Chris LuandDevin 8844d9823f iam/oidc: wrap the jti replay cache in its own type (#12017) ...

* iam/oidc: wrap the jti replay cache in its own type

The replay-protection state lived as ten fields and nine methods spread
across OIDCProvider. jtiReplayCache now owns the store, count, bound,
sweep scheduling, and cleanup worker; the provider keeps a single jti
field and delegates configure, consume, stop, adopt, and merge.

* iam/oidc: lazily allocate the jti replay cache

A zero-value OIDCProvider left jti nil, so Initialize, single-use
validation, Shutdown, and the replay-state handoffs panicked on a nil
cache. Allocate the cache through a sync.Once-guarded getter instead.

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-10-24 07:03:42 -07:00

..

jti_cache.go

iam/oidc: wrap the jti replay cache in its own type (#12017)

2026-10-24 07:03:42 -07:00

mock_provider_test.go

go fix

2026-02-20 18:42:00 -08:00

mock_provider.go

iam/oidc: reject reused jti claims with a bounded replay cache (#11936)

2026-10-23 00:46:14 -07:00

oidc_discovery_test.go

feat(iam): STS web-identity AWS-fidelity polish (Phase 1) (#9318)

2026-05-04 22:10:49 -07:00

oidc_https_keys_test.go

iam: manage OIDC providers and roles over the filer IAM gRPC service (#11523)

2026-10-03 08:36:19 +08:00

oidc_provider_test.go

iam/oidc: wrap the jti replay cache in its own type (#12017)

2026-10-24 07:03:42 -07:00

oidc_provider.go

iam/oidc: wrap the jti replay cache in its own type (#12017)

2026-10-24 07:03:42 -07:00

policy_claim_test.go

feat(iam): claim-based policy mode for AssumeRoleWithWebIdentity (Phase 3b) (#9322)

2026-05-05 12:21:55 -07:00

principal_tags_test.go

feat(iam): principal session tags from OIDC tokens (Phase 3a) (#9321)

2026-05-05 11:43:05 -07:00

thumbprint_test.go

feat(iam): OIDC provider mutations + multi-client + TLS thumbprints (Phase 2b) (#9320)

2026-05-05 11:26:08 -07:00