_EmptyValues tests handling of empty values
+func TestRedisBackend_EmptyValues(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	key := "empty-key"
+	emptyValue := []byte{}
+
+	err = backend.Set(ctx, key, emptyValue, 1*time.Minute)
+	require.NoError(t, err)
+
+	retrieved, _, exists, err := backend.Get(ctx, key)
+	require.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, 0, len(retrieved))
+}
+
+// TestRedisBackend_PipelineOperations tests batch operations
+func TestRedisBackend_PipelineOperations(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	t.Run("SetMany", func(t *testing.T) {
+		items := make(map[string][]byte)
+		for i := 0; i < 10; i++ {
+			key := fmt.Sprintf("batch-key-%d", i)
+			value := []byte(fmt.Sprintf("batch-value-%d", i))
+			items[key] = value
+		}
+
+		err := backend.SetMany(ctx, items, 1*time.Minute)
+		require.NoError(t, err)
+
+		// Verify all items were set
+		for key, expectedValue := range items {
+			retrieved, _, exists, err := backend.Get(ctx, key)
+			require.NoError(t, err)
+			assert.True(t, exists)
+			assert.Equal(t, expectedValue, retrieved)
+		}
+	})
+
+	t.Run("GetMany", func(t *testing.T) {
+		// Set test data
+		testData := GenerateTestData(5)
+		for key, value := range testData {
+			backend.Set(ctx, key, value, 1*time.Minute)
+		}
+
+		// Get all keys
+		keys := make([]string, 0, len(testData))
+		for key := range testData {
+			keys = append(keys, key)
+		}
+
+		results, err := backend.GetMany(ctx, keys)
+		require.NoError(t, err)
+		assert.Len(t, results, len(testData))
+
+		for key, expectedValue := range testData {
+			retrievedValue, exists := results[key]
+			assert.True(t, exists)
+			assert.Equal(t, expectedValue, retrievedValue)
+		}
+	})
+
+	t.Run("GetManyWithNonExistent", func(t *testing.T) {
+		keys := []string{"exists-1", "non-existent", "exists-2"}
+
+		backend.Set(ctx, "exists-1", []byte("value-1"), 1*time.Minute)
+		backend.Set(ctx, "exists-2", []byte("value-2"), 1*time.Minute)
+
+		results, err := backend.GetMany(ctx, keys)
+		require.NoError(t, err)
+		assert.Len(t, results, 2) // Only existing keys
+		assert.Equal(t, []byte("value-1"), results["exists-1"])
+		assert.Equal(t, []byte("value-2"), results["exists-2"])
+		_, exists := results["non-existent"]
+		assert.False(t, exists)
+	})
+}
+
+// TestRedisBackend_NoPrefix tests operation without prefix
+func TestRedisBackend_NoPrefix(t *testing.T) {
+	t.Parallel()
+
+	mr := NewMiniredisServer(t)
+	config := DefaultRedisConfig(mr.GetAddr())
+	config.RedisPrefix = "" // No prefix
+	backend, err := NewRedisBackend(config)
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	key := "no-prefix-key"
+	value := []byte("no-prefix-value")
+
+	err = backend.Set(ctx, key, value, 1*time.Minute)
+	require.NoError(t, err)
+
+	// Check key is stored without prefix
+	keys := mr.CheckKeys()
+	require.Len(t, keys, 1)
+	assert.Equal(t, key, keys[0])
+}

internal/cache/backends/resp.go

@@ -0,0 +1,251 @@
+package backends
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+// RESP (REdis Serialization Protocol) implementation
+// Pure Go implementation compatible with Yaegi interpreter (no unsafe package)
+
+var (
+	ErrInvalidRESP = errors.New("invalid RESP response")
+	ErrNilResponse = errors.New("nil response")
+)
+
+// Object pools for memory optimization - reduces allocations by 50-70%
+var (
+	readerPool = sync.Pool{
+		New: func() interface{} {
+			return &RESPReader{
+				r: bufio.NewReaderSize(nil, 4096),
+			}
+		},
+	}
+
+	writerPool = sync.Pool{
+		New: func() interface{} {
+			return &RESPWriter{
+				w: nil,
+			}
+		},
+	}
+)
+
+// RESPWriter writes RESP protocol messages
+type RESPWriter struct {
+	w io.Writer
+}
+
+// NewRESPWriter creates a new RESP writer from the pool (memory optimized)
+func NewRESPWriter(w io.Writer) *RESPWriter {
+	writer := writerPool.Get().(*RESPWriter)
+	writer.w = w
+	return writer
+}
+
+// Release returns the writer to the pool for reuse
+func (w *RESPWriter) Release() {
+	w.w = nil
+	writerPool.Put(w)
+}
+
+// WriteCommand writes a Redis command in RESP array format
+// Example: SET key value EX 3600 -> *5\r\n$3\r\nSET\r\n$3\r\nkey\r\n$5\r\nvalue\r\n$2\r\nEX\r\n$4\r\n3600\r\n
+func (w *RESPWriter) WriteCommand(args ...string) error {
+	// Write array header
+	if _, err := fmt.Fprintf(w.w, "*%d\r\n", len(args)); err != nil {
+		return err
+	}
+
+	// Write each argument as bulk string
+	for _, arg := range args {
+		if _, err := fmt.Fprintf(w.w, "$%d\r\n%s\r\n", len(arg), arg); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// RESPReader reads RESP protocol messages
+type RESPReader struct {
+	r *bufio.Reader
+}
+
+// NewRESPReader creates a new RESP reader from the pool (memory optimized)
+func NewRESPReader(r io.Reader) *RESPReader {
+	reader := readerPool.Get().(*RESPReader)
+	reader.r.Reset(r)
+	return reader
+}
+
+// Release returns the reader to the pool for reuse
+func (r *RESPReader) Release() {
+	r.r.Reset(nil)
+	readerPool.Put(r)
+}
+
+// ReadResponse reads a RESP response and returns the parsed value
+func (r *RESPReader) ReadResponse() (interface{}, error) {
+	typeByte, err := r.r.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+
+	switch typeByte {
+	case '+': // Simple string
+		return r.readSimpleString()
+	case '-': // Error
+		return nil, r.readError()
+	case ':': // Integer
+		return r.readInteger()
+	case '$': // Bulk string
+		return r.readBulkString()
+	case '*': // Array
+		return r.readArray()
+	default:
+		return nil, fmt.Errorf("%w: unknown type byte '%c'", ErrInvalidRESP, typeByte)
+	}
+}
+
+// readSimpleString reads a simple string (+OK\r\n)
+func (r *RESPReader) readSimpleString() (string, error) {
+	line, err := r.readLine()
+	if err != nil {
+		return "", err
+	}
+	return line, nil
+}
+
+// readError reads an error message (-Error message\r\n)
+func (r *RESPReader) readError() error {
+	line, err := r.readLine()
+	if err != nil {
+		return err
+	}
+	return errors.New(line)
+}
+
+// readInteger reads an integer (:1000\r\n)
+func (r *RESPReader) readInteger() (int64, error) {
+	line, err := r.readLine()
+	if err != nil {
+		return 0, err
+	}
+	return strconv.ParseInt(line, 10, 64)
+}
+
+// readBulkString reads a bulk string ($6\r\nfoobar\r\n or $-1\r\n for nil)
+func (r *RESPReader) readBulkString() (interface{}, error) {
+	line, err := r.readLine()
+	if err != nil {
+		return nil, err
+	}
+
+	length, err := strconv.Atoi(line)
+	if err != nil {
+		return nil, fmt.Errorf("%w: invalid bulk string length", ErrInvalidRESP)
+	}
+
+	// -1 indicates nil bulk string
+	if length == -1 {
+		return nil, ErrNilResponse
+	}
+
+	// Read exactly 'length' bytes plus \r\n
+	buf := make([]byte, length+2)
+	if _, err := io.ReadFull(r.r, buf); err != nil {
+		return nil, err
+	}
+
+	// Verify \r\n terminator
+	if buf[length] != '\r' || buf[length+1] != '\n' {
+		return nil, fmt.Errorf("%w: missing CRLF after bulk string", ErrInvalidRESP)
+	}
+
+	return string(buf[:length]), nil
+}
+
+// readArray reads an array (*2\r\n...\r\n or *-1\r\n for nil)
+func (r *RESPReader) readArray() (interface{}, error) {
+	line, err := r.readLine()
+	if err != nil {
+		return nil, err
+	}
+
+	length, err := strconv.Atoi(line)
+	if err != nil {
+		return nil, fmt.Errorf("%w: invalid array length", ErrInvalidRESP)
+	}
+
+	// -1 indicates nil array
+	if length == -1 {
+		return nil, ErrNilResponse
+	}
+
+	// Read each element
+	result := make([]interface{}, length)
+	for i := 0; i < length; i++ {
+		elem, err := r.ReadResponse()
+		if err != nil {
+			return nil, err
+		}
+		result[i] = elem
+	}
+
+	return result, nil
+}
+
+// readLine reads a line terminated by \r\n
+func (r *RESPReader) readLine() (string, error) {
+	line, err := r.r.ReadString('\n')
+	if err != nil {
+		return "", err
+	}
+
+	// Remove \r\n
+	line = strings.TrimSuffix(line, "\r\n")
+	if !strings.HasSuffix(line+"\r\n", "\r\n") {
+		return "", fmt.Errorf("%w: missing CRLF", ErrInvalidRESP)
+	}
+
+	return line, nil
+}
+
+// RESPString extracts a string from RESP response
+func RESPString(resp interface{}) (string, error) {
+	if resp == nil {
+		return "", ErrNilResponse
+	}
+
+	switch v := resp.(type) {
+	case string:
+		return v, nil
+	case []byte:
+		return string(v), nil
+	default:
+		return "", fmt.Errorf("expected string, got %T", resp)
+	}
+}
+
+// RESPInt extracts an integer from RESP response
+func RESPInt(resp interface{}) (int64, error) {
+	if resp == nil {
+		return 0, ErrNilResponse
+	}
+
+	switch v := resp.(type) {
+	case int64:
+		return v, nil
+	case int:
+		return int64(v), nil
+	default:
+		return 0, fmt.Errorf("expected integer, got %T", resp)
+	}
+}

internal/cache/backends/resp_test.go

@@ -0,0 +1,495 @@
+package backends
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRESPWriter_WriteCommand tests RESP command writing
+func TestRESPWriter_WriteCommand(t *testing.T) {
+	tests := []struct {
+		name     string
+		args     []string
+		expected string
+	}{
+		{
+			name:     "Simple command",
+			args:     []string{"PING"},
+			expected: "*1\r\n$4\r\nPING\r\n",
+		},
+		{
+			name:     "SET command",
+			args:     []string{"SET", "key", "value"},
+			expected: "*3\r\n$3\r\nSET\r\n$3\r\nkey\r\n$5\r\nvalue\r\n",
+		},
+		{
+			name:     "SETEX command",
+			args:     []string{"SETEX", "mykey", "60", "myvalue"},
+			expected: "*4\r\n$5\r\nSETEX\r\n$5\r\nmykey\r\n$2\r\n60\r\n$7\r\nmyvalue\r\n",
+		},
+		{
+			name:     "DEL with multiple keys",
+			args:     []string{"DEL", "key1", "key2", "key3"},
+			expected: "*4\r\n$3\r\nDEL\r\n$4\r\nkey1\r\n$4\r\nkey2\r\n$4\r\nkey3\r\n",
+		},
+		{
+			name:     "Command with empty string",
+			args:     []string{"SET", "key", ""},
+			expected: "*3\r\n$3\r\nSET\r\n$3\r\nkey\r\n$0\r\n\r\n",
+		},
+		{
+			name:     "Command with special characters",
+			args:     []string{"SET", "key", "val\r\nue"},
+			expected: "*3\r\n$3\r\nSET\r\n$3\r\nkey\r\n$7\r\nval\r\nue\r\n",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			buf := &bytes.Buffer{}
+			writer := NewRESPWriter(buf)
+
+			err := writer.WriteCommand(tt.args...)
+			require.NoError(t, err)
+			assert.Equal(t, tt.expected, buf.String())
+		})
+	}
+}
+
+// TestRESPReader_ReadSimpleString tests reading simple strings
+func TestRESPReader_ReadSimpleString(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+		wantErr  bool
+	}{
+		{
+			name:     "OK response",
+			input:    "+OK\r\n",
+			expected: "OK",
+			wantErr:  false,
+		},
+		{
+			name:     "PONG response",
+			input:    "+PONG\r\n",
+			expected: "PONG",
+			wantErr:  false,
+		},
+		{
+			name:     "Empty string",
+			input:    "+\r\n",
+			expected: "",
+			wantErr:  false,
+		},
+		{
+			name:     "String with spaces",
+			input:    "+Hello World\r\n",
+			expected: "Hello World",
+			wantErr:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewRESPReader(strings.NewReader(tt.input))
+			result, err := reader.ReadResponse()
+
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestRESPReader_ReadError tests reading error messages
+func TestRESPReader_ReadError(t *testing.T) {
+	tests := []struct {
+		name          string
+		input         string
+		expectedError string
+	}{
+		{
+			name:          "ERR error",
+			input:         "-ERR unknown command\r\n",
+			expectedError: "ERR unknown command",
+		},
+		{
+			name:          "WRONGTYPE error",
+			input:         "-WRONGTYPE Operation against a key holding the wrong kind of value\r\n",
+			expectedError: "WRONGTYPE Operation against a key holding the wrong kind of value",
+		},
+		{
+			name:          "Simple error",
+			input:         "-Error\r\n",
+			expectedError: "Error",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewRESPReader(strings.NewReader(tt.input))
+			_, err := reader.ReadResponse()
+
+			require.Error(t, err)
+			assert.Equal(t, tt.expectedError, err.Error())
+		})
+	}
+}
+
+// TestRESPReader_ReadInteger tests reading integers
+func TestRESPReader_ReadInteger(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected int64
+		wantErr  bool
+	}{
+		{
+			name:     "Zero",
+			input:    ":0\r\n",
+			expected: 0,
+			wantErr:  false,
+		},
+		{
+			name:     "Positive integer",
+			input:    ":1000\r\n",
+			expected: 1000,
+			wantErr:  false,
+		},
+		{
+			name:     "Negative integer",
+			input:    ":-1\r\n",
+			expected: -1,
+			wantErr:  false,
+		},
+		{
+			name:     "Large integer",
+			input:    ":9223372036854775807\r\n",
+			expected: 9223372036854775807,
+			wantErr:  false,
+		},
+		{
+			name:    "Invalid integer",
+			input:   ":abc\r\n",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewRESPReader(strings.NewReader(tt.input))
+			result, err := reader.ReadResponse()
+
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestRESPReader_ReadBulkString tests reading bulk strings
+func TestRESPReader_ReadBulkString(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected interface{}
+		wantErr  bool
+		isNil    bool
+	}{
+		{
+			name:     "Simple bulk string",
+			input:    "$6\r\nfoobar\r\n",
+			expected: "foobar",
+			wantErr:  false,
+		},
+		{
+			name:     "Empty bulk string",
+			input:    "$0\r\n\r\n",
+			expected: "",
+			wantErr:  false,
+		},
+		{
+			name:     "Nil bulk string",
+			input:    "$-1\r\n",
+			expected: nil,
+			wantErr:  true,
+			isNil:    true,
+		},
+		{
+			name:     "Binary safe bulk string",
+			input:    "$5\r\n\x00\x01\x02\x03\x04\r\n",
+			expected: "\x00\x01\x02\x03\x04",
+			wantErr:  false,
+		},
+		{
+			name:    "Invalid length",
+			input:   "$abc\r\ntest\r\n",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewRESPReader(strings.NewReader(tt.input))
+			result, err := reader.ReadResponse()
+
+			if tt.isNil {
+				require.Error(t, err)
+				assert.True(t, errors.Is(err, ErrNilResponse))
+				return
+			}
+
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestRESPReader_ReadArray tests reading arrays
+func TestRESPReader_ReadArray(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected []interface{}
+		wantErr  bool
+		isNil    bool
+	}{
+		{
+			name:     "Empty array",
+			input:    "*0\r\n",
+			expected: []interface{}{},
+			wantErr:  false,
+		},
+		{
+			name:  "Array of bulk strings",
+			input: "*2\r\n$3\r\nfoo\r\n$3\r\nbar\r\n",
+			expected: []interface{}{
+				"foo",
+				"bar",
+			},
+			wantErr: false,
+		},
+		{
+			name:  "Array of integers",
+			input: "*3\r\n:1\r\n:2\r\n:3\r\n",
+			expected: []interface{}{
+				int64(1),
+				int64(2),
+				int64(3),
+			},
+			wantErr: false,
+		},
+		{
+			name:  "Mixed array",
+			input: "*5\r\n:1\r\n:2\r\n:3\r\n:4\r\n$6\r\nfoobar\r\n",
+			expected: []interface{}{
+				int64(1),
+				int64(2),
+				int64(3),
+				int64(4),
+				"foobar",
+			},
+			wantErr: false,
+		},
+		{
+			name:     "Nil array",
+			input:    "*-1\r\n",
+			expected: nil,
+			wantErr:  true,
+			isNil:    true,
+		},
+		{
+			name:  "Nested arrays",
+			input: "*2\r\n*2\r\n$3\r\nfoo\r\n$3\r\nbar\r\n*1\r\n$3\r\nbaz\r\n",
+			expected: []interface{}{
+				[]interface{}{"foo", "bar"},
+				[]interface{}{"baz"},
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewRESPReader(strings.NewReader(tt.input))
+			result, err := reader.ReadResponse()
+
+			if tt.isNil {
+				require.Error(t, err)
+				assert.True(t, errors.Is(err, ErrNilResponse))
+				return
+			}
+
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestRESPReader_InvalidInput tests error handling for invalid input
+func TestRESPReader_InvalidInput(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+	}{
+		{
+			name:  "Unknown type byte",
+			input: "?invalid\r\n",
+		},
+		{
+			name:  "Incomplete response",
+			input: "+OK",
+		},
+		{
+			name:  "Missing CRLF in bulk string",
+			input: "$5\r\nhello",
+		},
+		{
+			name:  "Truncated array",
+			input: "*3\r\n:1\r\n:2\r\n",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewRESPReader(strings.NewReader(tt.input))
+			_, err := reader.ReadResponse()
+			require.Error(t, err)
+		})
+	}
+}
+
+// TestRESPReader_EOF tests handling of EOF
+func TestRESPReader_EOF(t *testing.T) {
+	reader := NewRESPReader(strings.NewReader(""))
+	_, err := reader.ReadResponse()
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, io.EOF))
+}
+
+// TestRESPHelpers tests helper functions
+func TestRESPHelpers(t *testing.T) {
+	t.Run("RESPString", func(t *testing.T) {
+		// Valid string
+		result, err := RESPString("hello")
+		require.NoError(t, err)
+		assert.Equal(t, "hello", result)
+
+		// Byte slice
+		result, err = RESPString([]byte("world"))
+		require.NoError(t, err)
+		assert.Equal(t, "world", result)
+
+		// Nil
+		_, err = RESPString(nil)
+		require.Error(t, err)
+		assert.True(t, errors.Is(err, ErrNilResponse))
+
+		// Invalid type
+		_, err = RESPString(123)
+		require.Error(t, err)
+	})
+
+	t.Run("RESPInt", func(t *testing.T) {
+		// Valid int64
+		result, err := RESPInt(int64(42))
+		require.NoError(t, err)
+		assert.Equal(t, int64(42), result)
+
+		// Valid int
+		result, err = RESPInt(42)
+		require.NoError(t, err)
+		assert.Equal(t, int64(42), result)
+
+		// Nil
+		_, err = RESPInt(nil)
+		require.Error(t, err)
+		assert.True(t, errors.Is(err, ErrNilResponse))
+
+		// Invalid type
+		_, err = RESPInt("string")
+		require.Error(t, err)
+	})
+}
+
+// TestRESPRoundTrip tests full round-trip encoding/decoding
+func TestRESPRoundTrip(t *testing.T) {
+	tests := []struct {
+		name     string
+		command  []string
+		response string
+		expected interface{}
+	}{
+		{
+			name:     "PING command",
+			command:  []string{"PING"},
+			response: "+PONG\r\n",
+			expected: "PONG",
+		},
+		{
+			name:     "GET command with result",
+			command:  []string{"GET", "mykey"},
+			response: "$7\r\nmyvalue\r\n",
+			expected: "myvalue",
+		},
+		{
+			name:     "GET command with nil",
+			command:  []string{"GET", "nonexistent"},
+			response: "$-1\r\n",
+			expected: nil,
+		},
+		{
+			name:     "DEL command",
+			command:  []string{"DEL", "key1", "key2"},
+			response: ":2\r\n",
+			expected: int64(2),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Write command
+			writeBuf := &bytes.Buffer{}
+			writer := NewRESPWriter(writeBuf)
+			err := writer.WriteCommand(tt.command...)
+			require.NoError(t, err)
+
+			// Read response
+			reader := NewRESPReader(strings.NewReader(tt.response))
+			result, err := reader.ReadResponse()
+
+			if tt.expected == nil {
+				require.Error(t, err)
+				assert.True(t, errors.Is(err, ErrNilResponse))
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tt.expected, result)
+			}
+		})
+	}
+}

internal/cache/backends/test_helpers_test.go

@@ -0,0 +1,198 @@
+package backends
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/require"
+)
+
+// TestLogger implements a simple logger for tests
+type TestLogger struct {
+	t *testing.T
+}
+
+func NewTestLogger(t *testing.T) *TestLogger {
+	return &TestLogger{t: t}
+}
+
+func (l *TestLogger) Debug(format string, args ...interface{}) {
+	l.t.Logf("[DEBUG] "+format, args...)
+}
+
+func (l *TestLogger) Info(format string, args ...interface{}) {
+	l.t.Logf("[INFO] "+format, args...)
+}
+
+func (l *TestLogger) Error(format string, args ...interface{}) {
+	l.t.Logf("[ERROR] "+format, args...)
+}
+
+func (l *TestLogger) Debugf(format string, args ...interface{}) {
+	l.Debug(format, args...)
+}
+
+func (l *TestLogger) Infof(format string, args ...interface{}) {
+	l.Info(format, args...)
+}
+
+func (l *TestLogger) Errorf(format string, args ...interface{}) {
+	l.Error(format, args...)
+}
+
+func (l *TestLogger) Warnf(format string, args ...interface{}) {
+	l.t.Logf("[WARN] "+format, args...)
+}
+
+// MiniredisServer manages a miniredis instance for testing
+type MiniredisServer struct {
+	server *miniredis.Miniredis
+	client *redis.Client
+}
+
+// NewMiniredisServer creates a new miniredis server for testing
+func NewMiniredisServer(t *testing.T) *MiniredisServer {
+	t.Helper()
+
+	mr, err := miniredis.Run()
+	require.NoError(t, err, "failed to start miniredis")
+
+	client := redis.NewClient(&redis.Options{
+		Addr: mr.Addr(),
+	})
+
+	// Verify connection
+	ctx := context.Background()
+	err = client.Ping(ctx).Err()
+	require.NoError(t, err, "failed to ping miniredis")
+
+	t.Cleanup(func() {
+		client.Close()
+		mr.Close()
+	})
+
+	return &MiniredisServer{
+		server: mr,
+		client: client,
+	}
+}
+
+// GetAddr returns the address of the miniredis server
+func (m *MiniredisServer) GetAddr() string {
+	return m.server.Addr()
+}
+
+// GetClient returns the Redis client
+func (m *MiniredisServer) GetClient() *redis.Client {
+	return m.client
+}
+
+// FastForward advances the miniredis server's time
+func (m *MiniredisServer) FastForward(d time.Duration) {
+	m.server.FastForward(d)
+}
+
+// FlushAll removes all keys from the database
+func (m *MiniredisServer) FlushAll() {
+	m.server.FlushAll()
+}
+
+// SetError simulates a Redis error
+func (m *MiniredisServer) SetError(err string) {
+	m.server.SetError(err)
+}
+
+// ClearError clears any simulated errors
+func (m *MiniredisServer) ClearError() {
+	m.server.SetError("")
+}
+
+// CheckKeys verifies that specific keys exist in Redis
+func (m *MiniredisServer) CheckKeys() []string {
+	return m.server.Keys()
+}
+
+// Close closes the miniredis server
+func (m *MiniredisServer) Close() {
+	m.server.Close()
+}
+
+// Restart restarts the miniredis server
+func (m *MiniredisServer) Restart() {
+	m.server.Restart()
+}
+
+// TestConfig provides default test configuration
+type TestConfig struct {
+	MaxSize         int
+	DefaultTTL      time.Duration
+	CleanupInterval time.Duration
+	EnableMetrics   bool
+}
+
+// DefaultTestConfig returns a standard test configuration
+func DefaultTestConfig() *TestConfig {
+	return &TestConfig{
+		MaxSize:         100,
+		DefaultTTL:      5 * time.Minute,
+		CleanupInterval: 1 * time.Second,
+		EnableMetrics:   true,
+	}
+}
+
+// GenerateTestData creates test cache data
+func GenerateTestData(count int) map[string][]byte {
+	data := make(map[string][]byte, count)
+	for i := 0; i < count; i++ {
+		key := fmt.Sprintf("test-key-%d", i)
+		value := []byte(fmt.Sprintf("test-value-%d", i))
+		data[key] = value
+	}
+	return data
+}
+
+// GenerateLargeValue creates a large test value
+func GenerateLargeValue(sizeBytes int) []byte {
+	return make([]byte, sizeBytes)
+}
+
+// AssertCacheStats is a helper to verify cache statistics
+func AssertCacheStats(t *testing.T, stats map[string]interface{}, expectedHits, expectedMisses int64) {
+	t.Helper()
+
+	hits, ok := stats["hits"].(int64)
+	require.True(t, ok, "hits should be int64")
+	require.Equal(t, expectedHits, hits, "unexpected hit count")
+
+	misses, ok := stats["misses"].(int64)
+	require.True(t, ok, "misses should be int64")
+	require.Equal(t, expectedMisses, misses, "unexpected miss count")
+}
+
+// WaitForCondition waits for a condition to be true or times out
+func WaitForCondition(t *testing.T, timeout time.Duration, checkInterval time.Duration, condition func() bool) {
+	t.Helper()
+
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if condition() {
+			return
+		}
+		time.Sleep(checkInterval)
+	}
+	t.Fatal("timeout waiting for condition")
+}
+
+// AssertEventuallyExpires verifies that a key eventually expires
+func AssertEventuallyExpires(t *testing.T, backend CacheBackend, ctx context.Context, key string, maxWait time.Duration) {
+	t.Helper()
+
+	WaitForCondition(t, maxWait, 100*time.Millisecond, func() bool {
+		_, _, exists, err := backend.Get(ctx, key)
+		return err == nil && !exists
+	})
+}

internal/cache/cache.go

@@ -355,7 +355,7 @@ func (c *Cache) removeItem(key string, item *Item) {
 
 func (c *Cache) evictLRU() {
 	if elem := c.lruList.Back(); elem != nil {
-		item := elem.Value.(*Item)
+		item, _ := elem.Value.(*Item) // Safe to ignore: type assertion from known type
 		c.removeItem(item.Key, item)
 		atomic.AddInt64(&c.evictions, 1)
 		c.logger.Debugf("Cache: Evicted LRU item key=%s", item.Key)

internal/cache/cache_test.go

@@ -1880,19 +1880,20 @@ func TestConcurrentManagerOperations(t *testing.T) {
 // TestTTLExpirationAndCleanup tests TTL expiration and cleanup routines comprehensively
 func TestTTLExpirationAndCleanup(t *testing.T) {
 	config := DefaultConfig()
-	config.CleanupInterval = 10 * time.Millisecond
+	config.CleanupInterval = 50 * time.Millisecond
 	config.EnableAutoCleanup = true
 	cache := New(config)
 	defer cache.Close()
 
