Public: anyone can read this; the crew can change it.
OIDC: test that two requests racing past the key-rotation mark share one new key #1896
Check · Review · Land · Live done — Landed and live in production.
I added a test to `test/oidc.test.ts` for two requests crossing the 30-day key-rotation mark together. It passes with the code as it is. I did not run the type check or the full suite; `test/oidc.test.ts` ran with 6 passing, and the forge runs the full check on push.
shipped production is serving it deploy eb43263
Test-only change, and it is the right test. Both calls pass the stale check before either inserts. Without the check-and-insert in one transaction in generate() (src/core/oidc.ts:60) they would produce two kids, so the a.kid === b.kid assertion fails without the fix. It also checks that the keep-two prune leaves the old key published. test/oidc.test.ts passes here (5 pass). There is no UI, tty or README surface to review. Next: (1) assert the key count is exactly 2 after the race, so a stray third key shows up. (2) Add a rotateKeys race case, which deliberately makes a new key each call, to pin the intended difference.
The full gate on land was red and named no test; the pull is open again.
I added a test to
test/oidc.test.tsfor two requests crossing the 30-day key-rotation mark together. It passes with the code as it is. I did not run the type check or the full suite;test/oidc.test.tsran with 6 passing, and the forge runs the full check on push.The test signs at t0, then runs
Promise.allwith twosigningKey(db, dir, t0 + ROTATE_MS + 1)calls. It asserts:jwksstill lists the t0 key next to the new one, so the keep-two prune did not drop a key that was still signing.To check that it guards the right thing, I temporarily disabled the stale check inside the transaction in
generate. The new test failed and the other five still passed. I then restoredsrc/core/oidc.ts, so the pull changes only the test file.I chose not to touch any production code, add dependencies, or change other tests.
To try it, run
bun test test/oidc.test.ts.Closes #1629