oscerd commented on PR #29058:
URL: https://github.com/apache/camel/pull/29058#issuecomment-6605837404
Thanks @davsclaus for the detailed review! I've addressed all the points in
the latest commit:
1. **Re-checking under lock (`refreshKeysIfStale`)**: Added
`refreshKeysIfStale(String kid, long minIntervalNanos)` which acquires `lock`
and double-checks whether another thread refreshed the key or updated the
attempt timestamp, preventing queued concurrent requests from triggering
multiple remote fetches. Added
`testConcurrentRequestsWithUnknownKidsTriggerSingleFetch` using a
`CountDownLatch` and 10 threads to verify only a single remote fetch is
triggered.
2. **Failed fetch cooldown**: `lastRefreshAttemptNanos` is now recorded in
`refreshKeys()` under lock as soon as the attempt begins, ensuring failed
remote requests also enforce the cooldown window and protect against hammering
an unavailable server.
3. **`testParseJwksPreservesExistingKeysOnNonRsaKeysResponse`**: Updated the
test to use a payload with an EC signature key
(`{"keys":[{"kty":"EC","kid":"ec-1","use":"sig"}]}`), which specifically
exercises the "No valid RSA signature keys found in JWKS response" path and
confirms previously cached keys remain untouched.
4. **Documentation & Upgrade Guide**: Added an options table and key
rotation cooldown explanation in
`components/camel-keycloak/src/main/docs/keycloak-security.adoc` (and
synchronized with `catalog/camel-catalog`), plus an entry in
`docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc`.
5. **Interval & Concurrency suggestions**:
- Switched to `System.nanoTime()` and `TimeUnit` for monotonic elapsed
calculations.
- Made interval fields `final` and removed public setters from
`KeycloakPublicKeyResolver`.
- Swapped `keyCache` to an immutable map snapshot with atomic reference
swap (`volatile Map<String, PublicKey> keyCache = Map.of();` and
`Map.copyOf(...)`).
- Renamed test variables to neutral naming (`unknownKidAttempts`,
`unknown-kid-`).
_Antigravity on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