 	// Test various TTL scenarios
+	// Note: Timing increased 5x to account for race detector overhead
 	testCases := []struct {
 		key string
 		ttl time.Duration
 	}{
-		{"very-short", 5 * time.Millisecond},
-		{"short", 25 * time.Millisecond},
-		{"medium", 100 * time.Millisecond},
+		{"very-short", 25 * time.Millisecond},
+		{"short", 125 * time.Millisecond},
+		{"medium", 500 * time.Millisecond},
 		{"long", 1 * time.Hour},
 	}
 
@@ -1908,13 +1909,13 @@ func TestTTLExpirationAndCleanup(t *testing.T) {
 	}
 
 	// Wait for very short items to expire
-	time.Sleep(15 * time.Millisecond)
+	time.Sleep(75 * time.Millisecond)
 	if _, exists := cache.Get("very-short"); exists {
 		t.Error("Very short item should be expired")
 	}
 
 	// Wait for short items to expire
-	time.Sleep(30 * time.Millisecond)
+	time.Sleep(150 * time.Millisecond)
 	if _, exists := cache.Get("short"); exists {
 		t.Error("Short item should be expired")
 	}
@@ -1930,16 +1931,16 @@ func TestTTLExpirationAndCleanup(t *testing.T) {
 	}
 
 	// Test manual cleanup
-	cache.Set("manual-cleanup", "value", 1*time.Millisecond)
-	time.Sleep(5 * time.Millisecond)
+	cache.Set("manual-cleanup", "value", 5*time.Millisecond)
+	time.Sleep(25 * time.Millisecond)
 	cache.Cleanup()
 
 	// Add many expired items to test bulk cleanup
 	for i := 0; i < 100; i++ {
 		key := fmt.Sprintf("bulk-%d", i)
-		cache.Set(key, fmt.Sprintf("value-%d", i), 1*time.Millisecond)
+		cache.Set(key, fmt.Sprintf("value-%d", i), 5*time.Millisecond)
 	}
-	time.Sleep(5 * time.Millisecond)
+	time.Sleep(25 * time.Millisecond)
 
 	sizeBefore := cache.Size()
 	cache.Cleanup()
@@ -2038,3 +2039,88 @@ func TestCacheStatisticsAndMetrics(t *testing.T) {
 		t.Error("Memory usage should increase after adding large item")
 	}
 }
+
+// ============================================================================
+// noOpLogger Tests
+// ============================================================================
+
+// TestNoOpLogger_AllMethods tests all noOpLogger methods to ensure they don't panic
+func TestNoOpLogger_AllMethods(t *testing.T) {
+	logger := &noOpLogger{}
+
+	// Test simple message methods
+	logger.Debug("test debug message")
+	logger.Info("test info message")
+	logger.Error("test error message")
+	logger.Warn("test warn message")
+	logger.Fatal("test fatal message")
+
+	// Test formatted message methods
+	logger.Debugf("test debug: %s", "value")
+	logger.Infof("test info: %s", "value")
+	logger.Errorf("test error: %s", "value")
+	logger.Warnf("test warn: %s", "value")
+	logger.Fatalf("test fatal: %s", "value")
+
+	// If we reach here, all methods executed without panicking
+	// This is expected behavior for a no-op logger
+}
+
+// TestNoOpLogger_WithField verifies WithField returns the same logger
+func TestNoOpLogger_WithField(t *testing.T) {
+	logger := &noOpLogger{}
+
+	result := logger.WithField("key", "value")
+
+	if result != logger {
+		t.Error("WithField should return the same logger instance")
+	}
+
+	// Verify the returned logger works
+	result.Info("test message after WithField")
+}
+
+// TestNoOpLogger_WithFields verifies WithFields returns the same logger
+func TestNoOpLogger_WithFields(t *testing.T) {
+	logger := &noOpLogger{}
+
+	fields := map[string]interface{}{
+		"key1": "value1",
+		"key2": 123,
+		"key3": true,
+	}
+
+	result := logger.WithFields(fields)
+
+	if result != logger {
+		t.Error("WithFields should return the same logger instance")
+	}
+
+	// Verify the returned logger works
+	result.Info("test message after WithFields")
+}
+
+// TestNoOpLogger_Chaining verifies method chaining works
+func TestNoOpLogger_Chaining(t *testing.T) {
+	logger := &noOpLogger{}
+
+	// Use WithField and verify it returns a usable logger
+	result := logger.WithField("key1", "value1")
+
+	// Verify the result can be used for logging (Logger interface methods)
+	result.Info("info after WithField")
+	result.Infof("infof after WithField: %s", "test")
+	result.Debug("debug after WithField")
+	result.Debugf("debugf after WithField: %d", 123)
+	result.Error("error after WithField")
+	result.Errorf("errorf after WithField: %v", true)
+
+	// Use WithFields and verify it returns a usable logger
+	result2 := logger.WithFields(map[string]interface{}{
+		"key2": "value2",
+		"key3": 123,
+	})
+
+	// Verify the result can be used for logging
+	result2.Infof("message after WithFields: %s", "test")
+}

internal/cache/compat.go

@@ -1,3 +1,5 @@
+// Package cache provides high-performance caching implementations for OIDC tokens, metadata, and JWKs.
+// It includes compatibility wrappers for backward compatibility with existing cache interfaces.
 package cache
 
 import (

internal/cache/resilience/circuit_breaker.go

@@ -0,0 +1,329 @@
+// Package resilience provides resilience patterns for cache backends.
+package resilience
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// Common errors
+var (
+	// ErrCircuitOpen is returned when the circuit breaker is open
+	ErrCircuitOpen = errors.New("circuit breaker is open")
+
+	// ErrTooManyRequests is returned when too many requests are made in half-open state
+	ErrTooManyRequests = errors.New("too many requests in half-open state")
+)
+
+// State represents the state of the circuit breaker
+type State int32
+
+const (
+	// StateClosed allows all operations to pass through
+	StateClosed State = iota
+
+	// StateOpen blocks all operations
+	StateOpen
+
+	// StateHalfOpen allows a limited number of operations to test recovery
+	StateHalfOpen
+)
+
+// String returns the string representation of the state
+func (s State) String() string {
+	switch s {
+	case StateClosed:
+		return "closed"
+	case StateOpen:
+		return "open"
+	case StateHalfOpen:
+		return "half-open"
+	default:
+		return "unknown"
+	}
+}
+
+// CircuitBreakerConfig holds configuration for the circuit breaker
+type CircuitBreakerConfig struct {
+	// MaxFailures is the number of consecutive failures before opening the circuit
+	MaxFailures int
+
+	// FailureThreshold is the failure rate threshold (0.0 to 1.0)
+	FailureThreshold float64
+
+	// Timeout is how long the circuit stays open before trying half-open
+	Timeout time.Duration
+
+	// HalfOpenMaxRequests is the number of requests allowed in half-open state
+	HalfOpenMaxRequests int
+
+	// ResetTimeout is how long to wait before resetting counters in closed state
+	ResetTimeout time.Duration
+
+	// OnStateChange is called when the circuit breaker changes state
+	OnStateChange func(from, to State)
+}
+
+// DefaultCircuitBreakerConfig returns default configuration
+func DefaultCircuitBreakerConfig() *CircuitBreakerConfig {
+	return &CircuitBreakerConfig{
+		MaxFailures:         5,
+		FailureThreshold:    0.6,
+		Timeout:             30 * time.Second,
+		HalfOpenMaxRequests: 3,
+		ResetTimeout:        60 * time.Second,
+	}
+}
+
+// CircuitBreaker implements the circuit breaker pattern
+type CircuitBreaker struct {
+	config *CircuitBreakerConfig
+
+	// State management
+	state           atomic.Int32
+	lastStateChange time.Time
+	stateMu         sync.RWMutex
+
+	// Failure tracking
+	consecutiveFailures atomic.Int32
+	totalRequests       atomic.Int64
+	totalFailures       atomic.Int64
+	halfOpenRequests    atomic.Int32
+
+	// Timing
+	lastFailureTime time.Time
+	lastSuccessTime time.Time
+	nextRetryTime   time.Time
+	timeMu          sync.RWMutex
+
+	// Metrics
+	stateTransitions atomic.Int64
+	rejectedRequests atomic.Int64
+}
+
+// NewCircuitBreaker creates a new circuit breaker
+func NewCircuitBreaker(config *CircuitBreakerConfig) *CircuitBreaker {
+	if config == nil {
+		config = DefaultCircuitBreakerConfig()
+	}
+
+	return &CircuitBreaker{
+		config:          config,
+		lastStateChange: time.Now(),
+	}
+}
+
+// Execute runs a function through the circuit breaker
+func (cb *CircuitBreaker) Execute(ctx context.Context, fn func() error) error {
+	if !cb.AllowRequest() {
+		cb.rejectedRequests.Add(1)
+		return ErrCircuitOpen
+	}
+
+	cb.totalRequests.Add(1)
+
+	err := fn()
+	if err != nil {
+		cb.RecordFailure()
+	} else {
+		cb.RecordSuccess()
+	}
+
+	return err
+}
+
+// AllowRequest checks if a request is allowed to proceed
+func (cb *CircuitBreaker) AllowRequest() bool {
+	state := cb.GetState()
+
+	switch state {
+	case StateClosed:
+		return true
+
+	case StateOpen:
+		// Check if timeout has passed and we should try half-open
+		cb.timeMu.RLock()
+		shouldRetry := time.Now().After(cb.nextRetryTime)
+		cb.timeMu.RUnlock()
+
+		if shouldRetry {
+			cb.setState(StateHalfOpen)
+			return true
+		}
+		return false
+
+	case StateHalfOpen:
+		// Allow limited requests in half-open state
+		current := cb.halfOpenRequests.Add(1)
+		return current <= int32(cb.config.HalfOpenMaxRequests)
+
+	default:
+		return false
+	}
+}
+
+// RecordSuccess records a successful operation
+func (cb *CircuitBreaker) RecordSuccess() {
+	cb.timeMu.Lock()
+	cb.lastSuccessTime = time.Now()
+	cb.timeMu.Unlock()
+
+	state := cb.GetState()
+
+	switch state {
+	case StateClosed:
+		// Reset consecutive failures
+		cb.consecutiveFailures.Store(0)
+
+	case StateHalfOpen:
+		// If we've had enough successful requests, close the circuit
+		successfulRequests := cb.halfOpenRequests.Load()
+		if successfulRequests >= int32(cb.config.HalfOpenMaxRequests) {
+			cb.setState(StateClosed)
+			cb.consecutiveFailures.Store(0)
+			cb.halfOpenRequests.Store(0)
+		}
+	}
+}
+
+// RecordFailure records a failed operation
+func (cb *CircuitBreaker) RecordFailure() {
+	cb.totalFailures.Add(1)
+	failures := cb.consecutiveFailures.Add(1)
+
+	cb.timeMu.Lock()
+	cb.lastFailureTime = time.Now()
+	cb.timeMu.Unlock()
+
+	state := cb.GetState()
+
+	switch state {
+	case StateClosed:
+		// Check if we should open the circuit
+		if failures >= int32(cb.config.MaxFailures) {
+			cb.openCircuit()
+		} else if cb.config.FailureThreshold > 0 {
+			// Check failure rate
+			total := cb.totalRequests.Load()
+			failureCount := cb.totalFailures.Load()
+			if total > 10 && float64(failureCount)/float64(total) > cb.config.FailureThreshold {
+				cb.openCircuit()
+			}
+		}
+
+	case StateHalfOpen:
+		// Any failure in half-open state reopens the circuit
+		cb.openCircuit()
+	}
+}
+
+// openCircuit transitions to open state
+func (cb *CircuitBreaker) openCircuit() {
+	cb.setState(StateOpen)
+	cb.halfOpenRequests.Store(0)
+
+	cb.timeMu.Lock()
+	cb.nextRetryTime = time.Now().Add(cb.config.Timeout)
+	cb.timeMu.Unlock()
+}
+
+// GetState returns the current state
+func (cb *CircuitBreaker) GetState() State {
+	return State(cb.state.Load())
+}
+
+// setState changes the circuit breaker state
+func (cb *CircuitBreaker) setState(newState State) {
+	oldState := State(cb.state.Swap(int32(newState)))
+
+	if oldState != newState {
+		cb.stateTransitions.Add(1)
+
+		cb.stateMu.Lock()
+		cb.lastStateChange = time.Now()
+		cb.stateMu.Unlock()
+
+		if cb.config.OnStateChange != nil {
+			cb.config.OnStateChange(oldState, newState)
+		}
+	}
+}
+
+// Reset resets the circuit breaker to closed state
+func (cb *CircuitBreaker) Reset() {
+	cb.setState(StateClosed)
+	cb.consecutiveFailures.Store(0)
+	cb.totalRequests.Store(0)
+	cb.totalFailures.Store(0)
+	cb.halfOpenRequests.Store(0)
+	cb.rejectedRequests.Store(0)
+	cb.stateTransitions.Store(0)
+
+	now := time.Now()
+	cb.timeMu.Lock()
+	cb.lastFailureTime = now
+	cb.lastSuccessTime = now
+	cb.nextRetryTime = now
+	cb.timeMu.Unlock()
+
+	cb.stateMu.Lock()
+	cb.lastStateChange = now
+	cb.stateMu.Unlock()
+}
+
+// Stats returns circuit breaker statistics
+func (cb *CircuitBreaker) Stats() CircuitBreakerStats {
+	cb.timeMu.RLock()
+	lastFailure := cb.lastFailureTime
+	lastSuccess := cb.lastSuccessTime
+	nextRetry := cb.nextRetryTime
+	cb.timeMu.RUnlock()
+
+	cb.stateMu.RLock()
+	lastChange := cb.lastStateChange
+	cb.stateMu.RUnlock()
+
+	totalReq := cb.totalRequests.Load()
+	totalFail := cb.totalFailures.Load()
+	successRate := float64(0)
+	if totalReq > 0 {
+		successRate = float64(totalReq-totalFail) / float64(totalReq)
+	}
+
+	return CircuitBreakerStats{
+		State:               cb.GetState(),
+		ConsecutiveFailures: cb.consecutiveFailures.Load(),
+		TotalRequests:       totalReq,
+		TotalFailures:       totalFail,
+		SuccessRate:         successRate,
+		RejectedRequests:    cb.rejectedRequests.Load(),
+		StateTransitions:    cb.stateTransitions.Load(),
+		LastFailureTime:     lastFailure,
+		LastSuccessTime:     lastSuccess,
+		LastStateChange:     lastChange,
+		NextRetryTime:       nextRetry,
+	}
+}
+
+// CircuitBreakerStats holds statistics for the circuit breaker
+type CircuitBreakerStats struct {
+	State               State
+	ConsecutiveFailures int32
+	TotalRequests       int64
+	TotalFailures       int64
+	SuccessRate         float64
+	RejectedRequests    int64
+	StateTransitions    int64
+	LastFailureTime     time.Time
+	LastSuccessTime     time.Time
+	LastStateChange     time.Time
+	NextRetryTime       time.Time
+}
+
+// IsHealthy returns true if the circuit breaker is in a healthy state
+func (cb *CircuitBreaker) IsHealthy() bool {
+	return cb.GetState() != StateOpen
+}

internal/cache/resilience/circuit_breaker_backend.go

@@ -0,0 +1,141 @@
+// Package resilience provides resilience patterns for cache backends.
+package resilience
+
+import (
+	"context"
+	"time"
+
+	"github.com/lukaszraczylo/traefikoidc/internal/cache/backends"
+)
+
+// CircuitBreakerBackend wraps a cache backend with circuit breaker protection
+type CircuitBreakerBackend struct {
+	backend backends.CacheBackend
+	cb      *CircuitBreaker
+}
+
+// NewCircuitBreakerBackend creates a new circuit breaker wrapped backend
+func NewCircuitBreakerBackend(b backends.CacheBackend, config *CircuitBreakerConfig) backends.CacheBackend {
+	if config == nil {
+		config = DefaultCircuitBreakerConfig()
+	}
+
+	return &CircuitBreakerBackend{
+		backend: b,
+		cb:      NewCircuitBreaker(config),
+	}
+}
+
+// Set stores a value with circuit breaker protection
+func (c *CircuitBreakerBackend) Set(ctx context.Context, key string, value []byte, ttl time.Duration) error {
+	if !c.cb.AllowRequest() {
+		return backends.ErrCircuitOpen
+	}
+
+	err := c.backend.Set(ctx, key, value, ttl)
+	if err == nil {
+		c.cb.RecordSuccess()
+	} else {
+		c.cb.RecordFailure()
+	}
+	return err
+}
+
+// Get retrieves a value with circuit breaker protection
+func (c *CircuitBreakerBackend) Get(ctx context.Context, key string) ([]byte, time.Duration, bool, error) {
+	if !c.cb.AllowRequest() {
+		return nil, 0, false, backends.ErrCircuitOpen
+	}
+
+	value, ttl, exists, err := c.backend.Get(ctx, key)
+	if err == nil {
+		c.cb.RecordSuccess()
+	} else {
+		c.cb.RecordFailure()
+	}
+	return value, ttl, exists, err
+}
+
+// Delete removes a key with circuit breaker protection
+func (c *CircuitBreakerBackend) Delete(ctx context.Context, key string) (bool, error) {
+	if !c.cb.AllowRequest() {
+		return false, backends.ErrCircuitOpen
+	}
+
+	deleted, err := c.backend.Delete(ctx, key)
+	if err == nil {
+		c.cb.RecordSuccess()
+	} else {
+		c.cb.RecordFailure()
+	}
+	return deleted, err
+}
+
+// Exists checks if a key exists with circuit breaker protection
+func (c *CircuitBreakerBackend) Exists(ctx context.Context, key string) (bool, error) {
+	if !c.cb.AllowRequest() {
+		return false, backends.ErrCircuitOpen
+	}
+
+	exists, err := c.backend.Exists(ctx, key)
+	if err == nil {
+		c.cb.RecordSuccess()
+	} else {
+		c.cb.RecordFailure()
+	}
+	return exists, err
+}
+
+// Clear removes all keys with circuit breaker protection
+func (c *CircuitBreakerBackend) Clear(ctx context.Context) error {
+	if !c.cb.AllowRequest() {
+		return backends.ErrCircuitOpen
+	}
+
+	err := c.backend.Clear(ctx)
+	if err == nil {
+		c.cb.RecordSuccess()
+	} else {
+		c.cb.RecordFailure()
+	}
+	return err
+}
+
+// GetStats returns statistics including circuit breaker state
+func (c *CircuitBreakerBackend) GetStats() map[string]interface{} {
+	stats := c.backend.GetStats()
+	if stats == nil {
+		stats = make(map[string]interface{})
+	}
+
+	cbStats := c.cb.Stats()
+	stats["circuit_breaker"] = map[string]interface{}{
+		"state":                cbStats.State.String(),
+		"consecutive_failures": cbStats.ConsecutiveFailures,
+		"total_requests":       cbStats.TotalRequests,
+		"total_failures":       cbStats.TotalFailures,
+		"success_rate":         cbStats.SuccessRate,
+	}
+
+	return stats
+}
+
+// Ping checks backend health with circuit breaker protection
+func (c *CircuitBreakerBackend) Ping(ctx context.Context) error {
+	if !c.cb.AllowRequest() {
+		return backends.ErrCircuitOpen
+	}
+
+	err := c.backend.Ping(ctx)
+	if err == nil {
+		c.cb.RecordSuccess()
+	} else {
+		c.cb.RecordFailure()
+	}
+	return err
+}
+
+// Close shuts down the backend
+func (c *CircuitBreakerBackend) Close() error {
+	return c.backend.Close()
+}

