[TT-15683] Add JWKS cache flush to the Dashboard API and MDCB

gateway/mw_jwt.go

@@ -1593,16 +1593,21 @@
 	return "", ErrNoSuitableUserIDClaimFound
 }
 
-func (gw *Gateway) invalidateJWKSCacheForAPIID(w http.ResponseWriter, r *http.Request) {
-	apiID := mux.Vars(r)["apiID"]
+func invalidateJWKSCacheByAPIID(apiID string) {
 	raw, ok := JWKCaches.Load(apiID)
 	if ok {
 		jwkCache, interfaceOK := raw.(cache.Repository)
 		if !interfaceOK {
 			panic("JWKCache must implement cache.Repository")
 		}
 		jwkCache.Flush()
+		mainLog.Debugf("JWKS cache for API: %s has been flushed", apiID)
 	}
+}
+
+func (gw *Gateway) invalidateJWKSCacheForAPIID(w http.ResponseWriter, r *http.Request) {
+	apiID := mux.Vars(r)["apiID"]
+	invalidateJWKSCacheByAPIID(apiID)
 	// Cache invalidation is idempotent: calling it ensures the key is absent,
 	// regardless of whether it was cached before or not.
 	doJSONWrite(w, http.StatusOK, apiOk("cache invalidated"))

gateway/mw_jwt_test.go

@@ -12,16 +12,16 @@
 	"testing"
 	"time"
 
+	"github.com/TykTechnologies/tyk/apidef"
 	"github.com/TykTechnologies/tyk/apidef/oas"
+	"github.com/TykTechnologies/tyk/config"
 	tyktime "github.com/TykTechnologies/tyk/internal/time"
+	"github.com/TykTechnologies/tyk/test"
+	"github.com/TykTechnologies/tyk/user"
 	"github.com/go-jose/go-jose/v3"
 	"github.com/golang-jwt/jwt/v4"
 	"github.com/stretchr/testify/assert"
-
-	"github.com/TykTechnologies/tyk/apidef"
-	"github.com/TykTechnologies/tyk/config"
-	"github.com/TykTechnologies/tyk/test"
-	"github.com/TykTechnologies/tyk/user"
+	"github.com/stretchr/testify/require"
 
 	"github.com/TykTechnologies/tyk/internal/cache"
 	"github.com/TykTechnologies/tyk/internal/uuid"
@@ -2425,6 +2425,41 @@
 	assert.Equal(t, 0, jwkCache.Count())
 }
 
+func Test_NoticeInvalidateJWKSCacheForAPI(t *testing.T) {
+	ts := StartTest(nil)
+	defer ts.Close()
+
+	spec, jwtToken := ts.prepareJWTSessionRSAWithEncodedJWKWithAPIID(uuid.NewHex())
+
+	authHeaders := map[string]string{"authorization": jwtToken}
+
+	spec.JWTSource = testHttpJWK
+	ts.Gw.LoadAPI(spec)
+
+	// Fill the JWKS cache
+	_, err := ts.Run(t, test.TestCase{
+		Headers: authHeaders, Code: http.StatusOK,
+	})
+	assert.Nil(t, err)
+
+	// The previous request should have filled the cache with some entries
+	jwkCache := loadOrCreateJWKCacheByApiID(spec.APIID)
+	assert.True(t, jwkCache.Count() > 0)
+
+	// Emit event
+	n := Notification{
+		Command: NoticeInvalidateJWKSCacheForAPI,
+		Payload: spec.APIID,
+		Gw:      ts.Gw,
+	}
+	ts.Gw.MainNotifier.Notify(n)
+
+	require.Eventuallyf(t, func() bool {
+		jwkCache = loadOrCreateJWKCacheByApiID(spec.APIID)
+		return jwkCache.Count() == 0
+	}, 5*time.Second, 100*time.Millisecond, "JWKS cache could not be flushed")
+}
+
 func TestJWTSessionRSAWithEncodedJWK(t *testing.T) {
 	ts := StartTest(nil)
 	defer ts.Close()

gateway/redis_signals.go

@@ -41,8 +41,9 @@
 	KeySpaceUpdateNotification   NotificationCommand = "KeySpaceUpdateNotification"
 	OAuthPurgeLapsedTokens       NotificationCommand = "OAuthPurgeLapsedTokens"
 	// NoticeDeleteAPICache is the command with which event is emitted from dashboard to invalidate cache for an API.
-	NoticeDeleteAPICache NotificationCommand = "DeleteAPICache"
-	NoticeUserKeyReset   NotificationCommand = "UserKeyReset"
+	NoticeDeleteAPICache            NotificationCommand = "DeleteAPICache"
+	NoticeUserKeyReset              NotificationCommand = "UserKeyReset"
+	NoticeInvalidateJWKSCacheForAPI NotificationCommand = "InvalidateJWKSCacheForAPI"
 )
 
 // Notification is a type that encodes a message published to a pub sub channel (shared between implementations)
@@ -159,6 +160,8 @@
 		if ok := gw.invalidateAPICache(notif.Payload); !ok {
 			log.WithError(err).Errorf("cache invalidation failed for: %s", notif.Payload)
 		}
+	case NoticeInvalidateJWKSCacheForAPI:
+		invalidateJWKSCacheByAPIID(notif.Payload)
 	case NoticeUserKeyReset:
 		gw.handleUserKeyReset(notif.Payload)
 	default: