shreemaan-abhishek opened a new pull request, #14088: URL: https://github.com/apache/apisix/pull/14088
### Description Upgrade `lua-resty-openidc` from `1.9.0-1` to `1.9.3-1` and its required `lua-resty-session` dependency from `4.1.5-1` to `4.2.0-1`. This allows the `openid-connect` plugin to consume the structured introspection failure returned by lua-resty-openidc and distinguish authentication failures from service failures: - confirmed inactive tokens return `401 Unauthorized` with an `invalid_token` challenge; - endpoint failures, transport errors, timeouts, and invalid responses return `503 Service Unavailable` without labeling the token invalid; - configuration failures return `500 Internal Server Error`; - concurrent cache misses for the same token share the in-flight introspection result while coordination succeeds. The PR adds end-to-end coverage for concurrent active requests, shared endpoint failures, inactive tokens, transport and read timeouts, non-cacheable responses, malformed `active` claims, and upstream's best-effort direct-introspection fallback when coordination times out. The introspection documentation now describes the client-visible behavior. Compatibility notes: - `lua-resty-openidc 1.9.3-1` requires `lua-resty-session 4.2.0-1`. The existing `lua-resty-saml 0.2.7` dependency accepts session versions `>= 4.1.5`. - RFC-compliant introspection responses are compatible. A non-boolean or missing `active` claim is now rejected as an invalid upstream response instead of being treated as truthy. - Session destroy and closed-mode revocation-store failures are now propagated by lua-resty-session/openidc rather than silently ignored. - Introspection coordination is deliberately best-effort upstream. If the coordination wait expires, the request falls back to direct introspection instead of failing solely because coordination was unavailable. Local tests were not run for this change; CI will provide the execution results. #### Which issue(s) this PR fixes: N/A ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible for standards-compliant introspection responses; the intentional malformed-response and error-propagation changes are documented above -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