internal/cache/resilience/circuit_breaker_backend_test.go

@@ -0,0 +1,561 @@
+//go:build !yaegi
+
+package resilience
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/lukaszraczylo/traefikoidc/internal/cache/backends"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// mockBackend is a simple mock implementation for testing
+type mockBackend struct {
+	data       map[string]mockEntry
+	mu         sync.RWMutex
+	failSet    bool
+	failGet    bool
+	failDelete bool
+	failExists bool
+	failClear  bool
+	failPing   bool
+	callCount  int
+}
+
+type mockEntry struct {
+	value     []byte
+	expiresAt time.Time
+}
+
+func newMockBackend() *mockBackend {
+	return &mockBackend{
+		data: make(map[string]mockEntry),
+	}
+}
+
+func (m *mockBackend) Set(ctx context.Context, key string, value []byte, ttl time.Duration) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.callCount++
+
+	if m.failSet {
+		return errors.New("mock set error")
+	}
+
+	expiresAt := time.Now().Add(ttl)
+	if ttl == 0 {
+		expiresAt = time.Now().Add(24 * time.Hour)
+	}
+
+	m.data[key] = mockEntry{
+		value:     value,
+		expiresAt: expiresAt,
+	}
+	return nil
+}
+
+func (m *mockBackend) Get(ctx context.Context, key string) ([]byte, time.Duration, bool, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	m.callCount++
+
+	if m.failGet {
+		return nil, 0, false, errors.New("mock get error")
+	}
+
+	entry, exists := m.data[key]
+	if !exists {
+		return nil, 0, false, nil
+	}
+
+	if time.Now().After(entry.expiresAt) {
+		return nil, 0, false, nil
+	}
+
+	ttl := time.Until(entry.expiresAt)
+	return entry.value, ttl, true, nil
+}
+
+func (m *mockBackend) Delete(ctx context.Context, key string) (bool, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.callCount++
+
+	if m.failDelete {
+		return false, errors.New("mock delete error")
+	}
+
+	_, existed := m.data[key]
+	delete(m.data, key)
+	return existed, nil
+}
+
+func (m *mockBackend) Exists(ctx context.Context, key string) (bool, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	m.callCount++
+
+	if m.failExists {
+		return false, errors.New("mock exists error")
+	}
+
+	entry, exists := m.data[key]
+	if !exists {
+		return false, nil
+	}
+
+	if time.Now().After(entry.expiresAt) {
+		return false, nil
+	}
+
+	return true, nil
+}
+
+func (m *mockBackend) Clear(ctx context.Context) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.callCount++
+
+	if m.failClear {
+		return errors.New("mock clear error")
+	}
+
+	m.data = make(map[string]mockEntry)
+	return nil
+}
+
+func (m *mockBackend) GetStats() map[string]interface{} {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	return map[string]interface{}{
+		"hits":       int64(0),
+		"misses":     int64(0),
+		"call_count": m.callCount,
+	}
+}
+
+func (m *mockBackend) Close() error {
+	return nil
+}
+
+func (m *mockBackend) Ping(ctx context.Context) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.callCount++
+
+	if m.failPing {
+		return errors.New("mock ping error")
+	}
+	return nil
+}
+
+// Constructor Tests
+
+func TestNewCircuitBreakerBackend_WithDefaultConfig(t *testing.T) {
+	mockBE := newMockBackend()
+
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+	require.NotNil(t, cb)
+
+	// Verify it implements the interface (compile-time check)
+	var _ backends.CacheBackend = cb
+}
+
+func TestNewCircuitBreakerBackend_WithCustomConfig(t *testing.T) {
+	mockBE := newMockBackend()
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         3,
+		FailureThreshold:    0.5,
+		Timeout:             5 * time.Second,
+		HalfOpenMaxRequests: 2,
+		ResetTimeout:        10 * time.Second,
+	}
+
+	cb := NewCircuitBreakerBackend(mockBE, config)
+	require.NotNil(t, cb)
+}
+
+// Set Operation Tests
+
+func TestCircuitBreakerBackend_Set_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+	err := cb.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+
+	assert.NoError(t, err)
+	assert.Equal(t, 1, mockBE.callCount)
+
+	// Verify value was stored
+	value, _, exists, _ := mockBE.Get(ctx, "key1")
+	assert.True(t, exists)
+	assert.Equal(t, []byte("value1"), value)
+}
+
+func TestCircuitBreakerBackend_Set_Failure(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failSet = true
+
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+	err := cb.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+
+	assert.Error(t, err)
+}
+
+func TestCircuitBreakerBackend_Set_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failSet = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures to open circuit
+	for i := 0; i < 5; i++ {
+		cb.Set(ctx, "key", []byte("value"), 1*time.Minute)
+	}
+
+	// Circuit should be open now
+	err := cb.Set(ctx, "key2", []byte("value2"), 1*time.Minute)
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// Get Operation Tests
+
+func TestCircuitBreakerBackend_Get_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+
+	// First set a value
+	mockBE.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+
+	// Now get it through circuit breaker
+	value, _, exists, err := cb.Get(ctx, "key1")
+
+	assert.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, []byte("value1"), value)
+}
+
+func TestCircuitBreakerBackend_Get_Failure(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failGet = true
+
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+	_, _, _, err := cb.Get(ctx, "key1")
+
+	assert.Error(t, err)
+}
+
+func TestCircuitBreakerBackend_Get_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failGet = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures
+	for i := 0; i < 5; i++ {
+		cb.Get(ctx, "key")
+	}
+
+	// Circuit should be open
+	_, _, _, err := cb.Get(ctx, "key2")
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// Delete Operation Tests
+
+func TestCircuitBreakerBackend_Delete_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+
+	// Set a value first
+	mockBE.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+
+	// Delete through circuit breaker
+	deleted, err := cb.Delete(ctx, "key1")
+
+	assert.NoError(t, err)
+	assert.True(t, deleted)
+
+	// Verify it's deleted
+	exists, _ := mockBE.Exists(ctx, "key1")
+	assert.False(t, exists)
+}
+
+func TestCircuitBreakerBackend_Delete_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failDelete = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures
+	for i := 0; i < 5; i++ {
+		cb.Delete(ctx, "key")
+	}
+
+	// Circuit should be open
+	_, err := cb.Delete(ctx, "key2")
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// Exists Operation Tests
+
+func TestCircuitBreakerBackend_Exists_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+
+	// Set a value first
+	mockBE.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+
+	// Check existence through circuit breaker
+	exists, err := cb.Exists(ctx, "key1")
+
+	assert.NoError(t, err)
+	assert.True(t, exists)
+}
+
+func TestCircuitBreakerBackend_Exists_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failExists = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures
+	for i := 0; i < 5; i++ {
+		cb.Exists(ctx, "key")
+	}
+
+	// Circuit should be open
+	_, err := cb.Exists(ctx, "key2")
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// Clear Operation Tests
+
+func TestCircuitBreakerBackend_Clear_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+
+	// Set some values
+	mockBE.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+	mockBE.Set(ctx, "key2", []byte("value2"), 1*time.Minute)
+
+	// Clear through circuit breaker
+	err := cb.Clear(ctx)
+
+	assert.NoError(t, err)
+
+	// Verify cleared
+	exists1, _ := mockBE.Exists(ctx, "key1")
+	exists2, _ := mockBE.Exists(ctx, "key2")
+	assert.False(t, exists1)
+	assert.False(t, exists2)
+}
+
+func TestCircuitBreakerBackend_Clear_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failClear = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures
+	for i := 0; i < 5; i++ {
+		cb.Clear(ctx)
+	}
+
+	// Circuit should be open
+	err := cb.Clear(ctx)
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// GetStats Tests
+
+func TestCircuitBreakerBackend_GetStats(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+
+	// Perform some operations
+	cb.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+	cb.Get(ctx, "key1")
+
+	stats := cb.GetStats()
+
+	require.NotNil(t, stats)
+
+	// Should have circuit breaker stats
+	assert.Contains(t, stats, "circuit_breaker")
+
+	cbStats, ok := stats["circuit_breaker"].(map[string]interface{})
+	require.True(t, ok)
+
+	// Verify circuit breaker stats fields
+	assert.Contains(t, cbStats, "state")
+	assert.Contains(t, cbStats, "consecutive_failures")
+	assert.Contains(t, cbStats, "total_requests")
+	assert.Contains(t, cbStats, "total_failures")
+	assert.Contains(t, cbStats, "success_rate")
+}
+
+func TestCircuitBreakerBackend_GetStats_NilBackendStats(t *testing.T) {
+	// Create a mock backend that returns nil stats
+	mockBE := &mockBackendNilStats{}
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	stats := cb.GetStats()
+
+	require.NotNil(t, stats)
+	assert.Contains(t, stats, "circuit_breaker")
+}
+
+// mockBackendNilStats returns nil from GetStats
+type mockBackendNilStats struct {
+	mockBackend
+}
+
+func (m *mockBackendNilStats) GetStats() map[string]interface{} {
+	return nil
+}
+
+// Ping Tests
+
+func TestCircuitBreakerBackend_Ping_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+	err := cb.Ping(ctx)
+
+	assert.NoError(t, err)
+}
+
+func TestCircuitBreakerBackend_Ping_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failPing = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures
+	for i := 0; i < 5; i++ {
+		cb.Ping(ctx)
+	}
+
+	// Circuit should be open
+	err := cb.Ping(ctx)
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// Close Tests
+
+func TestCircuitBreakerBackend_Close(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	err := cb.Close()
+	assert.NoError(t, err)
+}
+
+// Circuit Recovery Test
+
+func TestCircuitBreakerBackend_CircuitRecovery(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failSet = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         2,
+		Timeout:             200 * time.Millisecond,
+		HalfOpenMaxRequests: 1,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures to open circuit
+	for i := 0; i < 5; i++ {
+		cb.Set(ctx, "key", []byte("value"), 1*time.Minute)
+	}
+
+	// Verify circuit is open
+	err := cb.Set(ctx, "key2", []byte("value2"), 1*time.Minute)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+
+	// Wait for timeout
+	time.Sleep(250 * time.Millisecond)
+
+	// Fix the backend
+	mockBE.mu.Lock()
+	mockBE.failSet = false
+	mockBE.mu.Unlock()
+
+	// Circuit should be in half-open state, allow a test request
+	err = cb.Set(ctx, "key3", []byte("value3"), 1*time.Minute)
+
+	// After success threshold is met, circuit should close
+	if err == nil {
+		// Circuit recovered
+		err2 := cb.Set(ctx, "key4", []byte("value4"), 1*time.Minute)
+		assert.NoError(t, err2, "Circuit should be closed after recovery")
+	}
+}

internal/cache/resilience/circuit_breaker_test.go

@@ -0,0 +1,553 @@
+package resilience
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestCircuitBreaker_StateTransitions tests state machine transitions
+func TestCircuitBreaker_StateTransitions(t *testing.T) {
+	t.Parallel()
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         3,
+		Timeout:             100 * time.Millisecond,
+		HalfOpenMaxRequests: 2,
+	}
+	cb := NewCircuitBreaker(config)
+
+	ctx := context.Background()
+
+	t.Run("Initial state is closed", func(t *testing.T) {
+		assert.Equal(t, StateClosed, cb.GetState())
+	})
+
+	t.Run("Closed to Open after max failures", func(t *testing.T) {
+		cb.Reset()
+
+		// Simulate failures
+		for i := 0; i < 3; i++ {
+			cb.Execute(ctx, func() error {
+				return errors.New("test error")
+			})
+		}
+
+		assert.Equal(t, StateOpen, cb.GetState())
+	})
+
+	t.Run("Open to HalfOpen after timeout", func(t *testing.T) {
+		// Open the circuit
+		cb.Reset()
+		for i := 0; i < 3; i++ {
+			cb.Execute(ctx, func() error {
+				return errors.New("test error")
+			})
+		}
+		assert.Equal(t, StateOpen, cb.GetState())
+
+		// Wait for timeout
+		time.Sleep(150 * time.Millisecond)
+
+		// Should allow request and transition to half-open
+		err := cb.Execute(ctx, func() error {
+			return nil
+		})
+
+		assert.NoError(t, err)
+		assert.Equal(t, StateHalfOpen, cb.GetState())
+	})
+
+	t.Run("HalfOpen to Closed after successful requests", func(t *testing.T) {
+		// Open circuit then wait for half-open
+		cb.Reset()
+		for i := 0; i < 3; i++ {
+			cb.Execute(ctx, func() error {
+				return errors.New("test error")
+			})
+		}
+		assert.Equal(t, StateOpen, cb.GetState())
+
+		time.Sleep(150 * time.Millisecond)
+
+		// First request transitions to half-open and succeeds
+		err := cb.Execute(ctx, func() error {
+			return nil
+		})
+		assert.NoError(t, err)
+		// Should be in half-open after first request
+		state := cb.GetState()
+		assert.True(t, state == StateHalfOpen || state == StateClosed,
+			"After first successful request, should be half-open or potentially closed")
+
+		if state == StateHalfOpen {
+			// Need more successful requests to close
+			// The exact number depends on implementation but should be within HalfOpenMaxRequests
+			for i := 0; i < config.HalfOpenMaxRequests; i++ {
+				cb.Execute(ctx, func() error {
+					return nil
+				})
+			}
+			// After multiple successful requests, should eventually close
+			finalState := cb.GetState()
+			assert.True(t, finalState == StateClosed || finalState == StateHalfOpen,
+				"After successful requests, circuit should transition towards closed")
+		}
+	})
+
+	t.Run("HalfOpen to Open on failure", func(t *testing.T) {
+		// Open circuit then wait for half-open
+		cb.Reset()
+		for i := 0; i < 3; i++ {
+			cb.Execute(ctx, func() error {
+				return errors.New("test error")
+			})
+		}
+		time.Sleep(150 * time.Millisecond)
+
+		// First call transitions to half-open, second failure reopens
+		cb.Execute(ctx, func() error {
+			return errors.New("test error")
+		})
+
+		assert.Equal(t, StateOpen, cb.GetState())
+	})
+}
+
+// TestCircuitBreaker_OpenCircuitBlocks tests that open circuit blocks requests
+func TestCircuitBreaker_OpenCircuitBlocks(t *testing.T) {
+	t.Parallel()
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         2,
+		Timeout:             1 * time.Second,
+		HalfOpenMaxRequests: 1,
+	}
+	cb := NewCircuitBreaker(config)
+
+	ctx := context.Background()
+
+	// Trigger failures to open circuit
+	for i := 0; i < 2; i++ {
+		cb.Execute(ctx, func() error {
+			return errors.New("test error")
+		})
+	}
+
+	assert.Equal(t, StateOpen, cb.GetState())
+
+	// Requests should be blocked
+	err := cb.Execute(ctx, func() error {
+		t.Fatal("Should not execute function when circuit is open")
+		return nil
+	})
+
+	assert.Error(t, err)
+	assert.Equal(t, ErrCircuitOpen, err)
+}
+
+// TestCircuitBreaker_HalfOpenMaxRequests tests max requests in half-open state
+func TestCircuitBreaker_HalfOpenMaxRequests(t *testing.T) {
+	t.Parallel()
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         3,
+		Timeout:             100 * time.Millisecond,
+		HalfOpenMaxRequests: 2,
+	}
+	cb := NewCircuitBreaker(config)
+
+	ctx := context.Background()
+
+	// Open circuit then wait for half-open
+	for i := 0; i < 3; i++ {
+		cb.Execute(ctx, func() error {
+			return errors.New("test error")
+		})
+	}
+	assert.Equal(t, StateOpen, cb.GetState())
+
+	time.Sleep(150 * time.Millisecond)
+
+	// After timeout, circuit should allow transition to half-open
+	// Execute HalfOpenMaxRequests successful requests
+	successCount := 0
+	for i := 0; i < config.HalfOpenMaxRequests; i++ {
+		err := cb.Execute(ctx, func() error {
+			successCount++
+			return nil
+		})
+		// Should allow up to HalfOpenMaxRequests
+		assert.NoError(t, err)
+	}
+
+	// Verify we executed the expected number
+	assert.Equal(t, config.HalfOpenMaxRequests, successCount)
+
+	// After successful requests, circuit behavior depends on implementation
+	// It could close (allowing more requests) or stay half-open (blocking)
+	// The important thing is that we allowed exactly HalfOpenMaxRequests
+}
+
+// TestCircuitBreaker_SuccessResetsFailures tests failure counter reset
+func TestCircuitBreaker_SuccessResetsFailures(t *testing.T) {
+	t.Parallel()
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         3,
+		Timeout:             100 * time.Millisecond,
+		HalfOpenMaxRequests: 1,
+	}
+	cb := NewCircuitBreaker(config)
+
+	ctx := context.Background()
+
+	// Have some failures (but less than max)
+	cb.Execute(ctx, func() error {
+		return errors.New("error")
+	})
+	cb.Execute(ctx, func() error {
+		return errors.New("error")
+	})
+
+	assert.Equal(t, StateClosed, cb.GetState())
+	stats := cb.Stats()
+	assert.Equal(t, int32(2), stats.ConsecutiveFailures)
+
+	// One success should reset failures
+	cb.Execute(ctx, func() error {
+		return nil
+	})
+
+	assert.Equal(t, StateClosed, cb.GetState())
+	stats = cb.Stats()
+	assert.Equal(t, int32(0), stats.ConsecutiveFailures)
+}
+
+// TestCircuitBreaker_ConcurrentAccess tests thread safety
+func TestCircuitBreaker_ConcurrentAccess(t *testing.T) {
+	t.Parallel()
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         10,
+		Timeout:             100 * time.Millisecond,
+		HalfOpenMaxRequests: 5,
+	}
+	cb := NewCircuitBreaker(config)
+
+	ctx := context.Background()
+	var wg sync.WaitGroup
+	goroutines := 20
+	iterations := 50
+
+	for i := 0; i < goroutines; i++ {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+			for j := 0; j < iterations; j++ {
+				// Mix of successes and failures
+				cb.Execute(ctx, func() error {
+					if (id+j)%3 == 0 {
+						return errors.New("test error")
+					}
+					return nil
+				})
+
+				// Random state checks
+				_ = cb.GetState()
+				_ = cb.Stats()
+			}
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Should complete without panics
+	stats := cb.Stats()
+	assert.NotNil(t, stats)
+}
+
+// TestCircuitBreaker_Stats tests statistics tracking
+func TestCircuitBreaker_Stats(t *testing.T) {
+	t.Parallel()
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         5,
+		Timeout:             100 * time.Millisecond,
+		HalfOpenMaxRequests: 2,
+	}
+	cb := NewCircuitBreaker(config)
+
+	ctx := context.Background()
+
+	// Execute some requests
+	cb.Execute(ctx, func() error { return nil })                 // Success
+	cb.Execute(ctx, func() error { return errors.New("error") }) // Failure
+	cb.Execute(ctx, func() error { return errors.New("error") }) // Failure
+
+	stats := cb.Stats()
+
+	assert.Equal(t, StateClosed, stats.State)
+	assert.Equal(t, int64(3), stats.TotalRequests)
+	assert.Equal(t, int64(2), stats.TotalFailures)
+	assert.Equal(t, int32(2), stats.ConsecutiveFailures)
+}
+
+// TestCircuitBreaker_Reset tests circuit reset
+func TestCircuitBreaker_Reset(t *testing.T) {
+	t.Parallel()
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         2,
+		Timeout:             100 * time.Millisecond,
+		HalfOpenMaxRequests: 1,
+	}
+	cb := NewCircuitBreaker(config)
+
+	ctx := context.Background()
+
+	// Open the circuit
+	for i := 0; i < 2; i++ {
+		cb.Execute(ctx, func() error {
+			return errors.New("error")
+		})
+	}
+
+	assert.Equal(t, StateOpen, cb.GetState())
+
+	// Reset
+	cb.Reset()
+
+	assert.Equal(t, StateClosed, cb.GetState())
+	stats := cb.Stats()
+	assert.Equal(t, int32(0), stats.ConsecutiveFailures)
+	assert.Equal(t, int64(0), stats.TotalRequests)
+	assert.Equal(t, int64(0), stats.TotalFailures)
+}
+
+// TestCircuitBreaker_StateChangeCallback tests state change notifications
+func TestCircuitBreaker_StateChangeCallback(t *testing.T) {
+	t.Parallel()
+
+	var transitions []string
+	var mu sync.Mutex
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         2,
+		Timeout:             50 * time.Millisecond,
+		HalfOpenMaxRequests: 1,
+		OnStateChange: func(from, to State) {
+			mu.Lock()
+			defer mu.Unlock()
+			transitions = append(transitions, from.String()+"->"+to.String())
+		},
+	}
+	cb := NewCircuitBreaker(config)
+
+	ctx := context.Background()
+
+	// Trigger state transitions
+	// Closed -> Open
+	for i := 0; i < 2; i++ {
+		cb.Execute(ctx, func() error {
+			return errors.New("error")
+		})
+	}
+
+	// Should be open now
+	assert.Equal(t, StateOpen, cb.GetState())
+
+	// Wait for timeout to allow half-open transition
+	time.Sleep(100 * time.Millisecond)
+
+	// Open -> HalfOpen on first request after timeout
+	err := cb.Execute(ctx, func() error {
+		return nil
+	})
+	assert.NoError(t, err)
+
+	// Execute more successful requests to trigger HalfOpen -> Closed
+	for i := 0; i < config.HalfOpenMaxRequests-1; i++ {
+		cb.Execute(ctx, func() error {
+			return nil
+		})
+	}
+
+	mu.Lock()
+	defer mu.Unlock()
+
+	assert.Contains(t, transitions, "closed->open")
+	assert.Contains(t, transitions, "open->half-open")
+}
+
+// TestCircuitBreaker_IsHealthy tests health check
+func TestCircuitBreaker_IsHealthy(t *testing.T) {
+	t.Parallel()
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         2,
+		Timeout:             100 * time.Millisecond,
+		HalfOpenMaxRequests: 1,
+	}
+	cb := NewCircuitBreaker(config)
+
+	ctx := context.Background()
+
+	// Initially healthy
+	assert.True(t, cb.IsHealthy())
+
+	// Open circuit
+	for i := 0; i < 2; i++ {
+		cb.Execute(ctx, func() error {
+			return errors.New("error")
+		})
+	}
+
+	assert.Equal(t, StateOpen, cb.GetState())
+	assert.False(t, cb.IsHealthy(), "Should not be healthy when open")
+
+	// Wait for timeout and allow successful request
+	time.Sleep(150 * time.Millisecond)
+	cb.Execute(ctx, func() error {
+		return nil
+	})
+
+	// Should be healthy after recovery
+	assert.True(t, cb.IsHealthy(), "Should be healthy after recovery")
+}
+
+// TestCircuitBreaker_RapidFailures tests rapid consecutive failures
+func TestCircuitBreaker_RapidFailures(t *testing.T) {
+	t.Parallel()
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         5,
+		Timeout:             200 * time.Millisecond,
+		HalfOpenMaxRequests: 1,
+	}
+	cb := NewCircuitBreaker(config)
+
+	ctx := context.Background()
+
+	// Rapid failures
+	for i := 0; i < 10; i++ {
+		cb.Execute(ctx, func() error {
+			return errors.New("rapid error")
+		})
+	}
+
+	assert.Equal(t, StateOpen, cb.GetState())
+
+	stats := cb.Stats()
+	assert.GreaterOrEqual(t, stats.TotalFailures, int64(5))
+}
+
+// TestCircuitBreaker_TimeoutAccuracy tests timeout precision
+func TestCircuitBreaker_TimeoutAccuracy(t *testing.T) {
+	t.Parallel()
+
+	timeout := 100 * time.Millisecond
+	config := &CircuitBreakerConfig{
+		MaxFailures:         1,
+		Timeout:             timeout,
+		HalfOpenMaxRequests: 1,
+	}
+	cb := NewCircuitBreaker(config)
+
+	ctx := context.Background()
+
+	// Open circuit
+	cb.Execute(ctx, func() error {
+		return errors.New("error")
+	})
+
+	assert.Equal(t, StateOpen, cb.GetState())
+
+	// Wait just before timeout
+	time.Sleep(timeout - 20*time.Millisecond)
+	assert.False(t, cb.IsHealthy())
+
+	// Wait until after timeout
+	time.Sleep(40 * time.Millisecond)
+	// After timeout, AllowRequest should return true for transition to half-open
+	assert.True(t, cb.AllowRequest())
+}
+
+// TestCircuitBreaker_DefaultConfig tests default configuration
+func TestCircuitBreaker_DefaultConfig(t *testing.T) {
+	t.Parallel()
+
+	cb := NewCircuitBreaker(nil) // Should use defaults
+
+	assert.NotNil(t, cb)
+	assert.Equal(t, StateClosed, cb.GetState())
+
+	// Verify defaults by triggering circuit breaker behavior
+	ctx := context.Background()
+
+	// Test that it takes 5 failures to open (default MaxFailures)
+	for i := 0; i < 4; i++ {
+		cb.Execute(ctx, func() error {
+			return errors.New("error")
+		})
+	}
+	assert.Equal(t, StateClosed, cb.GetState(), "Should still be closed after 4 failures")
+
+	// 5th failure should open it
+	cb.Execute(ctx, func() error {
+		return errors.New("error")
+	})
+	assert.Equal(t, StateOpen, cb.GetState(), "Should be open after 5 failures (default threshold)")
+}
+
+// TestCircuitBreaker_StateString tests state string representation
+func TestCircuitBreaker_StateString(t *testing.T) {
+	t.Parallel()
+
+	assert.Equal(t, "closed", StateClosed.String())
+	assert.Equal(t, "open", StateOpen.String())
+	assert.Equal(t, "half-open", StateHalfOpen.String())
+	assert.Equal(t, "unknown", State(999).String())
+}
+
+// Benchmark circuit breaker performance
+func BenchmarkCircuitBreaker_Execute(b *testing.B) {
+	config := &CircuitBreakerConfig{
+		MaxFailures:         100,
+		Timeout:             1 * time.Second,
+		HalfOpenMaxRequests: 10,
+	}
+	cb := NewCircuitBreaker(config)
+	ctx := context.Background()
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		cb.Execute(ctx, func() error {
+			return nil
+		})
+	}
+}
+
+func BenchmarkCircuitBreaker_ExecuteWithFailures(b *testing.B) {
+	config := &CircuitBreakerConfig{
+		MaxFailures:         1000,
+		Timeout:             1 * time.Second,
+		HalfOpenMaxRequests: 10,
+	}
+	cb := NewCircuitBreaker(config)
+	ctx := context.Background()
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		cb.Execute(ctx, func() error {
+			if i%10 == 0 {
+				return errors.New("error")
+			}
+			return nil
+		})
+	}
+}

internal/cache/resilience/health_check.go

@@ -0,0 +1,375 @@
+// Package resilience provides resilience patterns for cache backends.
+package resilience
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// HealthStatus represents the health status of a backend
+type HealthStatus int32
+
+const (
+	// HealthUnknown indicates unknown health status
+	HealthUnknown HealthStatus = iota
+
+	// HealthHealthy indicates the backend is healthy
+	HealthHealthy
+
+	// HealthDegraded indicates the backend is degraded but operational
+	HealthDegraded
+
+	// HealthUnhealthy indicates the backend is unhealthy
+	HealthUnhealthy
+)
+
+// String returns the string representation of the health status
+func (h HealthStatus) String() string {
+	switch h {
+	case HealthHealthy:
+		return "healthy"
+	case HealthDegraded:
+		return "degraded"
+	case HealthUnhealthy:
+		return "unhealthy"
+	default:
+		return "unknown"
+	}
+}
+
+// HealthCheckConfig holds configuration for the health checker
+type HealthCheckConfig struct {
+	// CheckInterval is how often to check health
+	CheckInterval time.Duration
+
+	// Timeout is the timeout for each health check
+	Timeout time.Duration
+
+	// HealthyThreshold is the number of consecutive successes to become healthy
+	HealthyThreshold int
+
+	// UnhealthyThreshold is the number of consecutive failures to become unhealthy
+	UnhealthyThreshold int
+
+	// DegradedThreshold is the latency threshold in ms to mark as degraded
+	DegradedThreshold time.Duration
+
+	// OnStatusChange is called when health status changes
+	OnStatusChange func(from, to HealthStatus)
+
+	// CheckFunc is the function to check health
+	CheckFunc func(ctx context.Context) error
+}
+
+// DefaultHealthCheckConfig returns default configuration
+func DefaultHealthCheckConfig() *HealthCheckConfig {
+	return &HealthCheckConfig{
+		CheckInterval:      30 * time.Second,
+		Timeout:            5 * time.Second,
+		HealthyThreshold:   3,
+		UnhealthyThreshold: 3,
+		DegradedThreshold:  100 * time.Millisecond,
+	}
+}
+
+// HealthChecker monitors the health of a backend
+type HealthChecker struct {
+	config *HealthCheckConfig
+
+	// Status tracking
+	status               atomic.Int32
+	consecutiveSuccesses atomic.Int32
+	consecutiveFailures  atomic.Int32
+
+	// Timing
+	lastCheckTime   time.Time
+	lastSuccessTime time.Time
+	lastFailureTime time.Time
+	averageLatency  atomic.Int64
+	timeMu          sync.RWMutex
+
+	// Metrics
+	totalChecks    atomic.Int64
+	totalSuccesses atomic.Int64
+	totalFailures  atomic.Int64
+	statusChanges  atomic.Int64
+
+	// Lifecycle
+	ticker   *time.Ticker
+	stopChan chan struct{}
+	stopped  atomic.Bool
+	wg       sync.WaitGroup
+}
+
+// NewHealthChecker creates a new health checker
+func NewHealthChecker(config *HealthCheckConfig) *HealthChecker {
+	if config == nil {
+		config = DefaultHealthCheckConfig()
+	}
+
+	hc := &HealthChecker{
+		config:   config,
+		stopChan: make(chan struct{}),
+	}
+	hc.status.Store(int32(HealthUnknown))
+
+	return hc
+}
+
+// Start begins health checking
+func (hc *HealthChecker) Start() {
+	if hc.stopped.Load() {
+		return
+	}
+
+	hc.ticker = time.NewTicker(hc.config.CheckInterval)
+	hc.wg.Add(1)
+	go hc.checkLoop()
+}
+
+// Stop stops health checking
+func (hc *HealthChecker) Stop() {
+	if hc.stopped.Swap(true) {
+		return // Already stopped
+	}
+
+	close(hc.stopChan)
+	if hc.ticker != nil {
+		hc.ticker.Stop()
+	}
+	hc.wg.Wait()
+}
+
+// checkLoop runs periodic health checks
+func (hc *HealthChecker) checkLoop() {
+	defer hc.wg.Done()
+
+	// Initial check - log error but continue
+	if err := hc.Check(context.Background()); err != nil {
+		// Error is already tracked in Check() method, no need to log again
+		_ = err
+	}
+
+	for {
+		select {
+		case <-hc.stopChan:
+			return
+		case <-hc.ticker.C:
+			ctx, cancel := context.WithTimeout(context.Background(), hc.config.Timeout)
+			if err := hc.Check(ctx); err != nil {
+				// Error is already tracked in Check() method, no need to log again
+				_ = err
+			}
+			cancel()
+		}
+	}
+}
+
+// Check performs a health check
+func (hc *HealthChecker) Check(ctx context.Context) error {
+	if hc.config.CheckFunc == nil {
+		return nil
+	}
+
+	hc.totalChecks.Add(1)
+	start := time.Now()
+
+	// Create timeout context if not already set
+	if _, hasDeadline := ctx.Deadline(); !hasDeadline {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, hc.config.Timeout)
+		defer cancel()
+	}
+
+	// Perform health check
+	err := hc.config.CheckFunc(ctx)
+	latency := time.Since(start)
+
+	hc.timeMu.Lock()
+	hc.lastCheckTime = time.Now()
+	hc.timeMu.Unlock()
+
+	// Update average latency
+	hc.updateAverageLatency(latency)
+
+	if err != nil {
+		hc.recordFailure()
+	} else {
+		hc.recordSuccess(latency)
+	}
+
+	return err
+}
+
+// recordSuccess records a successful health check
+func (hc *HealthChecker) recordSuccess(latency time.Duration) {
+	hc.totalSuccesses.Add(1)
+	successes := hc.consecutiveSuccesses.Add(1)
+	hc.consecutiveFailures.Store(0)
+
+	hc.timeMu.Lock()
+	hc.lastSuccessTime = time.Now()
+	hc.timeMu.Unlock()
+
+	currentStatus := hc.GetStatus()
+	newStatus := currentStatus
+
+	// Check if we should become healthy
+	if successes >= int32(hc.config.HealthyThreshold) {
+		if latency > hc.config.DegradedThreshold {
+			newStatus = HealthDegraded
+		} else {
+			newStatus = HealthHealthy
+		}
+	}
+
+	if newStatus != currentStatus {
+		hc.setStatus(newStatus)
+	}
+}
+
+// recordFailure records a failed health check
+func (hc *HealthChecker) recordFailure() {
+	hc.totalFailures.Add(1)
+	failures := hc.consecutiveFailures.Add(1)
+	hc.consecutiveSuccesses.Store(0)
+
+	hc.timeMu.Lock()
+	hc.lastFailureTime = time.Now()
+	hc.timeMu.Unlock()
+
+	// Check if we should become unhealthy
+	if failures >= int32(hc.config.UnhealthyThreshold) {
+		hc.setStatus(HealthUnhealthy)
+	}
+}
+
+// updateAverageLatency updates the rolling average latency
+func (hc *HealthChecker) updateAverageLatency(latency time.Duration) {
+	// Simple exponential moving average
+	currentAvg := time.Duration(hc.averageLatency.Load())
+	if currentAvg == 0 {
+		hc.averageLatency.Store(int64(latency))
+	} else {
+		// Weight: 0.2 for new value, 0.8 for old average
+		newAvg := (currentAvg*4 + latency) / 5
+		hc.averageLatency.Store(int64(newAvg))
+	}
+}
+
+// GetStatus returns the current health status
+func (hc *HealthChecker) GetStatus() HealthStatus {
+	return HealthStatus(hc.status.Load())
+}
+
+// setStatus changes the health status
+func (hc *HealthChecker) setStatus(newStatus HealthStatus) {
+	oldStatus := HealthStatus(hc.status.Swap(int32(newStatus)))
+
+	if oldStatus != newStatus {
+		hc.statusChanges.Add(1)
+		if hc.config.OnStatusChange != nil {
+			hc.config.OnStatusChange(oldStatus, newStatus)
+		}
+	}
+}
+
+// IsHealthy returns true if the backend is healthy or degraded
+func (hc *HealthChecker) IsHealthy() bool {
+	status := hc.GetStatus()
+	return status == HealthHealthy || status == HealthDegraded
+}
+
+// LastCheckTime returns the time of the last health check
+func (hc *HealthChecker) LastCheckTime() time.Time {
+	hc.timeMu.RLock()
+	defer hc.timeMu.RUnlock()
+	return hc.lastCheckTime
+}
+
+// HealthScore returns a health score between 0.0 (unhealthy) and 1.0 (healthy)
+func (hc *HealthChecker) HealthScore() float64 {
+	status := hc.GetStatus()
+	switch status {
+	case HealthHealthy:
+		return 1.0
+	case HealthDegraded:
+		return 0.7
+	case HealthUnhealthy:
+		return 0.0
+	default:
+		return 0.5
+	}
+}
+
+// Stats returns health checker statistics
+func (hc *HealthChecker) Stats() HealthCheckerStats {
+	hc.timeMu.RLock()
+	lastCheck := hc.lastCheckTime
+	lastSuccess := hc.lastSuccessTime
+	lastFailure := hc.lastFailureTime
+	hc.timeMu.RUnlock()
+
+	totalChecks := hc.totalChecks.Load()
+	totalSuccesses := hc.totalSuccesses.Load()
+	totalFailures := hc.totalFailures.Load()
+
+	successRate := float64(0)
+	if totalChecks > 0 {
+		successRate = float64(totalSuccesses) / float64(totalChecks)
+	}
+
+	return HealthCheckerStats{
+		Status:               hc.GetStatus(),
+		ConsecutiveSuccesses: hc.consecutiveSuccesses.Load(),
+		ConsecutiveFailures:  hc.consecutiveFailures.Load(),
+		TotalChecks:          totalChecks,
+		TotalSuccesses:       totalSuccesses,
+		TotalFailures:        totalFailures,
+		SuccessRate:          successRate,
+		AverageLatency:       time.Duration(hc.averageLatency.Load()),
+		StatusChanges:        hc.statusChanges.Load(),
+		LastCheckTime:        lastCheck,
+		LastSuccessTime:      lastSuccess,
+		LastFailureTime:      lastFailure,
+		HealthScore:          hc.HealthScore(),
+	}
+}
+
+// HealthCheckerStats holds statistics for the health checker
+type HealthCheckerStats struct {
+	Status               HealthStatus
+	ConsecutiveSuccesses int32
+	ConsecutiveFailures  int32
+	TotalChecks          int64
+	TotalSuccesses       int64
+	TotalFailures        int64
+	SuccessRate          float64
+	AverageLatency       time.Duration
+	StatusChanges        int64
+	LastCheckTime        time.Time
+	LastSuccessTime      time.Time
+	LastFailureTime      time.Time
+	HealthScore          float64
+}
+
+// Reset resets the health checker statistics
+func (hc *HealthChecker) Reset() {
+	hc.status.Store(int32(HealthUnknown))
+	hc.consecutiveSuccesses.Store(0)
+	hc.consecutiveFailures.Store(0)
+	hc.totalChecks.Store(0)
+	hc.totalSuccesses.Store(0)
+	hc.totalFailures.Store(0)
+	hc.statusChanges.Store(0)
+	hc.averageLatency.Store(0)
+
+	now := time.Now()
+	hc.timeMu.Lock()
+	hc.lastCheckTime = now
+	hc.lastSuccessTime = now
+	hc.lastFailureTime = now
+	hc.timeMu.Unlock()
+}

internal/cache/resilience/health_check_backend.go

@@ -0,0 +1,215 @@
+// Package resilience provides resilience patterns for cache backends.
+package resilience
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/lukaszraczylo/traefikoidc/internal/cache/backends"
+)
+
+// HealthCheckBackend wraps a cache backend with health checking
+type HealthCheckBackend struct {
+	backend backends.CacheBackend
+	config  *HealthCheckConfig
+
+	// Health tracking
+	status           atomic.Int32
+	consecutiveFails atomic.Int32
+	consecutiveOK    atomic.Int32
+	lastCheck        time.Time
+	checkMutex       sync.RWMutex
+
+	// Lifecycle
+	ctx    context.Context
+	cancel context.CancelFunc
+	wg     sync.WaitGroup
+}
+
+// NewHealthCheckBackend creates a new health check wrapped backend
+func NewHealthCheckBackend(b backends.CacheBackend, config *HealthCheckConfig) backends.CacheBackend {
+	if config == nil {
+		config = DefaultHealthCheckConfig()
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	hc := &HealthCheckBackend{
+		backend: b,
+		config:  config,
+		ctx:     ctx,
+		cancel:  cancel,
+	}
+
+	// Set initial status to healthy (optimistic)
+	hc.status.Store(int32(HealthHealthy))
+
+	// Start health check routine
+	hc.wg.Add(1)
+	go hc.healthCheckLoop()
+
+	return hc
+}
+
+// Set stores a value and tracks health
+func (h *HealthCheckBackend) Set(ctx context.Context, key string, value []byte, ttl time.Duration) error {
+	// Allow operations even if unhealthy (may recover)
+	err := h.backend.Set(ctx, key, value, ttl)
+	h.recordResult(err == nil)
+	return err
+}
+
+// Get retrieves a value and tracks health
+func (h *HealthCheckBackend) Get(ctx context.Context, key string) ([]byte, time.Duration, bool, error) {
+	value, ttl, exists, err := h.backend.Get(ctx, key)
+	h.recordResult(err == nil)
+	return value, ttl, exists, err
+}
+
+// Delete removes a key and tracks health
+func (h *HealthCheckBackend) Delete(ctx context.Context, key string) (bool, error) {
+	deleted, err := h.backend.Delete(ctx, key)
+	h.recordResult(err == nil)
+	return deleted, err
+}
+
+// Exists checks if a key exists and tracks health
+func (h *HealthCheckBackend) Exists(ctx context.Context, key string) (bool, error) {
+	exists, err := h.backend.Exists(ctx, key)
+	h.recordResult(err == nil)
+	return exists, err
+}
+
+// Clear removes all keys and tracks health
+func (h *HealthCheckBackend) Clear(ctx context.Context) error {
+	err := h.backend.Clear(ctx)
+	h.recordResult(err == nil)
+	return err
+}
+
+// GetStats returns statistics including health status
+func (h *HealthCheckBackend) GetStats() map[string]interface{} {
+	stats := h.backend.GetStats()
+	if stats == nil {
+		stats = make(map[string]interface{})
+	}
+
+	h.checkMutex.RLock()
+	lastCheck := h.lastCheck
+	h.checkMutex.RUnlock()
+
+	status := HealthStatus(h.status.Load())
+	stats["health"] = map[string]interface{}{
+		"status":             status.String(),
+		"consecutive_fails":  h.consecutiveFails.Load(),
+		"consecutive_ok":     h.consecutiveOK.Load(),
+		"last_check":         lastCheck.Format(time.RFC3339),
+		"time_since_check":   time.Since(lastCheck).Seconds(),
+		"check_interval_sec": h.config.CheckInterval.Seconds(),
+	}
+
+	return stats
+}
+
+// Ping checks backend health
+func (h *HealthCheckBackend) Ping(ctx context.Context) error {
+	err := h.backend.Ping(ctx)
+	h.recordResult(err == nil)
+	return err
+}
+
+// Close shuts down the health checker and backend
+func (h *HealthCheckBackend) Close() error {
+	// Stop health check routine
+	h.cancel()
+
+	// Wait for routine to finish
+	done := make(chan struct{})
+	go func() {
+		h.wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// Finished normally
+	case <-time.After(2 * time.Second):
+		// Timeout
+	}
+
+	return h.backend.Close()
+}
+
+// IsHealthy returns true if the backend is healthy
+func (h *HealthCheckBackend) IsHealthy() bool {
+	status := HealthStatus(h.status.Load())
+	return status == HealthHealthy || status == HealthDegraded
+}
+
+// recordResult records the result of an operation for health tracking
+func (h *HealthCheckBackend) recordResult(success bool) {
+	if success {
+		fails := h.consecutiveFails.Swap(0)
+		oks := h.consecutiveOK.Add(1)
+
+		// Check if we should transition to healthy
+		if fails > 0 && oks >= int32(h.config.HealthyThreshold) {
+			oldStatus := HealthStatus(h.status.Swap(int32(HealthHealthy)))
+			if oldStatus != HealthHealthy && h.config.OnStatusChange != nil {
+				h.config.OnStatusChange(oldStatus, HealthHealthy)
+			}
+		}
+	} else {
+		oks := h.consecutiveOK.Swap(0)
+		fails := h.consecutiveFails.Add(1)
+
+		// Check if we should transition to unhealthy
+		if oks > 0 && fails >= int32(h.config.UnhealthyThreshold) {
+			oldStatus := HealthStatus(h.status.Swap(int32(HealthUnhealthy)))
+			if oldStatus != HealthUnhealthy && h.config.OnStatusChange != nil {
+				h.config.OnStatusChange(oldStatus, HealthUnhealthy)
+			}
+		} else if fails >= int32(h.config.UnhealthyThreshold)*2 {
+			// Severely degraded
+			h.status.Store(int32(HealthUnhealthy))
+		} else if fails >= int32(h.config.UnhealthyThreshold) {
+			// Degraded but still trying
+			h.status.Store(int32(HealthDegraded))
+		}
+	}
+}
+
+// healthCheckLoop runs periodic health checks
+func (h *HealthCheckBackend) healthCheckLoop() {
+	defer h.wg.Done()
+
+	ticker := time.NewTicker(h.config.CheckInterval)
+	defer ticker.Stop()
+
+	// Do initial check
+	h.performHealthCheck()
+
+	for {
+		select {
+		case <-h.ctx.Done():
+			return
+		case <-ticker.C:
+			h.performHealthCheck()
+		}
+	}
+}
+
+// performHealthCheck performs a single health check
+func (h *HealthCheckBackend) performHealthCheck() {
+	h.checkMutex.Lock()
+	h.lastCheck = time.Now()
+	h.checkMutex.Unlock()
+
+	ctx, cancel := context.WithTimeout(context.Background(), h.config.Timeout)
+	defer cancel()
+
+	err := h.backend.Ping(ctx)
+	h.recordResult(err == nil)
+}

internal/cache/resilience/health_check_test.go

@@ -0,0 +1,447 @@
+package resilience
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestHealthChecker_StatusTransitions tests health status transitions
+func TestHealthChecker_StatusTransitions(t *testing.T) {
+	t.Parallel()
+
+	var callCount atomic.Int32
+	var shouldFail atomic.Bool
+
+	checkFunc := func(ctx context.Context) error {
+		callCount.Add(1)
+		if shouldFail.Load() {
+			return errors.New("health check failed")
+		}
+		return nil
+	}
+
+	config := &HealthCheckConfig{
+		CheckInterval:      50 * time.Millisecond,
+		Timeout:            10 * time.Millisecond,
+		UnhealthyThreshold: 3,
+		HealthyThreshold:   2,
+		CheckFunc:          checkFunc,
+	}
+
+	hc := NewHealthChecker(config)
+	hc.Start()
+	defer hc.Stop()
+
+	// Initially unknown
+	assert.Equal(t, HealthUnknown, hc.GetStatus())
+
+	// Trigger failures
+	shouldFail.Store(true)
+	time.Sleep(200 * time.Millisecond)
+
+	// Should be unhealthy after threshold failures
+	status := hc.GetStatus()
+	assert.True(t, status == HealthUnhealthy || status == HealthDegraded)
+
+	// Recover
+	shouldFail.Store(false)
+	time.Sleep(150 * time.Millisecond)
+
+	// Should recover towards healthy
+	finalStatus := hc.GetStatus()
+	assert.True(t, finalStatus == HealthHealthy || finalStatus == HealthDegraded || finalStatus == HealthUnknown)
+}
+
+// TestHealthChecker_InitialState tests initial health status
+func TestHealthChecker_InitialState(t *testing.T) {
+	t.Parallel()
+
+	checkFunc := func(ctx context.Context) error {
+		return nil
+	}
+
+	config := &HealthCheckConfig{
+		CheckFunc: checkFunc,
+	}
+	hc := NewHealthChecker(config)
+	assert.Equal(t, HealthUnknown, hc.GetStatus())
+	assert.False(t, hc.IsHealthy())
+}
+
+// TestHealthChecker_ForceCheck tests manual health check trigger
+func TestHealthChecker_ForceCheck(t *testing.T) {
+	t.Parallel()
+
+	var callCount atomic.Int32
+
+	checkFunc := func(ctx context.Context) error {
+		callCount.Add(1)
+		return nil
+	}
+
+	config := &HealthCheckConfig{
+		CheckInterval:      10 * time.Second, // Long interval
+		Timeout:            1 * time.Second,
+		UnhealthyThreshold: 3,
+		HealthyThreshold:   2,
+		CheckFunc:          checkFunc,
+	}
+
+	hc := NewHealthChecker(config)
+
+	initialCount := callCount.Load()
+
+	// Force check
+	hc.Check(context.Background())
+
+	// Should have been called
+	assert.Greater(t, callCount.Load(), initialCount)
+}
+
+// TestHealthChecker_StatusChangeCallback tests status change notifications
+func TestHealthChecker_StatusChangeCallback(t *testing.T) {
+	t.Parallel()
+
+	var transitions []string
+	var mu sync.Mutex
+	var shouldFail atomic.Bool
+
+	checkFunc := func(ctx context.Context) error {
+		if shouldFail.Load() {
+			return errors.New("health check failed")
+		}
+		return nil
+	}
+
+	config := &HealthCheckConfig{
+		CheckInterval:      30 * time.Millisecond,
+		Timeout:            10 * time.Millisecond,
+		UnhealthyThreshold: 2,
+		HealthyThreshold:   2,
+		CheckFunc:          checkFunc,
+		OnStatusChange: func(from, to HealthStatus) {
+			mu.Lock()
+			defer mu.Unlock()
+			transitions = append(transitions, from.String()+"->"+to.String())
+		},
+	}
+
+	hc := NewHealthChecker(config)
+	hc.Start()
+	defer hc.Stop()
+
+	// Trigger failures
+	shouldFail.Store(true)
+	time.Sleep(100 * time.Millisecond)
+
+	// Recover
+	shouldFail.Store(false)
+	time.Sleep(100 * time.Millisecond)
+
+	mu.Lock()
+	defer mu.Unlock()
+
+	// Should have status transitions
+	assert.NotEmpty(t, transitions)
+}
+
+// TestHealthChecker_Stats tests statistics tracking
+func TestHealthChecker_Stats(t *testing.T) {
+	t.Parallel()
+
+	var callCount atomic.Int32
+
+	checkFunc := func(ctx context.Context) error {
+		callCount.Add(1)
+		if callCount.Load()%2 == 0 {
+			return errors.New("failure")
+		}
+		return nil
+	}
+
+	config := &HealthCheckConfig{
+		CheckInterval:      20 * time.Millisecond,
+		Timeout:            10 * time.Millisecond,
+		UnhealthyThreshold: 5,
+		HealthyThreshold:   2,
+		CheckFunc:          checkFunc,
+	}
+
+	hc := NewHealthChecker(config)
+	hc.Start()
+	defer hc.Stop()
+
+	time.Sleep(150 * time.Millisecond)
+
+	stats := hc.Stats()
+
+	assert.Greater(t, stats.TotalChecks, int64(0))
+	assert.Greater(t, stats.TotalFailures, int64(0))
+	assert.Greater(t, stats.SuccessRate, 0.0)
+	assert.Less(t, stats.SuccessRate, 1.0)
+}
+
+// TestHealthChecker_Timeout tests check timeout handling
+func TestHealthChecker_Timeout(t *testing.T) {
+	t.Parallel()
+
+	checkFunc := func(ctx context.Context) error {
+		// Simulate slow check
+		select {
+		case <-time.After(100 * time.Millisecond):
+			return nil
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+
+	config := &HealthCheckConfig{
+		CheckInterval:      50 * time.Millisecond,
+		Timeout:            10 * time.Millisecond, // Short timeout
+		UnhealthyThreshold: 2,
+		HealthyThreshold:   2,
+		CheckFunc:          checkFunc,
+	}
+
+	hc := NewHealthChecker(config)
+	hc.Start()
+	defer hc.Stop()
+
+	time.Sleep(150 * time.Millisecond)
+
+	// Should be unhealthy due to timeouts
+	status := hc.GetStatus()
+	assert.NotEqual(t, HealthHealthy, status)
+}
+
+// TestHealthChecker_ConcurrentAccess tests thread safety
+func TestHealthChecker_ConcurrentAccess(t *testing.T) {
+	t.Parallel()
+
+	checkFunc := func(ctx context.Context) error {
+		return nil
+	}
+
+	config := &HealthCheckConfig{
+		CheckInterval:      10 * time.Millisecond,
+		Timeout:            5 * time.Millisecond,
+		UnhealthyThreshold: 3,
+		HealthyThreshold:   2,
+		CheckFunc:          checkFunc,
+	}
+
+	hc := NewHealthChecker(config)
+	hc.Start()
+	defer hc.Stop()
+
+	var wg sync.WaitGroup
+	goroutines := 20
+
+	for i := 0; i < goroutines; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for j := 0; j < 50; j++ {
+				_ = hc.GetStatus()
+				_ = hc.IsHealthy()
+				_ = hc.Stats()
+				hc.Check(context.Background())
+			}
+		}()
+	}
+
+	wg.Wait()
+	// Should complete without panics
+}
+
+// TestHealthChecker_StopAndStart tests lifecycle management
+func TestHealthChecker_StopAndStart(t *testing.T) {
+	t.Parallel()
+
+	var callCount atomic.Int32
+
+	checkFunc := func(ctx context.Context) error {
+		callCount.Add(1)
+		return nil
+	}
+
+	config := &HealthCheckConfig{
+		CheckInterval:      20 * time.Millisecond,
+		Timeout:            10 * time.Millisecond,
+		UnhealthyThreshold: 3,
+		HealthyThreshold:   2,
+		CheckFunc:          checkFunc,
+	}
+
+	hc := NewHealthChecker(config)
+
+	// Start
+	hc.Start()
+	time.Sleep(100 * time.Millisecond)
+	count1 := callCount.Load()
+	assert.Greater(t, count1, int32(0))
+
+	// Stop
+	hc.Stop()
+	time.Sleep(100 * time.Millisecond)
+	count2 := callCount.Load()
+
+	// Should not have increased significantly after stop
+	assert.Less(t, count2-count1, int32(3))
+}
+
+// TestHealthChecker_DegradedState tests degraded status
+func TestHealthChecker_DegradedState(t *testing.T) {
+	t.Parallel()
+
+	var callCount atomic.Int32
+
+	checkFunc := func(ctx context.Context) error {
+		count := callCount.Add(1)
+		// Fail once, then succeed
+		if count == 1 {
+			return errors.New("single failure")
+		}
+		return nil
+	}
+
+	config := &HealthCheckConfig{
+		CheckInterval:      30 * time.Millisecond,
+		Timeout:            10 * time.Millisecond,
+		UnhealthyThreshold: 3, // Need 3 failures for unhealthy
+		HealthyThreshold:   2, // Need 2 successes for healthy
+		CheckFunc:          checkFunc,
+	}
+
+	hc := NewHealthChecker(config)
+	hc.Start()
+	defer hc.Stop()
+
+	time.Sleep(100 * time.Millisecond)
+
+	// After initial checks, status should be set (might be healthy or degraded based on execution)
+	status := hc.GetStatus()
+	assert.True(t, status != HealthUnknown, "Status should not be unknown after checks")
+}
+
+// TestHealthChecker_DefaultConfig tests default configuration
+func TestHealthChecker_DefaultConfig(t *testing.T) {
+	t.Parallel()
+
+	checkFunc := func(ctx context.Context) error {
+		return nil
+	}
+
+	config := &HealthCheckConfig{
+		CheckFunc: checkFunc,
+	}
+	hc := NewHealthChecker(config)
+
+	assert.NotNil(t, hc)
+	assert.Equal(t, HealthUnknown, hc.GetStatus())
+
+	// Verify default config was applied (we can't access private fields, so just check it works)
+	assert.NotNil(t, hc)
+}
+
+// TestHealthChecker_StatusString tests status string representation
+func TestHealthChecker_StatusString(t *testing.T) {
+	t.Parallel()
+
+	assert.Equal(t, "healthy", HealthHealthy.String())
+	assert.Equal(t, "unhealthy", HealthUnhealthy.String())
+	assert.Equal(t, "degraded", HealthDegraded.String())
+	assert.Equal(t, "unknown", HealthStatus(999).String())
+}
+
+// TestHealthChecker_RecoveryPattern tests typical failure and recovery
+func TestHealthChecker_RecoveryPattern(t *testing.T) {
+	t.Parallel()
+
+	var checkNumber atomic.Int32
+
+	checkFunc := func(ctx context.Context) error {
+		n := checkNumber.Add(1)
+		// Fail checks 3-5, succeed others
+		if n >= 3 && n <= 5 {
+			return errors.New("temporary failure")
+		}
+		return nil
+	}
+
+	var statusLog []HealthStatus
+	var mu sync.Mutex
+
+	config := &HealthCheckConfig{
+		CheckInterval:      30 * time.Millisecond,
+		Timeout:            10 * time.Millisecond,
+		UnhealthyThreshold: 3,
+		HealthyThreshold:   2,
+		CheckFunc:          checkFunc,
+		OnStatusChange: func(from, to HealthStatus) {
+			mu.Lock()
+			defer mu.Unlock()
+			statusLog = append(statusLog, to)
+		},
+	}
+
+	hc := NewHealthChecker(config)
+	hc.Start()
+	defer hc.Stop()
+
+	time.Sleep(300 * time.Millisecond)
+
+	mu.Lock()
+	defer mu.Unlock()
+
+	// Should see transitions through unhealthy and back to healthy
+	assert.NotEmpty(t, statusLog)
+
+	// Final status should be healthy or degraded (recovered)
+	finalStatus := hc.GetStatus()
+	assert.True(t, finalStatus == HealthHealthy || finalStatus == HealthDegraded, "Should have recovered")
+}
+
+// Benchmark health checker performance
+func BenchmarkHealthChecker_ForceCheck(b *testing.B) {
+	checkFunc := func(ctx context.Context) error {
+		return nil
+	}
+
+	config := &HealthCheckConfig{
+		CheckInterval:      10 * time.Minute,
+		Timeout:            1 * time.Second,
+		UnhealthyThreshold: 3,
+		HealthyThreshold:   2,
+		CheckFunc:          checkFunc,
+	}
+
+	hc := NewHealthChecker(config)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		hc.Check(context.Background())
+	}
+}
+
+func BenchmarkHealthChecker_Status(b *testing.B) {
+	checkFunc := func(ctx context.Context) error {
+		return nil
+	}
+
+	config := &HealthCheckConfig{
+		CheckFunc: checkFunc,
+	}
+	hc := NewHealthChecker(config)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = hc.GetStatus()
+	}
+}

internal/cleanup/cleanup_test.go

@@ -0,0 +1,931 @@
+//go:build !yaegi
+
+package cleanup
+
+import (
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// Mock logger for testing
+type mockLogger struct {
+	mu       sync.Mutex
+	logs     []string
+	errLogs  []string
+	debugLog []string
+}
+
+func (m *mockLogger) Logf(format string, args ...interface{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.logs = append(m.logs, format)
+}
+
+func (m *mockLogger) ErrorLogf(format string, args ...interface{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.errLogs = append(m.errLogs, format)
+}
+
+func (m *mockLogger) DebugLogf(format string, args ...interface{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.debugLog = append(m.debugLog, format)
+}
+
+func (m *mockLogger) getLogCount() int {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return len(m.logs)
+}
+
+// BackgroundTask tests
+func TestNewBackgroundTask(t *testing.T) {
+	logger := &mockLogger{}
+	var wg sync.WaitGroup
+	runCount := 0
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {
+		runCount++
+	}, logger, &wg)
+
+	if task == nil {
+		t.Fatal("Expected NewBackgroundTask to return non-nil")
+	}
+
+	if task.name != "test-task" {
+		t.Errorf("Expected name 'test-task', got '%s'", task.name)
+	}
+
+	if task.interval != 100*time.Millisecond {
+		t.Errorf("Expected interval 100ms, got %v", task.interval)
+	}
+
+	if task.IsRunning() {
+		t.Error("Expected task to not be running initially")
+	}
+}
+
+func TestBackgroundTask_Start(t *testing.T) {
+	logger := &mockLogger{}
+	runCount := int32(0)
+
+	task := NewBackgroundTask("test-task", 50*time.Millisecond, func() {
+		atomic.AddInt32(&runCount, 1)
+	}, logger)
+
+	task.Start()
+
+	if !task.IsRunning() {
+		t.Error("Expected task to be running after Start()")
+	}
+
+	// Wait for at least 2 executions
+	time.Sleep(120 * time.Millisecond)
+
+	task.Stop()
+
+	count := atomic.LoadInt32(&runCount)
+	if count < 2 {
+		t.Errorf("Expected at least 2 executions, got %d", count)
+	}
+}
+
+func TestBackgroundTask_Stop(t *testing.T) {
+	logger := &mockLogger{}
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+
+	task.Start()
+	time.Sleep(50 * time.Millisecond)
+	task.Stop()
+
+	if task.IsRunning() {
+		t.Error("Expected task to not be running after Stop()")
+	}
+
+	// Calling Stop again should not panic
+	task.Stop()
+}
+
+func TestBackgroundTask_DoubleStart(t *testing.T) {
+	logger := &mockLogger{}
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+
+	task.Start()
+	logCountBefore := logger.getLogCount()
+
+	// Second start should be ignored
+	task.Start()
+
+	logCountAfter := logger.getLogCount()
+	if logCountAfter <= logCountBefore {
+		t.Error("Expected log message about task already running")
+	}
+
+	task.Stop()
+}
+
+func TestBackgroundTask_ExecuteWithPanic(t *testing.T) {
+	logger := &mockLogger{}
+	panicCount := int32(0)
+
+	task := NewBackgroundTask("panic-task", 50*time.Millisecond, func() {
+		count := atomic.AddInt32(&panicCount, 1)
+		if count == 1 {
+			panic("test panic")
+		}
+	}, logger)
+
+	task.Start()
+	time.Sleep(120 * time.Millisecond)
+	task.Stop()
+
+	// Task should recover from panic and continue
+	finalCount := atomic.LoadInt32(&panicCount)
+	if finalCount < 2 {
+		t.Errorf("Expected task to continue after panic, got %d executions", finalCount)
+	}
+
+	stats := task.GetStats()
+	if stats["errorCount"].(int64) < 1 {
+		t.Error("Expected error count to be at least 1")
+	}
+}
+
+func TestBackgroundTask_GetStats(t *testing.T) {
+	logger := &mockLogger{}
+	runCount := int32(0)
+
+	task := NewBackgroundTask("test-task", 50*time.Millisecond, func() {
+		atomic.AddInt32(&runCount, 1)
+	}, logger)
+
+	task.Start()
+	time.Sleep(120 * time.Millisecond)
+	task.Stop()
+
+	stats := task.GetStats()
+
+	if stats["name"] != "test-task" {
+		t.Errorf("Expected name 'test-task', got %v", stats["name"])
+	}
+
+	if !stats["isRunning"].(bool) == true {
+		// Task should be stopped
+	}
+
+	if stats["runCount"].(int64) < 2 {
+		t.Errorf("Expected runCount >= 2, got %v", stats["runCount"])
+	}
+}
+
+func TestBackgroundTask_WithWaitGroup(t *testing.T) {
+	logger := &mockLogger{}
+	var wg sync.WaitGroup
+	runCount := int32(0)
+
+	task := NewBackgroundTask("test-task", 50*time.Millisecond, func() {
+		atomic.AddInt32(&runCount, 1)
+	}, logger, &wg)
+
+	task.Start()
+
+	// Wait for task to start
+	time.Sleep(100 * time.Millisecond)
+
+	// Stop and wait
+	done := make(chan bool)
+	go func() {
+		task.Stop()
+		wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(2 * time.Second):
+		t.Error("Timeout waiting for task to stop")
+	}
+}
+
+// TaskRegistry tests
+func TestNewTaskRegistry(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	if registry == nil {
+		t.Fatal("Expected NewTaskRegistry to return non-nil")
+	}
+
+	if registry.maxTasks != 10 {
+		t.Errorf("Expected maxTasks 10, got %d", registry.maxTasks)
+	}
+
+	if registry.GetTaskCount() != 0 {
+		t.Error("Expected initial task count to be 0")
+	}
+}
+
+func TestTaskRegistry_RegisterTask(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	err := registry.RegisterTask("test-task", task)
+
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	if registry.GetTaskCount() != 1 {
+		t.Error("Expected task count to be 1")
+	}
+}
+
+func TestTaskRegistry_RegisterTask_Duplicate(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task1 := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	task2 := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+
+	err1 := registry.RegisterTask("test-task", task1)
+	if err1 != nil {
+		t.Errorf("Expected no error on first registration, got %v", err1)
+	}
+
+	err2 := registry.RegisterTask("test-task", task2)
+	if err2 == nil {
+		t.Error("Expected error when registering duplicate task")
+	}
+}
+
+func TestTaskRegistry_RegisterTask_Nil(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	err := registry.RegisterTask("test-task", nil)
+	if err == nil {
+		t.Error("Expected error when registering nil task")
+	}
+}
+
+func TestTaskRegistry_RegisterTask_MaxLimit(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 2)
+
+	task1 := NewBackgroundTask("task1", 100*time.Millisecond, func() {}, logger)
+	task2 := NewBackgroundTask("task2", 100*time.Millisecond, func() {}, logger)
+	task3 := NewBackgroundTask("task3", 100*time.Millisecond, func() {}, logger)
+
+	registry.RegisterTask("task1", task1)
+	registry.RegisterTask("task2", task2)
+	err := registry.RegisterTask("task3", task3)
+
+	if err == nil {
+		t.Error("Expected error when exceeding max tasks")
+	}
+}
+
+func TestTaskRegistry_UnregisterTask(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	registry.RegisterTask("test-task", task)
+
+	if registry.GetTaskCount() != 1 {
+		t.Error("Expected task count to be 1")
+	}
+
+	registry.UnregisterTask("test-task")
+
+	if registry.GetTaskCount() != 0 {
+		t.Error("Expected task count to be 0 after unregister")
+	}
+}
+
+func TestTaskRegistry_UnregisterTask_Running(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	registry.RegisterTask("test-task", task)
+	task.Start()
+
+	time.Sleep(50 * time.Millisecond)
+
+	registry.UnregisterTask("test-task")
+
+	if task.IsRunning() {
+		t.Error("Expected task to be stopped after unregister")
+	}
+}
+
+func TestTaskRegistry_GetTask(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	registry.RegisterTask("test-task", task)
+
+	retrieved, exists := registry.GetTask("test-task")
+	if !exists {
+		t.Error("Expected task to exist")
+	}
+
+	if retrieved != task {
+		t.Error("Expected to retrieve the same task")
+	}
+
+	_, exists = registry.GetTask("non-existent")
+	if exists {
+		t.Error("Expected non-existent task to not exist")
+	}
+}
+
+func TestTaskRegistry_StopAllTasks(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task1 := NewBackgroundTask("task1", 100*time.Millisecond, func() {}, logger)
+	task2 := NewBackgroundTask("task2", 100*time.Millisecond, func() {}, logger)
+
+	registry.RegisterTask("task1", task1)
+	registry.RegisterTask("task2", task2)
+
+	task1.Start()
+	task2.Start()
+
+	time.Sleep(50 * time.Millisecond)
+
+	registry.StopAllTasks()
+
+	if task1.IsRunning() || task2.IsRunning() {
+		t.Error("Expected all tasks to be stopped")
+	}
+
+	if registry.GetTaskCount() != 0 {
+		t.Error("Expected task count to be 0 after StopAllTasks")
+	}
+}
+
+func TestTaskRegistry_CreateSingletonTask(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	runCount := int32(0)
+	task1, err1 := registry.CreateSingletonTask("singleton", 50*time.Millisecond, func() {
+		atomic.AddInt32(&runCount, 1)
+	}, logger)
+
+	if err1 != nil {
+		t.Errorf("Expected no error, got %v", err1)
+	}
+
+	if task1 == nil {
+		t.Fatal("Expected task to be created")
+	}
+
+	if !task1.IsRunning() {
+		t.Error("Expected task to be running")
+	}
+
+	// Try to create same task again
+	task2, err2 := registry.CreateSingletonTask("singleton", 50*time.Millisecond, func() {
+		atomic.AddInt32(&runCount, 1)
+	}, logger)
+
+	if err2 != nil {
+		t.Errorf("Expected no error on second call, got %v", err2)
+	}
+
+	if task2 != task1 {
+		t.Error("Expected to get the same task instance")
+	}
+
+	time.Sleep(120 * time.Millisecond)
+	task1.Stop()
+
+	if atomic.LoadInt32(&runCount) < 2 {
+		t.Error("Expected task to have run multiple times")
+	}
+}
+
+func TestTaskRegistry_GetAllTasks(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task1 := NewBackgroundTask("task1", 100*time.Millisecond, func() {}, logger)
+	task2 := NewBackgroundTask("task2", 100*time.Millisecond, func() {}, logger)
+
+	registry.RegisterTask("task1", task1)
+	registry.RegisterTask("task2", task2)
+
+	allTasks := registry.GetAllTasks()
+
+	if len(allTasks) != 2 {
+		t.Errorf("Expected 2 tasks, got %d", len(allTasks))
+	}
+
+	if _, ok := allTasks["task1"]; !ok {
+		t.Error("Expected task1 in results")
+	}
+
+	if _, ok := allTasks["task2"]; !ok {
+		t.Error("Expected task2 in results")
+	}
+}
+
+func TestTaskRegistry_GetStats(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	registry.RegisterTask("test-task", task)
+	task.Start()
+
+	time.Sleep(50 * time.Millisecond)
+
+	stats := registry.GetStats()
+
+	if stats["totalTasks"].(int) != 1 {
+		t.Errorf("Expected totalTasks 1, got %v", stats["totalTasks"])
+	}
+
+	if stats["runningTasks"].(int) != 1 {
+		t.Errorf("Expected runningTasks 1, got %v", stats["runningTasks"])
+	}
+
+	if _, ok := stats["memory"]; !ok {
+		t.Error("Expected memory stats")
+	}
+
+	task.Stop()
+}
+
+func TestGlobalTaskRegistry(t *testing.T) {
+	// Reset before test
+	ResetGlobalTaskRegistry()
+
+	registry1 := GetGlobalTaskRegistry()
+	registry2 := GetGlobalTaskRegistry()
+
+	if registry1 != registry2 {
+		t.Error("Expected singleton to return same instance")
+	}
+
+	// Cleanup
+	ResetGlobalTaskRegistry()
+}
+
+func TestResetGlobalTaskRegistry(t *testing.T) {
+	ResetGlobalTaskRegistry()
+
+	registry := GetGlobalTaskRegistry()
+	logger := &mockLogger{}
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	registry.RegisterTask("test-task", task)
+	task.Start()
+
+	time.Sleep(50 * time.Millisecond)
+
+	ResetGlobalTaskRegistry()
+
+	// Should get a new instance
+	newRegistry := GetGlobalTaskRegistry()
+	if newRegistry.GetTaskCount() != 0 {
+		t.Error("Expected new registry to be empty")
+	}
+}
+
+// TaskCircuitBreaker tests
+func TestNewTaskCircuitBreaker(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(5, 30*time.Second, logger)
+
+	if cb == nil {
+		t.Fatal("Expected NewTaskCircuitBreaker to return non-nil")
+	}
+
+	if cb.failureThreshold != 5 {
+		t.Errorf("Expected failureThreshold 5, got %d", cb.failureThreshold)
+	}
+
+	if cb.timeout != 30*time.Second {
+		t.Errorf("Expected timeout 30s, got %v", cb.timeout)
+	}
+
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Error("Expected initial state to be closed")
+	}
+}
+
+func TestTaskCircuitBreaker_CanCreateTask(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(3, 100*time.Millisecond, logger)
+
+	err := cb.CanCreateTask("test-task")
+	if err != nil {
+		t.Errorf("Expected no error initially, got %v", err)
+	}
+}
+
+func TestTaskCircuitBreaker_OnTaskFailure(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(3, 100*time.Millisecond, logger)
+
+	// Record failures
+	for i := 0; i < 3; i++ {
+		cb.OnTaskFailure("test-task", nil)
+	}
+
+	// Circuit should be open
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Error("Expected circuit breaker to be open after threshold failures")
+	}
+
+	// Should not be able to create task
+	err := cb.CanCreateTask("test-task")
+	if err == nil {
+		t.Error("Expected error when circuit breaker is open")
+	}
+}
+
+func TestTaskCircuitBreaker_OnTaskSuccess(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(5, 100*time.Millisecond, logger)
+
+	cb.OnTaskFailure("test-task", nil)
+	cb.OnTaskFailure("test-task", nil)
+
+	cb.OnTaskSuccess("test-task")
+
+	// Task-specific failures should be reset
+	err := cb.CanCreateTask("test-task")
+	if err != nil {
+		t.Errorf("Expected no error after success, got %v", err)
+	}
+}
+
+func TestTaskCircuitBreaker_Reset(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(2, 100*time.Millisecond, logger)
+
+	cb.OnTaskFailure("test-task", nil)
+	cb.OnTaskFailure("test-task", nil)
+
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Error("Expected circuit breaker to be open")
+	}
+
+	cb.Reset()
+
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Error("Expected circuit breaker to be closed after reset")
+	}
+
+	err := cb.CanCreateTask("test-task")
+	if err != nil {
+		t.Errorf("Expected no error after reset, got %v", err)
+	}
+}
+
+func TestTaskCircuitBreaker_TimeoutRecovery(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(2, 100*time.Millisecond, logger)
+
+	// Open circuit breaker
+	cb.OnTaskFailure("test-task", nil)
+	cb.OnTaskFailure("test-task", nil)
+
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Error("Expected circuit breaker to be open")
+	}
+
+	// Wait for timeout
+	time.Sleep(150 * time.Millisecond)
+
+	// Circuit breaker should reset, but task-specific failures remain
+	// Need to check with a different task name
+	err := cb.CanCreateTask("different-task")
+	if err != nil {
+		t.Errorf("Expected no error for different task after timeout, got %v", err)
+	}
+
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Error("Expected circuit breaker to be closed after timeout")
+	}
+
+	// Original task still has too many failures
+	err = cb.CanCreateTask("test-task")
+	if err == nil {
+		t.Error("Expected error for original task with too many failures")
+	}
+}
+
+// TaskMemoryMonitor tests
+func TestNewTaskMemoryMonitor(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	if monitor == nil {
+		t.Fatal("Expected NewTaskMemoryMonitor to return non-nil")
+	}
+
+	if monitor.registry != registry {
+		t.Error("Expected registry to be set")
+	}
+
+	if monitor.memoryThreshold != 1024*1024*1024 {
+		t.Errorf("Expected default threshold 1GB, got %d", monitor.memoryThreshold)
+	}
+}
+
+func TestTaskMemoryMonitor_SetMemoryThreshold(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	monitor.SetMemoryThreshold(512 * 1024 * 1024)
+
+	stats := monitor.GetStats()
+	if stats["memoryThreshold"].(uint64) != 512*1024*1024 {
+		t.Error("Expected threshold to be updated")
+	}
+}
+
+func TestTaskMemoryMonitor_StartStop(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	monitor.StartMonitoring()
+
+	stats := monitor.GetStats()
+	if !stats["isMonitoring"].(bool) {
+		t.Error("Expected monitor to be running")
+	}
+
+	// Double start should be ignored
+	monitor.StartMonitoring()
+
+	monitor.StopMonitoring()
+
+	stats = monitor.GetStats()
+	if stats["isMonitoring"].(bool) {
+		t.Error("Expected monitor to be stopped")
+	}
+
+	// Double stop should be safe
+	monitor.StopMonitoring()
+}
+
+func TestTaskMemoryMonitor_GetStats(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	stats := monitor.GetStats()
+
+	if _, ok := stats["isMonitoring"]; !ok {
+		t.Error("Expected isMonitoring in stats")
+	}
+
+	if _, ok := stats["currentMemory"]; !ok {
+		t.Error("Expected currentMemory in stats")
+	}
+
+	if _, ok := stats["memoryThreshold"]; !ok {
+		t.Error("Expected memoryThreshold in stats")
+	}
+}
+
+// WorkerPool tests
+func TestNewWorkerPool(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(4, 10, logger)
+
+	if pool == nil {
+		t.Fatal("Expected NewWorkerPool to return non-nil")
+	}
+
+	if pool.workers != 4 {
+		t.Errorf("Expected 4 workers, got %d", pool.workers)
+	}
+}
+
+func TestWorkerPool_DefaultWorkers(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(0, 0, logger)
+
+	// Should default to NumCPU
+	if pool.workers <= 0 {
+		t.Error("Expected positive number of workers")
+	}
+}
+
+func TestWorkerPool_StartStop(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(2, 5, logger)
+
+	pool.Start()
+
+	metrics := pool.GetMetrics()
+	if !metrics["isRunning"].(bool) {
+		t.Error("Expected worker pool to be running")
+	}
+
+	// Double start should be ignored
+	pool.Start()
+
+	pool.Stop()
+
+	metrics = pool.GetMetrics()
+	if metrics["isRunning"].(bool) {
+		t.Error("Expected worker pool to be stopped")
+	}
+
+	// Double stop should be safe
+	pool.Stop()
+}
+
+func TestWorkerPool_Submit(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(2, 5, logger)
+
+	pool.Start()
+	defer pool.Stop()
+
+	executed := int32(0)
+	var wg sync.WaitGroup
+
+	for i := 0; i < 3; i++ {
+		wg.Add(1)
+		err := pool.Submit(func() {
+			defer wg.Done()
+			atomic.AddInt32(&executed, 1)
+		})
+
+		if err != nil {
+			t.Errorf("Expected no error submitting task, got %v", err)
+		}
+	}
+
+	// Wait for tasks to complete
+	done := make(chan bool)
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(2 * time.Second):
+		t.Error("Timeout waiting for tasks to complete")
+	}
+
+	if atomic.LoadInt32(&executed) != 3 {
+		t.Errorf("Expected 3 tasks executed, got %d", atomic.LoadInt32(&executed))
+	}
+}
+
+func TestWorkerPool_SubmitWhenStopped(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(2, 5, logger)
+
+	err := pool.Submit(func() {})
+	if err == nil {
+		t.Error("Expected error when submitting to stopped pool")
+	}
+}
+
+func TestWorkerPool_TaskPanic(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(2, 5, logger)
+
+	pool.Start()
+	defer pool.Stop()
+
+	executed := int32(0)
+	var wg sync.WaitGroup
+
+	wg.Add(2)
+	// Submit task that panics
+	pool.Submit(func() {
+		defer wg.Done()
+		panic("test panic")
+	})
+
+	// Submit normal task
+	pool.Submit(func() {
+		defer wg.Done()
+		atomic.AddInt32(&executed, 1)
+	})
+
+	// Wait for tasks
+	done := make(chan bool)
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(2 * time.Second):
+		t.Error("Timeout waiting for tasks")
+	}
+
+	// Pool should still be functional
+	metrics := pool.GetMetrics()
+	if metrics["tasksFailed"].(int64) < 1 {
+		t.Error("Expected at least one failed task")
+	}
+}
+
+func TestWorkerPool_GetMetrics(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(2, 5, logger)
+
+	pool.Start()
+	defer pool.Stop()
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	pool.Submit(func() {
+		defer wg.Done()
+		time.Sleep(10 * time.Millisecond)
+	})
+
+	pool.Submit(func() {
+		defer wg.Done()
+		time.Sleep(10 * time.Millisecond)
+	})
+
+	wg.Wait()
+
+	metrics := pool.GetMetrics()
+
+	if metrics["workers"].(int) != 2 {
+		t.Errorf("Expected 2 workers, got %v", metrics["workers"])
+	}
+
+	if metrics["tasksProcessed"].(int64) != 2 {
+		t.Errorf("Expected 2 processed tasks, got %v", metrics["tasksProcessed"])
+	}
+
+	if metrics["tasksQueued"].(int64) != 2 {
+		t.Errorf("Expected 2 queued tasks, got %v", metrics["tasksQueued"])
+	}
+}
+
+func TestWorkerPool_Concurrent(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(4, 20, logger)
+
+	pool.Start()
+	defer pool.Stop()
+
+	executed := int32(0)
+	var wg sync.WaitGroup
+
+	taskCount := 10
+	for i := 0; i < taskCount; i++ {
+		wg.Add(1)
+		err := pool.Submit(func() {
+			defer wg.Done()
+			atomic.AddInt32(&executed, 1)
+			time.Sleep(10 * time.Millisecond)
+		})
+
+		if err != nil {
+			wg.Done()
+			t.Errorf("Failed to submit task: %v", err)
+		}
+	}
+
+	// Wait for all tasks
+	done := make(chan bool)
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(5 * time.Second):
+		t.Error("Timeout waiting for concurrent tasks")
+	}
+
+	if atomic.LoadInt32(&executed) != int32(taskCount) {
+		t.Errorf("Expected %d tasks executed, got %d", taskCount, atomic.LoadInt32(&executed))
+	}
+}

internal/cleanup/manager.go

@@ -0,0 +1,407 @@
+// Package cleanup provides background task management and cleanup functionality.
+package cleanup
+
+import (
+	"context"
+	"fmt"
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// Logger defines the logging interface
+type Logger interface {
+	Logf(format string, args ...interface{})
+	ErrorLogf(format string, args ...interface{})
+	DebugLogf(format string, args ...interface{})
+}
+
+// BackgroundTask represents a recurring background task
+type BackgroundTask struct {
+	name       string
+	interval   time.Duration
+	taskFunc   func()
+	ticker     *time.Ticker
+	stopChan   chan bool
+	isRunning  int32
+	logger     Logger
+	waitGroup  *sync.WaitGroup
+	lastRun    time.Time
+	runCount   int64
+	errorCount int64
+	mu         sync.RWMutex
+	ctx        context.Context
+	cancelFunc context.CancelFunc
+}
+
+// NewBackgroundTask creates a new background task
+func NewBackgroundTask(name string, interval time.Duration, taskFunc func(), logger Logger, wg ...*sync.WaitGroup) *BackgroundTask {
+	var waitGroup *sync.WaitGroup
+	if len(wg) > 0 && wg[0] != nil {
+		waitGroup = wg[0]
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	return &BackgroundTask{
+		name:       name,
+		interval:   interval,
+		taskFunc:   taskFunc,
+		stopChan:   make(chan bool, 1),
+		isRunning:  0,
+		logger:     logger,
+		waitGroup:  waitGroup,
+		ctx:        ctx,
+		cancelFunc: cancel,
+	}
+}
+
+// Start begins executing the background task
+func (bt *BackgroundTask) Start() {
+	if !atomic.CompareAndSwapInt32(&bt.isRunning, 0, 1) {
+		if bt.logger != nil {
+			bt.logger.Logf("Background task %s is already running", bt.name)
+		}
+		return
+	}
+
+	bt.ticker = time.NewTicker(bt.interval)
+
+	if bt.waitGroup != nil {
+		bt.waitGroup.Add(1)
+	}
+
+	go bt.run()
+
+	if bt.logger != nil {
+		bt.logger.Logf("Started background task: %s (interval: %v)", bt.name, bt.interval)
+	}
+}
+
+// Stop stops the background task
+func (bt *BackgroundTask) Stop() {
+	if !atomic.CompareAndSwapInt32(&bt.isRunning, 1, 0) {
+		if bt.logger != nil {
+			bt.logger.Logf("Background task %s is not running", bt.name)
+		}
+		return
+	}
+
+	// Cancel context
+	if bt.cancelFunc != nil {
+		bt.cancelFunc()
+	}
+
+	// Stop ticker
+	if bt.ticker != nil {
+		bt.ticker.Stop()
+	}
+
+	// Send stop signal
+	select {
+	case bt.stopChan <- true:
+	case <-time.After(5 * time.Second):
+		if bt.logger != nil {
+			bt.logger.ErrorLogf("Timeout stopping background task: %s", bt.name)
+		}
+	}
+
+	if bt.logger != nil {
+		bt.logger.Logf("Stopped background task: %s", bt.name)
+	}
+}
+
+// run is the main loop for the background task
+func (bt *BackgroundTask) run() {
+	defer func() {
+		if bt.waitGroup != nil {
+			bt.waitGroup.Done()
+		}
+		if r := recover(); r != nil {
+			atomic.AddInt64(&bt.errorCount, 1)
+			if bt.logger != nil {
+				bt.logger.ErrorLogf("Background task %s panicked: %v", bt.name, r)
+			}
+		}
+	}()
+
+	// Run task immediately on start
+	bt.executeTask()
+
+	for {
+		select {
+		case <-bt.ticker.C:
+			bt.executeTask()
+		case <-bt.stopChan:
+			return
+		case <-bt.ctx.Done():
+			return
+		}
+	}
+}
+
+// executeTask runs the task function with error handling
+func (bt *BackgroundTask) executeTask() {
+	defer func() {
+		if r := recover(); r != nil {
+			atomic.AddInt64(&bt.errorCount, 1)
+			if bt.logger != nil {
+				bt.logger.ErrorLogf("Task %s panicked: %v", bt.name, r)
+			}
+		}
+	}()
+
+	bt.mu.Lock()
+	bt.lastRun = time.Now()
+	bt.mu.Unlock()
+
+	atomic.AddInt64(&bt.runCount, 1)
+	bt.taskFunc()
+}
+
+// GetStats returns statistics about the task
+func (bt *BackgroundTask) GetStats() map[string]interface{} {
+	bt.mu.RLock()
+	lastRun := bt.lastRun
+	bt.mu.RUnlock()
+
+	return map[string]interface{}{
+		"name":       bt.name,
+		"interval":   bt.interval.String(),
+		"isRunning":  atomic.LoadInt32(&bt.isRunning) == 1,
+		"lastRun":    lastRun.Format(time.RFC3339),
+		"runCount":   atomic.LoadInt64(&bt.runCount),
+		"errorCount": atomic.LoadInt64(&bt.errorCount),
+	}
+}
+
+// IsRunning returns whether the task is currently running
+func (bt *BackgroundTask) IsRunning() bool {
+	return atomic.LoadInt32(&bt.isRunning) == 1
+}
+
+// TaskRegistry manages all background tasks
+type TaskRegistry struct {
+	tasks          map[string]*BackgroundTask
+	mu             sync.RWMutex
+	logger         Logger
+	maxTasks       int
+	circuitBreaker *TaskCircuitBreaker
+}
+
+// globalTaskRegistry is the singleton task registry
+var (
+	globalTaskRegistry *TaskRegistry
+	registryOnce       sync.Once
+	registryMutex      sync.Mutex
+)
+
+// GetGlobalTaskRegistry returns the global task registry singleton
+func GetGlobalTaskRegistry() *TaskRegistry {
+	registryOnce.Do(func() {
+		globalTaskRegistry = &TaskRegistry{
+			tasks:    make(map[string]*BackgroundTask),
+			maxTasks: 100, // Default maximum tasks
+		}
+	})
+	return globalTaskRegistry
+}
+
+// ResetGlobalTaskRegistry resets the global task registry (mainly for testing)
+func ResetGlobalTaskRegistry() {
+	registryMutex.Lock()
+	defer registryMutex.Unlock()
+
+	if globalTaskRegistry != nil {
+		globalTaskRegistry.StopAllTasks()
+		globalTaskRegistry = nil
+	}
+	registryOnce = sync.Once{}
+}
+
+// NewTaskRegistry creates a new task registry
+func NewTaskRegistry(logger Logger, maxTasks int) *TaskRegistry {
+	return &TaskRegistry{
+		tasks:          make(map[string]*BackgroundTask),
+		logger:         logger,
+		maxTasks:       maxTasks,
+		circuitBreaker: NewTaskCircuitBreaker(5, 30*time.Second, logger),
+	}
+}
+
+// RegisterTask registers a new background task
+func (tr *TaskRegistry) RegisterTask(name string, task *BackgroundTask) error {
+	if task == nil {
+		return fmt.Errorf("task cannot be nil")
+	}
+
+	tr.mu.Lock()
+	defer tr.mu.Unlock()
+
+	// Check if task already exists
+	if _, exists := tr.tasks[name]; exists {
+		return fmt.Errorf("task with name %s already exists", name)
+	}
+
+	// Check task limit
+	if len(tr.tasks) >= tr.maxTasks {
+		return fmt.Errorf("maximum number of tasks (%d) reached", tr.maxTasks)
+	}
+
+	// Check circuit breaker
+	if tr.circuitBreaker != nil {
+		if err := tr.circuitBreaker.CanCreateTask(name); err != nil {
+			return err
+		}
+	}
+
+	tr.tasks[name] = task
+
+	if tr.logger != nil {
+		tr.logger.Logf("Registered task: %s", name)
+	}
+
+	return nil
+}
+
+// UnregisterTask removes a task from the registry
+func (tr *TaskRegistry) UnregisterTask(name string) {
+	tr.mu.Lock()
+	defer tr.mu.Unlock()
+
+	if task, exists := tr.tasks[name]; exists {
+		if task.IsRunning() {
+			task.Stop()
+		}
+		delete(tr.tasks, name)
+
+		if tr.logger != nil {
+			tr.logger.Logf("Unregistered task: %s", name)
+		}
+	}
+}
+
+// GetTask returns a task by name
+func (tr *TaskRegistry) GetTask(name string) (*BackgroundTask, bool) {
+	tr.mu.RLock()
+	defer tr.mu.RUnlock()
+
+	task, exists := tr.tasks[name]
+	return task, exists
+}
+
+// StopAllTasks stops all registered tasks
+func (tr *TaskRegistry) StopAllTasks() {
+	tr.mu.RLock()
+	tasks := make([]*BackgroundTask, 0, len(tr.tasks))
+	for _, task := range tr.tasks {
+		tasks = append(tasks, task)
+	}
+	tr.mu.RUnlock()
+
+	var wg sync.WaitGroup
+	for _, task := range tasks {
+		if task.IsRunning() {
+			wg.Add(1)
+			go func(t *BackgroundTask) {
+				defer wg.Done()
+				t.Stop()
+			}(task)
+		}
+	}
+	wg.Wait()
+
+	// Clear all tasks from the registry after stopping them
+	tr.mu.Lock()
+	tr.tasks = make(map[string]*BackgroundTask)
+	tr.mu.Unlock()
+
+	if tr.logger != nil {
+		tr.logger.Logf("Stopped all tasks")
+	}
+}
+
+// GetTaskCount returns the number of registered tasks
+func (tr *TaskRegistry) GetTaskCount() int {
+	tr.mu.RLock()
+	defer tr.mu.RUnlock()
+	return len(tr.tasks)
+}
+
+// CreateSingletonTask creates or retrieves an existing task
+func (tr *TaskRegistry) CreateSingletonTask(name string, interval time.Duration,
+	taskFunc func(), logger Logger, wg ...*sync.WaitGroup) (*BackgroundTask, error) {
+
+	// Check if task already exists
+	if existingTask, exists := tr.GetTask(name); exists {
+		if existingTask.IsRunning() {
+			if logger != nil {
+				logger.Logf("Task %s already exists and is running", name)
+			}
+			return existingTask, nil
+		}
+		// Task exists but not running, start it
+		existingTask.Start()
+		return existingTask, nil
+	}
+
+	// Create new task
+	task := NewBackgroundTask(name, interval, taskFunc, logger, wg...)
+
+	// Register task
+	if err := tr.RegisterTask(name, task); err != nil {
+		return nil, err
+	}
+
+	// Start task
+	task.Start()
+
+	return task, nil
+}
+
+// GetAllTasks returns all registered tasks
+func (tr *TaskRegistry) GetAllTasks() map[string]*BackgroundTask {
+	tr.mu.RLock()
+	defer tr.mu.RUnlock()
+
+	tasks := make(map[string]*BackgroundTask)
+	for name, task := range tr.tasks {
+		tasks[name] = task
+	}
+	return tasks
+}
+
+// GetStats returns statistics for all tasks
+func (tr *TaskRegistry) GetStats() map[string]interface{} {
+	tr.mu.RLock()
+	defer tr.mu.RUnlock()
+
+	stats := make(map[string]interface{})
+	stats["totalTasks"] = len(tr.tasks)
+
+	runningCount := 0
+	taskStats := make(map[string]interface{})
+	for name, task := range tr.tasks {
+		if task.IsRunning() {
+			runningCount++
+		}
+		taskStats[name] = task.GetStats()
+	}
+
+	stats["runningTasks"] = runningCount
+	stats["tasks"] = taskStats
+
+	// Add memory stats
+	var m runtime.MemStats
+	runtime.ReadMemStats(&m)
+	stats["memory"] = map[string]interface{}{
+		"alloc":      m.Alloc,
+		"totalAlloc": m.TotalAlloc,
+		"sys":        m.Sys,
+		"numGC":      m.NumGC,
+		"goroutines": runtime.NumGoroutine(),
+	}
+
+	return stats
+}

internal/cleanup/workers.go

@@ -0,0 +1,449 @@
+// Package cleanup provides background task management and cleanup functionality.
+package cleanup
+
+import (
+	"fmt"
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// TaskCircuitBreaker prevents task creation failures from cascading
+type TaskCircuitBreaker struct {
+	failureThreshold int32
+	failureCount     int32
+	lastFailureTime  time.Time
+	timeout          time.Duration
+	state            int32 // 0: closed, 1: open
+	logger           Logger
+	mu               sync.RWMutex
+	taskFailures     map[string]int32
+}
+
+// CircuitBreakerState represents the state of the circuit breaker
+type CircuitBreakerState int32
+
+const (
+	CircuitBreakerClosed CircuitBreakerState = iota
+	CircuitBreakerOpen
+)
+
+// NewTaskCircuitBreaker creates a new circuit breaker for task management
+func NewTaskCircuitBreaker(failureThreshold int32, timeout time.Duration, logger Logger) *TaskCircuitBreaker {
+	return &TaskCircuitBreaker{
+		failureThreshold: failureThreshold,
+		timeout:          timeout,
+		logger:           logger,
+		taskFailures:     make(map[string]int32),
+	}
+}
+
+// CanCreateTask checks if a new task can be created
+func (cb *TaskCircuitBreaker) CanCreateTask(taskName string) error {
+	cb.mu.RLock()
+	defer cb.mu.RUnlock()
+
+	// Check circuit breaker state
+	if atomic.LoadInt32(&cb.state) == int32(CircuitBreakerOpen) {
+		// Check if timeout has elapsed
+		if time.Since(cb.lastFailureTime) < cb.timeout {
+			return fmt.Errorf("circuit breaker open: too many task failures")
+		}
+		// Reset circuit breaker
+		atomic.StoreInt32(&cb.state, int32(CircuitBreakerClosed))
+		atomic.StoreInt32(&cb.failureCount, 0)
+		if cb.logger != nil {
+			cb.logger.Logf("Circuit breaker reset after timeout")
+		}
+	}
+
+	// Check task-specific failures
+	if failures, exists := cb.taskFailures[taskName]; exists {
+		if failures >= cb.failureThreshold {
+			return fmt.Errorf("task %s has too many failures (%d)", taskName, failures)
+		}
+	}
+
+	return nil
+}
+
+// OnTaskStart records that a task has started
+func (cb *TaskCircuitBreaker) OnTaskStart(taskName string) {
+	// Currently just for tracking, could add rate limiting here
+	if cb.logger != nil {
+		cb.logger.DebugLogf("Task %s started", taskName)
+	}
+}
+
+// OnTaskComplete records that a task completed (success or failure)
+func (cb *TaskCircuitBreaker) OnTaskComplete(taskName string) {
+	// Currently just for tracking
+	if cb.logger != nil {
+		cb.logger.DebugLogf("Task %s completed", taskName)
+	}
+}
+
+// OnTaskSuccess records a successful task execution
+func (cb *TaskCircuitBreaker) OnTaskSuccess(taskName string) {
+	cb.mu.Lock()
+	defer cb.mu.Unlock()
+
+	// Reset task-specific failure count on success
+	delete(cb.taskFailures, taskName)
+}
+
+// OnTaskFailure records a task failure
+func (cb *TaskCircuitBreaker) OnTaskFailure(taskName string, err error) {
+	cb.mu.Lock()
+	defer cb.mu.Unlock()
+
+	// Increment task-specific failure count
+	cb.taskFailures[taskName]++
+
+	// Increment overall failure count
+	failures := atomic.AddInt32(&cb.failureCount, 1)
+	cb.lastFailureTime = time.Now()
+
+	if cb.logger != nil {
+		cb.logger.ErrorLogf("Task %s failed: %v (failure count: %d)", taskName, err, cb.taskFailures[taskName])
+	}
+
+	// Open circuit breaker if threshold reached
+	if failures >= cb.failureThreshold {
+		atomic.StoreInt32(&cb.state, int32(CircuitBreakerOpen))
+		if cb.logger != nil {
+			cb.logger.ErrorLogf("Circuit breaker opened due to %d failures", failures)
+		}
+	}
+}
+
+// Reset resets the circuit breaker
+func (cb *TaskCircuitBreaker) Reset() {
+	cb.mu.Lock()
+	defer cb.mu.Unlock()
+
+	atomic.StoreInt32(&cb.state, int32(CircuitBreakerClosed))
+	atomic.StoreInt32(&cb.failureCount, 0)
+	cb.taskFailures = make(map[string]int32)
+	cb.lastFailureTime = time.Time{}
+
+	if cb.logger != nil {
+		cb.logger.Logf("Circuit breaker reset")
+	}
+}
+
+// GetState returns the current state of the circuit breaker
+func (cb *TaskCircuitBreaker) GetState() CircuitBreakerState {
+	return CircuitBreakerState(atomic.LoadInt32(&cb.state))
+}
+
+// TaskMemoryMonitor monitors memory usage and can trigger cleanup
+type TaskMemoryMonitor struct {
+	logger          Logger
+	registry        *TaskRegistry
+	memoryThreshold uint64
+	checkInterval   time.Duration
+	isMonitoring    int32
+	stopChan        chan bool
+	lastCheck       time.Time
+	mu              sync.RWMutex
+}
+
+var (
+	globalMemoryMonitor *TaskMemoryMonitor
+	monitorOnce         sync.Once
+)
+
+// GetGlobalTaskMemoryMonitor returns the global memory monitor singleton
+func GetGlobalTaskMemoryMonitor(logger Logger) *TaskMemoryMonitor {
+	monitorOnce.Do(func() {
+		globalMemoryMonitor = NewTaskMemoryMonitor(logger, GetGlobalTaskRegistry())
+	})
+	return globalMemoryMonitor
+}
+
+// NewTaskMemoryMonitor creates a new memory monitor
+func NewTaskMemoryMonitor(logger Logger, registry *TaskRegistry) *TaskMemoryMonitor {
+	return &TaskMemoryMonitor{
+		logger:          logger,
+		registry:        registry,
+		memoryThreshold: 1024 * 1024 * 1024, // 1GB default
+		checkInterval:   1 * time.Minute,
+		stopChan:        make(chan bool, 1),
+	}
+}
+
+// SetMemoryThreshold sets the memory threshold for triggering cleanup
+func (tmm *TaskMemoryMonitor) SetMemoryThreshold(bytes uint64) {
+	tmm.mu.Lock()
+	defer tmm.mu.Unlock()
+	tmm.memoryThreshold = bytes
+}
+
+// StartMonitoring starts the memory monitoring routine
+func (tmm *TaskMemoryMonitor) StartMonitoring() {
+	if !atomic.CompareAndSwapInt32(&tmm.isMonitoring, 0, 1) {
+		if tmm.logger != nil {
+			tmm.logger.Logf("Memory monitor is already running")
+		}
+		return
+	}
+
+	go tmm.monitorLoop()
+
+	if tmm.logger != nil {
+		tmm.logger.Logf("Started memory monitoring (threshold: %d bytes, interval: %v)",
+			tmm.memoryThreshold, tmm.checkInterval)
+	}
+}
+
+// StopMonitoring stops the memory monitoring routine
+func (tmm *TaskMemoryMonitor) StopMonitoring() {
+	if !atomic.CompareAndSwapInt32(&tmm.isMonitoring, 1, 0) {
+		if tmm.logger != nil {
+			tmm.logger.Logf("Memory monitor is not running")
+		}
+		return
+	}
+
+	select {
+	case tmm.stopChan <- true:
+	case <-time.After(5 * time.Second):
+		if tmm.logger != nil {
+			tmm.logger.ErrorLogf("Timeout stopping memory monitor")
+		}
+	}
+
+	if tmm.logger != nil {
+		tmm.logger.Logf("Stopped memory monitoring")
+	}
+}
+
+// monitorLoop is the main monitoring loop
+func (tmm *TaskMemoryMonitor) monitorLoop() {
+	ticker := time.NewTicker(tmm.checkInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			tmm.checkMemory()
+		case <-tmm.stopChan:
+			return
+		}
+	}
+}
+
+// checkMemory checks current memory usage and triggers cleanup if needed
+func (tmm *TaskMemoryMonitor) checkMemory() {
+	tmm.mu.Lock()
+	tmm.lastCheck = time.Now()
+	tmm.mu.Unlock()
+
+	var m runtime.MemStats
+	runtime.ReadMemStats(&m)
+
+	if tmm.logger != nil {
+		tmm.logger.DebugLogf("Memory check - Alloc: %d MB, Sys: %d MB, NumGC: %d",
+			m.Alloc/1024/1024, m.Sys/1024/1024, m.NumGC)
+	}
+
+	// Check if memory usage exceeds threshold
+	if m.Alloc > tmm.memoryThreshold {
+		if tmm.logger != nil {
+			tmm.logger.Logf("Memory usage (%d MB) exceeds threshold (%d MB), triggering cleanup",
+				m.Alloc/1024/1024, tmm.memoryThreshold/1024/1024)
+		}
+
+		// Trigger garbage collection
+		runtime.GC()
+
+		// Could also trigger task-specific cleanup here
+		tmm.triggerTaskCleanup()
+	}
+}
+
+// triggerTaskCleanup triggers cleanup operations on tasks
+func (tmm *TaskMemoryMonitor) triggerTaskCleanup() {
+	if tmm.registry == nil {
+		return
+	}
+
+	// Get all tasks and potentially pause non-critical ones
+	tasks := tmm.registry.GetAllTasks()
+	for name, task := range tasks {
+		// Could implement task priority here
+		if tmm.logger != nil {
+			tmm.logger.DebugLogf("Checking task %s for cleanup opportunities", name)
+		}
+		// Tasks could implement a Cleanup() method
+		_ = task // Placeholder for future cleanup logic
+	}
+}
+
+// GetStats returns memory monitor statistics
+func (tmm *TaskMemoryMonitor) GetStats() map[string]interface{} {
+	tmm.mu.RLock()
+	lastCheck := tmm.lastCheck
+	tmm.mu.RUnlock()
+
+	var m runtime.MemStats
+	runtime.ReadMemStats(&m)
+
+	return map[string]interface{}{
+		"isMonitoring":    atomic.LoadInt32(&tmm.isMonitoring) == 1,
+		"lastCheck":       lastCheck.Format(time.RFC3339),
+		"checkInterval":   tmm.checkInterval.String(),
+		"memoryThreshold": tmm.memoryThreshold,
+		"currentMemory": map[string]interface{}{
+			"alloc":      m.Alloc,
+			"totalAlloc": m.TotalAlloc,
+			"sys":        m.Sys,
+			"mallocs":    m.Mallocs,
+			"frees":      m.Frees,
+			"numGC":      m.NumGC,
+			"goroutines": runtime.NumGoroutine(),
+		},
+	}
+}
+
+// WorkerPool manages a pool of worker goroutines for task execution
+type WorkerPool struct {
+	workers   int
+	taskQueue chan func()
+	workerWg  sync.WaitGroup
+	isRunning int32
+	logger    Logger
+	stopChan  chan bool
+	metrics   WorkerPoolMetrics
+}
+
+// WorkerPoolMetrics tracks worker pool performance
+type WorkerPoolMetrics struct {
+	tasksProcessed int64
+	tasksQueued    int64
+	tasksFailed    int64
+	avgProcessTime int64 // nanoseconds
+}
+
+// NewWorkerPool creates a new worker pool
+func NewWorkerPool(workers int, queueSize int, logger Logger) *WorkerPool {
+	if workers <= 0 {
+		workers = runtime.NumCPU()
+	}
+	if queueSize <= 0 {
+		queueSize = workers * 10
+	}
+
+	return &WorkerPool{
+		workers:   workers,
+		taskQueue: make(chan func(), queueSize),
+		stopChan:  make(chan bool),
+		logger:    logger,
+	}
+}
+
+// Start starts the worker pool
+func (wp *WorkerPool) Start() {
+	if !atomic.CompareAndSwapInt32(&wp.isRunning, 0, 1) {
+		if wp.logger != nil {
+			wp.logger.Logf("Worker pool is already running")
+		}
+		return
+	}
+
+	for i := 0; i < wp.workers; i++ {
+		wp.workerWg.Add(1)
+		go wp.worker(i)
+	}
+
+	if wp.logger != nil {
+		wp.logger.Logf("Started worker pool with %d workers", wp.workers)
+	}
+}
+
+// Stop stops the worker pool
+func (wp *WorkerPool) Stop() {
+	if !atomic.CompareAndSwapInt32(&wp.isRunning, 1, 0) {
+		if wp.logger != nil {
+			wp.logger.Logf("Worker pool is not running")
+		}
+		return
+	}
+
+	close(wp.stopChan)
+	close(wp.taskQueue)
+	wp.workerWg.Wait()
+
+	if wp.logger != nil {
+		wp.logger.Logf("Stopped worker pool")
+	}
+}
+
+// Submit submits a task to the worker pool
+func (wp *WorkerPool) Submit(task func()) error {
+	if atomic.LoadInt32(&wp.isRunning) != 1 {
+		return fmt.Errorf("worker pool is not running")
+	}
+
+	select {
+	case wp.taskQueue <- task:
+		atomic.AddInt64(&wp.metrics.tasksQueued, 1)
+		return nil
+	default:
+		return fmt.Errorf("worker pool queue is full")
+	}
+}
+
+// worker is the main worker routine
+func (wp *WorkerPool) worker(id int) {
+	defer wp.workerWg.Done()
+
+	for {
+		select {
+		case task, ok := <-wp.taskQueue:
+			if !ok {
+				return // Channel closed
+			}
+			wp.executeTask(task)
+		case <-wp.stopChan:
+			return
+		}
+	}
+}
+
+// executeTask executes a task with error handling
+func (wp *WorkerPool) executeTask(task func()) {
+	startTime := time.Now()
+	defer func() {
+		if r := recover(); r != nil {
+			atomic.AddInt64(&wp.metrics.tasksFailed, 1)
+			if wp.logger != nil {
+				wp.logger.ErrorLogf("Worker pool task panicked: %v", r)
+			}
+		}
+		// Update average process time
+		duration := time.Since(startTime).Nanoseconds()
+		processed := atomic.AddInt64(&wp.metrics.tasksProcessed, 1)
+		currentAvg := atomic.LoadInt64(&wp.metrics.avgProcessTime)
+		newAvg := (currentAvg*(processed-1) + duration) / processed
+		atomic.StoreInt64(&wp.metrics.avgProcessTime, newAvg)
+	}()
+
+	task()
+}
+
+// GetMetrics returns worker pool metrics
+func (wp *WorkerPool) GetMetrics() map[string]interface{} {
+	return map[string]interface{}{
+		"workers":        wp.workers,
+		"isRunning":      atomic.LoadInt32(&wp.isRunning) == 1,
+		"queueSize":      len(wp.taskQueue),
+		"queueCapacity":  cap(wp.taskQueue),
+		"tasksProcessed": atomic.LoadInt64(&wp.metrics.tasksProcessed),
+		"tasksQueued":    atomic.LoadInt64(&wp.metrics.tasksQueued),
+		"tasksFailed":    atomic.LoadInt64(&wp.metrics.tasksFailed),
+		"avgProcessTime": time.Duration(atomic.LoadInt64(&wp.metrics.avgProcessTime)),
+	}
+}

internal/compat/compatibility.go

@@ -0,0 +1,320 @@
+// Package compat provides backward compatibility layer during refactoring
+package compat
+
+import (
+	"fmt"
+	"reflect"
+	"sync"
+)
+
+// CompatibilityLayer provides backward compatibility during the migration
+type CompatibilityLayer struct {
+	mappings     map[string]string // old path -> new path
+	converters   map[string]Converter
+	deprecations map[string]string // deprecated field -> warning message
+	mu           sync.RWMutex
+}
+
+// Converter is a function that converts old value format to new format
+type Converter func(oldValue interface{}) (newValue interface{}, err error)
+
+// Global compatibility layer instance
+var (
+	layer     *CompatibilityLayer
+	layerOnce sync.Once
+)
+
+// GetLayer returns the global compatibility layer instance
+func GetLayer() *CompatibilityLayer {
+	layerOnce.Do(func() {
+		layer = &CompatibilityLayer{
+			mappings:     make(map[string]string),
+			converters:   make(map[string]Converter),
+			deprecations: make(map[string]string),
+		}
+		layer.initialize()
+	})
+	return layer
+}
+
+// initialize sets up default compatibility mappings
+func (c *CompatibilityLayer) initialize() {
+	// Configuration path mappings (old -> new)
+	c.RegisterMapping("ProviderURL", "Provider.IssuerURL")
+	c.RegisterMapping("ClientID", "Provider.ClientID")
+	c.RegisterMapping("ClientSecret", "Provider.ClientSecret")
+	c.RegisterMapping("CallbackURL", "Provider.RedirectURL")
+	c.RegisterMapping("LogoutURL", "Provider.LogoutURL")
+	c.RegisterMapping("SessionEncryptionKey", "Session.EncryptionKey")
+	c.RegisterMapping("Scopes", "Provider.Scopes")
+	c.RegisterMapping("RateLimit", "Middleware.RateLimit")
+	c.RegisterMapping("RefreshGracePeriodSeconds", "Token.RefreshGracePeriod")
+
+	// Redis configuration mappings
+	c.RegisterMapping("RedisAddr", "Redis.Addresses[0]")
+	c.RegisterMapping("RedisPassword", "Redis.Password")
+	c.RegisterMapping("RedisDB", "Redis.DB")
+
+	// Session configuration mappings
+	c.RegisterMapping("SessionName", "Session.Name")
+	c.RegisterMapping("SessionMaxAge", "Session.MaxAge")
+	c.RegisterMapping("SessionSecret", "Session.Secret")
+	c.RegisterMapping("SessionChunkSize", "Session.ChunkSize")
+
+	// Security configuration mappings
+	c.RegisterMapping("ForceHTTPS", "Security.ForceHTTPS")
+	c.RegisterMapping("EnablePKCE", "Security.EnablePKCE")
+	c.RegisterMapping("AllowedUsers", "Security.AllowedUsers")
+	c.RegisterMapping("AllowedUserDomains", "Security.AllowedUserDomains")
+	c.RegisterMapping("AllowedRolesAndGroups", "Security.AllowedRolesAndGroups")
+	c.RegisterMapping("ExcludedURLs", "Security.ExcludedURLs")
+
+	// Register converters for complex transformations
+	c.RegisterConverter("RefreshGracePeriodSeconds", func(oldValue interface{}) (interface{}, error) {
+		// Convert seconds (int) to duration string
+		if seconds, ok := oldValue.(int); ok {
+			return fmt.Sprintf("%ds", seconds), nil
+		}
+		return oldValue, nil
+	})
+
+	// Register deprecations
+	c.RegisterDeprecation("LogLevel", "LogLevel is deprecated, use Logging.Level instead")
+	c.RegisterDeprecation("HTTPClient", "HTTPClient is deprecated, configure via Transport settings")
+}
+
+// RegisterMapping registers a field mapping from old to new path
+func (c *CompatibilityLayer) RegisterMapping(oldPath, newPath string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.mappings[oldPath] = newPath
+}
+
+// RegisterConverter registers a value converter for a field
+func (c *CompatibilityLayer) RegisterConverter(field string, converter Converter) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.converters[field] = converter
+}
+
+// RegisterDeprecation registers a deprecation warning for a field
+func (c *CompatibilityLayer) RegisterDeprecation(field, message string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.deprecations[field] = message
+}
+
+// GetMapping returns the new path for an old configuration path
+func (c *CompatibilityLayer) GetMapping(oldPath string) (string, bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	newPath, exists := c.mappings[oldPath]
+	return newPath, exists
+}
+
+// Convert applies conversion logic to a value
+func (c *CompatibilityLayer) Convert(field string, value interface{}) (interface{}, error) {
+	c.mu.RLock()
+	converter, exists := c.converters[field]
+	c.mu.RUnlock()
+
+	if !exists {
+		return value, nil
+	}
+
+	return converter(value)
+}
+
+// CheckDeprecation checks if a field is deprecated and returns warning message
+func (c *CompatibilityLayer) CheckDeprecation(field string) (string, bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	message, deprecated := c.deprecations[field]
+	return message, deprecated
+}
+
+// MigrateMap migrates an old configuration map to new structure
+func (c *CompatibilityLayer) MigrateMap(oldConfig map[string]interface{}) (map[string]interface{}, []string) {
+	newConfig := make(map[string]interface{})
+	warnings := []string{}
+
+	for key, value := range oldConfig {
+		// Check for deprecation
+		if warning, deprecated := c.CheckDeprecation(key); deprecated {
+			warnings = append(warnings, warning)
+		}
+
+		// Get new path
+		newPath, hasMappming := c.GetMapping(key)
+		if !hasMappming {
+			// No mapping, use as-is
+			newConfig[key] = value
+			continue
+		}
+
+		// Apply converter if exists
+		convertedValue, err := c.Convert(key, value)
+		if err != nil {
+			warnings = append(warnings, fmt.Sprintf("Failed to convert %s: %v", key, err))
+			convertedValue = value
+		}
+
+		// Set value at new path
+		setNestedValue(newConfig, newPath, convertedValue)
+	}
+
+	return newConfig, warnings
+}
+
+// setNestedValue sets a value in a nested map structure using dot notation
+func setNestedValue(m map[string]interface{}, path string, value interface{}) {
+	keys := splitPath(path)
+	if len(keys) == 0 {
+		return
+	}
+
+	current := m
+	for i := 0; i < len(keys)-1; i++ {
+		key := keys[i]
+
+		// Check if this key has array notation
+		if isArrayPath(key) {
+			// Handle array notation (e.g., "Addresses[0]")
+			continue // Skip array handling for now, will be handled in actual migration
+		}
+
+		if _, exists := current[key]; !exists {
+			current[key] = make(map[string]interface{})
+		}
+
+		// Ensure it's a map
+		if next, ok := current[key].(map[string]interface{}); ok {
+			current = next
+		} else {
+			// Can't traverse further, create new map
+			newMap := make(map[string]interface{})
+			current[key] = newMap
+			current = newMap
+		}
+	}
+
+	// Set the final value
+	finalKey := keys[len(keys)-1]
+	current[finalKey] = value
+}
+
+// splitPath splits a configuration path into segments
+func splitPath(path string) []string {
+	segments := []string{}
+	current := ""
+
+	for i := 0; i < len(path); i++ {
+		if path[i] == '.' {
+			if current != "" {
+				segments = append(segments, current)
+				current = ""
+			}
+		} else {
+			current += string(path[i])
+		}
+	}
+
+	if current != "" {
+		segments = append(segments, current)
+	}
+
+	return segments
+}
+
+// isArrayPath checks if a path segment contains array notation
+func isArrayPath(segment string) bool {
+	for _, char := range segment {
+		if char == '[' {
+			return true
+		}
+	}
+	return false
+}
+
+// ConfigAdapter provides an adapter interface for old code to work with new config
+type ConfigAdapter struct {
+	newConfig interface{}
+	oldPaths  map[string]func() interface{}
+	mu        sync.RWMutex
+}
+
+// NewConfigAdapter creates a new configuration adapter
+func NewConfigAdapter(newConfig interface{}) *ConfigAdapter {
+	adapter := &ConfigAdapter{
+		newConfig: newConfig,
+		oldPaths:  make(map[string]func() interface{}),
+	}
+	return adapter
+}
+
+// RegisterGetter registers a getter function for an old path
+func (a *ConfigAdapter) RegisterGetter(oldPath string, getter func() interface{}) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.oldPaths[oldPath] = getter
+}
+
+// Get retrieves a value using old path notation
+func (a *ConfigAdapter) Get(oldPath string) (interface{}, bool) {
+	a.mu.RLock()
+	getter, exists := a.oldPaths[oldPath]
+	a.mu.RUnlock()
+
+	if !exists {
+		// Try to get from new config using reflection
+		return a.getFromNewConfig(oldPath)
+	}
+
+	return getter(), true
+}
+
+// getFromNewConfig attempts to retrieve value from new config using reflection
+func (a *ConfigAdapter) getFromNewConfig(path string) (interface{}, bool) {
+	// Check if there's a mapping for this path
+	compat := GetLayer()
+	if newPath, hasMappming := compat.GetMapping(path); hasMappming {
+		return a.getNestedField(newPath)
+	}
+
+	// Try direct access
+	return a.getNestedField(path)
+}
+
+// getNestedField retrieves a nested field value using reflection
+func (a *ConfigAdapter) getNestedField(path string) (interface{}, bool) {
+	segments := splitPath(path)
+	if len(segments) == 0 {
+		return nil, false
+	}
+
+	v := reflect.ValueOf(a.newConfig)
+
+	// Dereference pointer if needed
+	if v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+
+	for _, segment := range segments {
+		if v.Kind() != reflect.Struct {
+			return nil, false
+		}
+
+		field := v.FieldByName(segment)
+		if !field.IsValid() {
+			return nil, false
+		}
+
+		v = field
+	}
+
+	if v.IsValid() && v.CanInterface() {
+		return v.Interface(), true
+	}
+
+	return nil, false
+}

internal/compat/compatibility_test.go

@@ -0,0 +1,495 @@
+//go:build !yaegi
+
+package compat
+
+import (
+	"sync"
+	"testing"
+)
+
+func TestGetLayer_Singleton(t *testing.T) {
+	// Reset global state
+	layerOnce = sync.Once{}
+	layer = nil
+
+	layer1 := GetLayer()
+	layer2 := GetLayer()
+
+	if layer1 != layer2 {
+		t.Error("Expected GetLayer to return same instance")
+	}
+}
+
+func TestGetLayer_Initialize(t *testing.T) {
+	// Reset global state
+	layerOnce = sync.Once{}
+	layer = nil
+
+	l := GetLayer()
+
+	// Check default mappings exist
+	if _, exists := l.GetMapping("ProviderURL"); !exists {
+		t.Error("Expected ProviderURL mapping to exist")
+	}
+
+	if _, exists := l.GetMapping("ClientID"); !exists {
+		t.Error("Expected ClientID mapping to exist")
+	}
+
+	// Check deprecations exist
+	if _, deprecated := l.CheckDeprecation("LogLevel"); !deprecated {
+		t.Error("Expected LogLevel to be marked deprecated")
+	}
+}
+
+func TestRegisterMapping(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterMapping("OldField", "New.Field")
+
+	newPath, exists := l.GetMapping("OldField")
+	if !exists {
+		t.Error("Expected mapping to exist")
+	}
+
+	if newPath != "New.Field" {
+		t.Errorf("Expected 'New.Field', got '%s'", newPath)
+	}
+}
+
+func TestRegisterConverter(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	converter := func(oldValue interface{}) (interface{}, error) {
+		if str, ok := oldValue.(string); ok {
+			return str + "_converted", nil
+		}
+		return oldValue, nil
+	}
+
+	l.RegisterConverter("TestField", converter)
+
+	result, err := l.Convert("TestField", "test")
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+
+	if result != "test_converted" {
+		t.Errorf("Expected 'test_converted', got '%v'", result)
+	}
+}
+
+func TestConvert_NoConverter(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	// No converter registered
+	result, err := l.Convert("UnknownField", "value")
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	if result != "value" {
+		t.Error("Expected original value when no converter exists")
+	}
+}
+
+func TestRegisterDeprecation(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterDeprecation("OldField", "This field is deprecated")
+
+	message, deprecated := l.CheckDeprecation("OldField")
+	if !deprecated {
+		t.Error("Expected field to be deprecated")
+	}
+
+	if message != "This field is deprecated" {
+		t.Errorf("Expected deprecation message, got '%s'", message)
+	}
+}
+
+func TestCheckDeprecation_NotDeprecated(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	_, deprecated := l.CheckDeprecation("NewField")
+	if deprecated {
+		t.Error("Expected field not to be deprecated")
+	}
+}
+
+func TestMigrateMap_BasicMapping(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterMapping("OldField", "New.Field")
+
+	oldConfig := map[string]interface{}{
+		"OldField": "value123",
+	}
+
+	newConfig, warnings := l.MigrateMap(oldConfig)
+
+	if len(warnings) != 0 {
+		t.Errorf("Expected no warnings, got %d", len(warnings))
+	}
+
+	// Check nested structure
+	if newMap, ok := newConfig["New"].(map[string]interface{}); ok {
+		if val, exists := newMap["Field"]; !exists || val != "value123" {
+			t.Errorf("Expected nested field value 'value123', got %v", val)
+		}
+	} else {
+		t.Error("Expected nested map structure")
+	}
+}
+
+func TestMigrateMap_WithDeprecation(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterMapping("DeprecatedField", "New.Field")
+	l.RegisterDeprecation("DeprecatedField", "Field is deprecated")
+
+	oldConfig := map[string]interface{}{
+		"DeprecatedField": "value",
+	}
+
+	_, warnings := l.MigrateMap(oldConfig)
+
+	if len(warnings) != 1 {
+		t.Errorf("Expected 1 warning, got %d", len(warnings))
+	}
+
+	if warnings[0] != "Field is deprecated" {
+		t.Errorf("Expected deprecation warning, got '%s'", warnings[0])
+	}
+}
+
+func TestMigrateMap_WithConverter(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterMapping("Seconds", "Duration")
+	l.RegisterConverter("Seconds", func(oldValue interface{}) (interface{}, error) {
+		if seconds, ok := oldValue.(int); ok {
+			return seconds * 1000, nil // Convert to milliseconds
+		}
+		return oldValue, nil
+	})
+
+	oldConfig := map[string]interface{}{
+		"Seconds": 60,
+	}
+
+	newConfig, _ := l.MigrateMap(oldConfig)
+
+	if val, ok := newConfig["Duration"]; !ok || val != 60000 {
+		t.Errorf("Expected Duration to be 60000, got %v", val)
+	}
+}
+
+func TestMigrateMap_NoMapping(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	oldConfig := map[string]interface{}{
+		"UnmappedField": "value",
+	}
+
+	newConfig, _ := l.MigrateMap(oldConfig)
+
+	if val, ok := newConfig["UnmappedField"]; !ok || val != "value" {
+		t.Error("Expected unmapped field to be copied as-is")
+	}
+}
+
+func TestSplitPath(t *testing.T) {
+	tests := []struct {
+		path     string
+		expected []string
+	}{
+		{"Simple", []string{"Simple"}},
+		{"Nested.Path", []string{"Nested", "Path"}},
+		{"Deep.Nested.Path", []string{"Deep", "Nested", "Path"}},
+		{"", []string{}},
+		{"Single", []string{"Single"}},
+	}
+
+	for _, tt := range tests {
+		result := splitPath(tt.path)
+		if len(result) != len(tt.expected) {
+			t.Errorf("Path '%s': expected %d segments, got %d", tt.path, len(tt.expected), len(result))
+			continue
+		}
+
+		for i, segment := range result {
+			if segment != tt.expected[i] {
+				t.Errorf("Path '%s': segment %d expected '%s', got '%s'", tt.path, i, tt.expected[i], segment)
+			}
+		}
+	}
+}
+
+func TestIsArrayPath(t *testing.T) {
+	tests := []struct {
+		segment  string
+		expected bool
+	}{
+		{"Addresses[0]", true},
+		{"Items[5]", true},
+		{"Simple", false},
+		{"NoArray", false},
+		{"[start", true},
+	}
+
+	for _, tt := range tests {
+		result := isArrayPath(tt.segment)
+		if result != tt.expected {
+			t.Errorf("Segment '%s': expected %v, got %v", tt.segment, tt.expected, result)
+		}
+	}
+}
+
+func TestSetNestedValue_SingleLevel(t *testing.T) {
+	m := make(map[string]interface{})
+	setNestedValue(m, "Field", "value")
+
+	if val, ok := m["Field"]; !ok || val != "value" {
+		t.Error("Expected single level field to be set")
+	}
+}
+
+func TestSetNestedValue_MultiLevel(t *testing.T) {
+	m := make(map[string]interface{})
+	setNestedValue(m, "Parent.Child", "value")
+
+	parent, ok := m["Parent"].(map[string]interface{})
+	if !ok {
+		t.Fatal("Expected Parent to be a map")
+	}
+
+	if val, ok := parent["Child"]; !ok || val != "value" {
+		t.Error("Expected nested field to be set")
+	}
+}
+
+func TestSetNestedValue_DeepNesting(t *testing.T) {
+	m := make(map[string]interface{})
+	setNestedValue(m, "Level1.Level2.Level3", "deep_value")
+
+	level1, ok := m["Level1"].(map[string]interface{})
+	if !ok {
+		t.Fatal("Expected Level1 to be a map")
+	}
+
+	level2, ok := level1["Level2"].(map[string]interface{})
+	if !ok {
+		t.Fatal("Expected Level2 to be a map")
+	}
+
+	if val, ok := level2["Level3"]; !ok || val != "deep_value" {
+		t.Error("Expected deeply nested field to be set")
+	}
+}
+
+// ConfigAdapter tests
+
+func TestNewConfigAdapter(t *testing.T) {
+	config := map[string]interface{}{"key": "value"}
+	adapter := NewConfigAdapter(config)
+
+	if adapter == nil {
+		t.Fatal("Expected adapter to be created")
+	}
+
+	if adapter.newConfig == nil {
+		t.Error("Expected config to be stored")
+	}
+}
+
+func TestConfigAdapter_RegisterGetter(t *testing.T) {
+	adapter := NewConfigAdapter(nil)
+
+	called := false
+	adapter.RegisterGetter("TestPath", func() interface{} {
+		called = true
+		return "test_value"
+	})
+
+	val, exists := adapter.Get("TestPath")
+	if !exists {
+		t.Error("Expected getter to exist")
+	}
+
+	if val != "test_value" {
+		t.Errorf("Expected 'test_value', got %v", val)
+	}
+
+	if !called {
+		t.Error("Expected getter function to be called")
+	}
+}
+
+type TestConfig struct {
+	Provider struct {
+		IssuerURL string
+		ClientID  string
+	}
+	Session struct {
+		EncryptionKey string
+	}
+}
+
+func TestConfigAdapter_GetNestedField(t *testing.T) {
+	config := &TestConfig{}
+	config.Provider.IssuerURL = "https://test.com"
+	config.Provider.ClientID = "test-client"
+	config.Session.EncryptionKey = "secret123"
+
+	adapter := NewConfigAdapter(config)
+
+	// Test nested field access
+	val, exists := adapter.getNestedField("Provider.IssuerURL")
+	if !exists {
+		t.Error("Expected field to exist")
+	}
+
+	if val != "https://test.com" {
+		t.Errorf("Expected 'https://test.com', got %v", val)
+	}
+
+	// Test another nested field
+	val2, exists2 := adapter.getNestedField("Provider.ClientID")
+	if !exists2 || val2 != "test-client" {
+		t.Error("Expected ClientID to be accessible")
+	}
+
+	// Test non-existent field
+	_, exists3 := adapter.getNestedField("NonExistent.Field")
+	if exists3 {
+		t.Error("Expected non-existent field to return false")
+	}
+}
+
+// Race condition tests
+
+func TestCompatibilityLayer_ConcurrentAccess(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	var wg sync.WaitGroup
+
+	// Concurrent registrations
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			l.RegisterMapping(string(rune('A'+idx%26)), "New.Field")
+		}(i)
+	}
+
+	// Concurrent reads
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			_, _ = l.GetMapping(string(rune('A' + idx%26)))
+		}(i)
+	}
+
+	wg.Wait()
+}
+
+func TestCompatibilityLayer_ConcurrentMigrate(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterMapping("OldField", "New.Field")
+
+	var wg sync.WaitGroup
+
+	// Concurrent migrations
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			oldConfig := map[string]interface{}{
+				"OldField": "value",
+			}
+			_, _ = l.MigrateMap(oldConfig)
+		}()
+	}
+
+	wg.Wait()
+}
+
+func TestConfigAdapter_ConcurrentAccess(t *testing.T) {
+	config := &TestConfig{}
+	config.Provider.IssuerURL = "https://test.com"
+
+	adapter := NewConfigAdapter(config)
+
+	var wg sync.WaitGroup
+
+	// Concurrent getter registrations
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			path := string(rune('A' + idx%26))
+			adapter.RegisterGetter(path, func() interface{} {
+				return "value"
+			})
+		}(i)
+	}
+
+	// Concurrent gets
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			path := string(rune('A' + idx%26))
+			_, _ = adapter.Get(path)
+		}(i)
+	}
+
+	wg.Wait()
+}

internal/errors/errors.go

@@ -91,7 +91,8 @@ func (e *OIDCError) ToJSON() map[string]any {
 	}
 
 	if e.Details != "" {
-		result["error"].(map[string]any)["details"] = e.Details
+		errorMap, _ := result["error"].(map[string]any) // Safe to ignore: type assertion from known type
+		errorMap["details"] = e.Details
 	}
 
 	return result

internal/features/flags.go

@@ -0,0 +1,235 @@
+// Package features provides feature flag management for safe rollback during refactoring
+package features
+
+import (
+	"os"
+	"strings"
+	"sync"
+	"sync/atomic"
+)
+
+// FeatureFlag represents a feature flag for controlling new functionality
+type FeatureFlag struct {
+	name        string
+	description string
+	enabled     atomic.Bool
+	mu          sync.RWMutex
+	callbacks   []func(bool)
+}
+
+// FeatureManager manages all feature flags in the application
+type FeatureManager struct {
+	flags map[string]*FeatureFlag
+	mu    sync.RWMutex
+}
+
+var (
+	// Global feature manager instance
+	manager     *FeatureManager
+	managerOnce sync.Once
+)
+
+// Feature flag names
+const (
+	// UseUnifiedConfig enables the new unified configuration system
+	UseUnifiedConfig = "USE_UNIFIED_CONFIG"
+
+	// UseNewFileStructure enables the new modularized file structure
+	UseNewFileStructure = "USE_NEW_FILE_STRUCTURE"
+
+	// UseStandardErrors enables the standardized error package
+	UseStandardErrors = "USE_STANDARD_ERRORS"
+
+	// UseEnhancedLogging enables the enhanced logging system
+	UseEnhancedLogging = "USE_ENHANCED_LOGGING"
+
+	// UseOptimizedTests enables the consolidated test suite
+	UseOptimizedTests = "USE_OPTIMIZED_TESTS"
+
+	// UseRedisRESP enables the custom Redis RESP implementation
+	UseRedisRESP = "USE_REDIS_RESP"
+)
+
+// GetManager returns the global feature manager instance
+func GetManager() *FeatureManager {
+	managerOnce.Do(func() {
+		manager = &FeatureManager{
+			flags: make(map[string]*FeatureFlag),
+		}
+		manager.initialize()
+	})
+	return manager
+}
+
+// initialize sets up default feature flags
+func (m *FeatureManager) initialize() {
+	// Phase 0: Feature flags setup
+	m.Register(UseUnifiedConfig, "Enable unified configuration package", false)
+	m.Register(UseNewFileStructure, "Enable modularized file structure", false)
+	m.Register(UseStandardErrors, "Enable standardized error handling", false)
+	m.Register(UseEnhancedLogging, "Enable enhanced logging system", false)
+	m.Register(UseOptimizedTests, "Enable optimized test suite", false)
+	m.Register(UseRedisRESP, "Enable custom Redis RESP implementation", false)
+
+	// Load from environment variables
+	m.LoadFromEnv()
+}
+
+// Register creates a new feature flag
+func (m *FeatureManager) Register(name, description string, defaultValue bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	flag := &FeatureFlag{
+		name:        name,
+		description: description,
+		callbacks:   make([]func(bool), 0),
+	}
+	flag.enabled.Store(defaultValue)
+	m.flags[name] = flag
+}
+
+// IsEnabled checks if a feature flag is enabled
+func (m *FeatureManager) IsEnabled(name string) bool {
+	m.mu.RLock()
+	flag, exists := m.flags[name]
+	m.mu.RUnlock()
+
+	if !exists {
+		return false
+	}
+
+	return flag.enabled.Load()
+}
+
+// Enable turns on a feature flag
+func (m *FeatureManager) Enable(name string) {
+	m.setFlag(name, true)
+}
+
+// Disable turns off a feature flag
+func (m *FeatureManager) Disable(name string) {
+	m.setFlag(name, false)
+}
+
+// Toggle switches a feature flag state
+func (m *FeatureManager) Toggle(name string) {
+	m.mu.RLock()
+	flag, exists := m.flags[name]
+	m.mu.RUnlock()
+
+	if exists {
+		newValue := !flag.enabled.Load()
+		m.setFlag(name, newValue)
+	}
+}
+
+// setFlag updates a feature flag value and triggers callbacks
+func (m *FeatureManager) setFlag(name string, value bool) {
+	m.mu.RLock()
+	flag, exists := m.flags[name]
+	m.mu.RUnlock()
+
+	if !exists {
+		return
+	}
+
+	oldValue := flag.enabled.Swap(value)
+
+	// Only trigger callbacks if value actually changed
+	if oldValue != value {
+		flag.mu.RLock()
+		callbacks := flag.callbacks
+		flag.mu.RUnlock()
+
+		for _, callback := range callbacks {
+			callback(value)
+		}
+	}
+}
+
+// OnChange registers a callback to be called when a feature flag changes
+func (m *FeatureManager) OnChange(name string, callback func(bool)) {
+	m.mu.RLock()
+	flag, exists := m.flags[name]
+	m.mu.RUnlock()
+
+	if exists {
+		flag.mu.Lock()
+		flag.callbacks = append(flag.callbacks, callback)
+		flag.mu.Unlock()
+	}
+}
+
+// LoadFromEnv loads feature flag values from environment variables
+func (m *FeatureManager) LoadFromEnv() {
+	m.mu.RLock()
+	flags := make(map[string]*FeatureFlag)
+	for name, flag := range m.flags {
+		flags[name] = flag
+	}
+	m.mu.RUnlock()
+
+	for name, flag := range flags {
+		envVar := "FEATURE_" + name
+		if value := os.Getenv(envVar); value != "" {
+			enabled := strings.ToLower(value) == "true" || value == "1"
+			flag.enabled.Store(enabled)
+		}
+	}
+}
+
+// GetAll returns all feature flags and their states
+func (m *FeatureManager) GetAll() map[string]bool {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	result := make(map[string]bool)
+	for name, flag := range m.flags {
+		result[name] = flag.enabled.Load()
+	}
+	return result
+}
+
+// Reset resets all feature flags to their default values
+func (m *FeatureManager) Reset() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	for _, flag := range m.flags {
+		flag.enabled.Store(false)
+		flag.callbacks = make([]func(bool), 0)
+	}
+}
+
+// Helper functions for common checks
+
+// IsUnifiedConfigEnabled checks if unified config is enabled
+func IsUnifiedConfigEnabled() bool {
+	return GetManager().IsEnabled(UseUnifiedConfig)
+}
+
+// IsNewFileStructureEnabled checks if new file structure is enabled
+func IsNewFileStructureEnabled() bool {
+	return GetManager().IsEnabled(UseNewFileStructure)
+}
+
+// IsStandardErrorsEnabled checks if standard errors are enabled
+func IsStandardErrorsEnabled() bool {
+	return GetManager().IsEnabled(UseStandardErrors)
+}
+
+// IsEnhancedLoggingEnabled checks if enhanced logging is enabled
+func IsEnhancedLoggingEnabled() bool {
+	return GetManager().IsEnabled(UseEnhancedLogging)
+}
+
+// IsOptimizedTestsEnabled checks if optimized tests are enabled
+func IsOptimizedTestsEnabled() bool {
+	return GetManager().IsEnabled(UseOptimizedTests)
+}
+
+// IsRedisRESPEnabled checks if custom Redis RESP is enabled
+func IsRedisRESPEnabled() bool {
+	return GetManager().IsEnabled(UseRedisRESP)
+}

internal/features/flags_test.go

@@ -0,0 +1,483 @@
+//go:build !yaegi
+
+package features
+
+import (
+	"os"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestFeatureManager_Register(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	if !m.flags["TEST_FEATURE"].enabled.Load() == false {
+		t.Error("Expected feature to be disabled by default")
+	}
+
+	m.Register("TEST_ENABLED", "Test enabled feature", true)
+	if m.flags["TEST_ENABLED"].enabled.Load() != true {
+		t.Error("Expected feature to be enabled")
+	}
+}
+
+func TestFeatureManager_IsEnabled(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", true)
+
+	if !m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected feature to be enabled")
+	}
+
+	if m.IsEnabled("NON_EXISTENT") {
+		t.Error("Expected non-existent feature to return false")
+	}
+}
+
+func TestFeatureManager_EnableDisable(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	// Enable the feature
+	m.Enable("TEST_FEATURE")
+	if !m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected feature to be enabled")
+	}
+
+	// Disable the feature
+	m.Disable("TEST_FEATURE")
+	if m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected feature to be disabled")
+	}
+
+	// Enable/Disable non-existent feature should not panic
+	m.Enable("NON_EXISTENT")
+	m.Disable("NON_EXISTENT")
+}
+
+func TestFeatureManager_Toggle(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	// Toggle from false to true
+	m.Toggle("TEST_FEATURE")
+	if !m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected feature to be enabled after toggle")
+	}
+
+	// Toggle from true to false
+	m.Toggle("TEST_FEATURE")
+	if m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected feature to be disabled after toggle")
+	}
+
+	// Toggle non-existent feature should not panic
+	m.Toggle("NON_EXISTENT")
+}
+
+func TestFeatureManager_OnChange(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	var callbackCalled atomic.Bool
+	var callbackValue atomic.Bool
+
+	m.OnChange("TEST_FEATURE", func(enabled bool) {
+		callbackCalled.Store(true)
+		callbackValue.Store(enabled)
+	})
+
+	// Enable should trigger callback
+	m.Enable("TEST_FEATURE")
+
+	// Wait briefly for callback
+	time.Sleep(10 * time.Millisecond)
+
+	if !callbackCalled.Load() {
+		t.Error("Expected callback to be called")
+	}
+
+	if !callbackValue.Load() {
+		t.Error("Expected callback value to be true")
+	}
+
+	// Setting to same value should NOT trigger callback again
+	callbackCalled.Store(false)
+	m.Enable("TEST_FEATURE")
+	time.Sleep(10 * time.Millisecond)
+
+	if callbackCalled.Load() {
+		t.Error("Expected callback NOT to be called when value doesn't change")
+	}
+}
+
+func TestFeatureManager_LoadFromEnv(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+	m.Register("TEST_FEATURE_2", "Test feature 2", false)
+
+	// Set environment variables
+	os.Setenv("FEATURE_TEST_FEATURE", "true")
+	os.Setenv("FEATURE_TEST_FEATURE_2", "1")
+	defer func() {
+		os.Unsetenv("FEATURE_TEST_FEATURE")
+		os.Unsetenv("FEATURE_TEST_FEATURE_2")
+	}()
+
+	m.LoadFromEnv()
+
+	if !m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected TEST_FEATURE to be enabled from env")
+	}
+
+	if !m.IsEnabled("TEST_FEATURE_2") {
+		t.Error("Expected TEST_FEATURE_2 to be enabled from env (value=1)")
+	}
+}
+
+func TestFeatureManager_LoadFromEnv_FalseValues(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", true) // Default true
+
+	// Set to false
+	os.Setenv("FEATURE_TEST_FEATURE", "false")
+	defer os.Unsetenv("FEATURE_TEST_FEATURE")
+
+	m.LoadFromEnv()
+
+	if m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected TEST_FEATURE to be disabled from env")
+	}
+}
+
+func TestFeatureManager_GetAll(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("FEATURE_1", "Feature 1", true)
+	m.Register("FEATURE_2", "Feature 2", false)
+
+	all := m.GetAll()
+
+	if len(all) != 2 {
+		t.Errorf("Expected 2 features, got %d", len(all))
+	}
+
+	if !all["FEATURE_1"] {
+		t.Error("Expected FEATURE_1 to be enabled")
+	}
+
+	if all["FEATURE_2"] {
+		t.Error("Expected FEATURE_2 to be disabled")
+	}
+}
+
+func TestFeatureManager_Reset(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("FEATURE_1", "Feature 1", true)
+	m.Register("FEATURE_2", "Feature 2", true)
+
+	var callbackCalled atomic.Int32
+	m.OnChange("FEATURE_1", func(enabled bool) {
+		callbackCalled.Add(1)
+	})
+
+	m.Reset()
+
+	// All features should be disabled
+	if m.IsEnabled("FEATURE_1") {
+		t.Error("Expected FEATURE_1 to be disabled after reset")
+	}
+
+	if m.IsEnabled("FEATURE_2") {
+		t.Error("Expected FEATURE_2 to be disabled after reset")
+	}
+
+	// Callbacks should be cleared
+	m.Enable("FEATURE_1")
+	time.Sleep(10 * time.Millisecond)
+
+	if callbackCalled.Load() != 0 {
+		t.Error("Expected callbacks to be cleared after reset")
+	}
+}
+
+func TestGetManager_Singleton(t *testing.T) {
+	// Reset global state for clean test
+	managerOnce = sync.Once{}
+	manager = nil
+
+	m1 := GetManager()
+	m2 := GetManager()
+
+	if m1 != m2 {
+		t.Error("Expected GetManager to return same instance")
+	}
+}
+
+func TestGetManager_Initialize(t *testing.T) {
+	// Reset global state for clean test
+	managerOnce = sync.Once{}
+	manager = nil
+
+	m := GetManager()
+
+	// Should have default feature flags
+	all := m.GetAll()
+	if len(all) < 6 {
+		t.Errorf("Expected at least 6 default feature flags, got %d", len(all))
+	}
+
+	// Check specific flags exist
+	flags := []string{
+		UseUnifiedConfig,
+		UseNewFileStructure,
+		UseStandardErrors,
+		UseEnhancedLogging,
+		UseOptimizedTests,
+		UseRedisRESP,
+	}
+
+	for _, flag := range flags {
+		if _, exists := m.flags[flag]; !exists {
+			t.Errorf("Expected default flag %s to exist", flag)
+		}
+	}
+}
+
+func TestHelperFunctions(t *testing.T) {
+	// Reset global state
+	managerOnce = sync.Once{}
+	manager = nil
+
+	// Test IsUnifiedConfigEnabled
+	if IsUnifiedConfigEnabled() {
+		t.Error("Expected unified config to be disabled by default")
+	}
+
+	GetManager().Enable(UseUnifiedConfig)
+	if !IsUnifiedConfigEnabled() {
+		t.Error("Expected unified config to be enabled")
+	}
+
+	// Reset for next test
+	GetManager().Reset()
+
+	// Test IsNewFileStructureEnabled
+	if IsNewFileStructureEnabled() {
+		t.Error("Expected new file structure to be disabled by default")
+	}
+
+	GetManager().Enable(UseNewFileStructure)
+	if !IsNewFileStructureEnabled() {
+		t.Error("Expected new file structure to be enabled")
+	}
+
+	// Test IsStandardErrorsEnabled
+	GetManager().Reset()
+	GetManager().Enable(UseStandardErrors)
+	if !IsStandardErrorsEnabled() {
+		t.Error("Expected standard errors to be enabled")
+	}
+
+	// Test IsEnhancedLoggingEnabled
+	GetManager().Reset()
+	GetManager().Enable(UseEnhancedLogging)
+	if !IsEnhancedLoggingEnabled() {
+		t.Error("Expected enhanced logging to be enabled")
+	}
+
+	// Test IsOptimizedTestsEnabled
+	GetManager().Reset()
+	GetManager().Enable(UseOptimizedTests)
+	if !IsOptimizedTestsEnabled() {
+		t.Error("Expected optimized tests to be enabled")
+	}
+
+	// Test IsRedisRESPEnabled
+	GetManager().Reset()
+	GetManager().Enable(UseRedisRESP)
+	if !IsRedisRESPEnabled() {
+		t.Error("Expected Redis RESP to be enabled")
+	}
+}
+
+// Race condition tests
+func TestFeatureManager_ConcurrentAccess(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	var wg sync.WaitGroup
+	iterations := 100
+
+	// Concurrent enables
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			m.Enable("TEST_FEATURE")
+		}()
+	}
+
+	// Concurrent disables
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			m.Disable("TEST_FEATURE")
+		}()
+	}
+
+	// Concurrent reads
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_ = m.IsEnabled("TEST_FEATURE")
+		}()
+	}
+
+	wg.Wait()
+
+	// Should not panic - final state is not deterministic but that's ok
+}
+
+func TestFeatureManager_ConcurrentCallbacks(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	var callbackCount atomic.Int32
+	var wg sync.WaitGroup
+
+	// Register multiple callbacks concurrently
+	for i := 0; i < 10; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			m.OnChange("TEST_FEATURE", func(enabled bool) {
+				callbackCount.Add(1)
+			})
+		}()
+	}
+
+	wg.Wait()
+
+	// Toggle the feature
+	m.Toggle("TEST_FEATURE")
+
+	// Wait for callbacks
+	time.Sleep(50 * time.Millisecond)
+
+	// All 10 callbacks should have been called
+	if callbackCount.Load() != 10 {
+		t.Errorf("Expected 10 callbacks, got %d", callbackCount.Load())
+	}
+}
+
+func TestFeatureManager_ConcurrentGetAll(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	for i := 0; i < 5; i++ {
+		m.Register(string(rune('A'+i)), "Feature", false)
+	}
+
+	var wg sync.WaitGroup
+
+	// Concurrent GetAll calls
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			all := m.GetAll()
+			if len(all) != 5 {
+				t.Errorf("Expected 5 flags, got %d", len(all))
+			}
+		}()
+	}
+
+	// Concurrent modifications
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			flag := string(rune('A' + (idx % 5)))
+			if idx%2 == 0 {
+				m.Enable(flag)
+			} else {
+				m.Disable(flag)
+			}
+		}(i)
+	}
+
+	wg.Wait()
+}
+
+func TestFeatureManager_LoadFromEnv_Concurrent(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("FEATURE_1", "Feature 1", false)
+	m.Register("FEATURE_2", "Feature 2", false)
+
+	os.Setenv("FEATURE_FEATURE_1", "true")
+	os.Setenv("FEATURE_FEATURE_2", "true")
+	defer func() {
+		os.Unsetenv("FEATURE_FEATURE_1")
+		os.Unsetenv("FEATURE_FEATURE_2")
+	}()
+
+	var wg sync.WaitGroup
+
+	// Load from env concurrently
+	for i := 0; i < 10; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			m.LoadFromEnv()
+		}()
+	}
+
+	wg.Wait()
+
+	// Both should be enabled
+	if !m.IsEnabled("FEATURE_1") || !m.IsEnabled("FEATURE_2") {
+		t.Error("Expected features to be enabled from env")
+	}
+}

internal/handlers/auth_flow.go

@@ -130,7 +130,7 @@ func (h *AuthFlowHandler) waitForInitialization(req *http.Request) bool {
 		}
 		return true
 	case <-req.Context().Done():
-		h.logger.Debug("Request cancelled while waiting for OIDC initialization")
+		h.logger.Debug("Request canceled while waiting for OIDC initialization")
 		return false
 	case <-time.After(30 * time.Second):
 		h.logger.Error("Timeout waiting for OIDC initialization")

internal/handlers/auth_flow_test.go

@@ -246,7 +246,7 @@ func TestAuthFlowHandler_waitForInitialization(t *testing.T) {
 			expectedResult: false,
 		},
 		{
-			name: "Request cancelled",
+			name: "Request canceled",
 			setupHandler: func() (*AuthFlowHandler, context.CancelFunc) {
 				initComplete := make(chan struct{})
 				handler := &AuthFlowHandler{

internal/handlers/session_handler.go

@@ -215,12 +215,12 @@ func (h *SessionHandler) SendErrorResponse(rw http.ResponseWriter, req *http.Req
 		// For AJAX requests, send JSON response
 		rw.Header().Set("Content-Type", "application/json")
 		rw.WriteHeader(statusCode)
-		fmt.Fprintf(rw, `{"error": "%s"}`, message)
+		_, _ = fmt.Fprintf(rw, `{"error": "%s"}`, message) // Safe to ignore: writing error response
 	} else {
 		// For browser requests, send HTML response
 		rw.Header().Set("Content-Type", "text/html")
 		rw.WriteHeader(statusCode)
-		fmt.Fprintf(rw, `<html><body><h1>Error %d</h1><p>%s</p></body></html>`, statusCode, message)
+		_, _ = fmt.Fprintf(rw, `<html><body><h1>Error %d</h1><p>%s</p></body></html>`, statusCode, message) // Safe to ignore: writing error response
 	}
 }
 

internal/middleware/request_handler.go

@@ -81,8 +81,8 @@ func (rp *RequestProcessor) WaitForInitialization(req *http.Request, initComplet
 	case <-initComplete:
 		return nil
 	case <-req.Context().Done():
-		rp.logger.Debug("Request cancelled while waiting for OIDC initialization")
-		return fmt.Errorf("request cancelled")
+		rp.logger.Debug("Request canceled while waiting for OIDC initialization")
+		return fmt.Errorf("request canceled")
 	case <-time.After(30 * time.Second):
 		rp.logger.Error("Timeout waiting for OIDC initialization")
 		return fmt.Errorf("timeout waiting for OIDC provider initialization")