refactor: review linting

Signed-off-by: Josh Wulf <josh.wulf@camunda.com>

Author: jwulf

README.md

@@ -217,7 +217,7 @@ Camunda SaaS continues returning `401 Unauthorized` for a misconfigured credenti
 
 Behavior:
 
-- First `401` for `(clientId, clientSecret, audienceType)` creates `oauth-401-tarpit-<clientId>-<audience>-<hash>.json` in the cache directory (`$HOME/.camunda` by default). `<hash>` is a truncated SHA-256 of the secret.
+- First `401` for `(clientId, clientSecret, audienceType)` creates `oauth-401-tarpit-<clientId>-<audience>-<hash>.json` in the cache directory (`$HOME/.camunda` by default). `<hash>` is a truncated PBKDF2 (100K iterations) hash of the secret.
 - Subsequent `getHeaders()` calls for that tuple immediately throw a tarpit error without hitting the token endpoint.
 - The tarpit does not auto-expire.
 

src/__tests__/oauth/OAuthProvider.401-memoization.unit.spec.ts

@@ -85,9 +85,11 @@ describe('OAuthProvider SaaS persistent 401 tarpit', () => {
 			)
 			.toString('hex')
 			.slice(0, 16)
+		const clientId = 'ZEEBE'
+		const audienceType = 'ZEEBE'
 		const tarpitFile = path.join(
 			cacheDir,
-			`oauth-401-tarpit-ZEEBE-ZEEBE-${hash}.json`
+			`oauth-401-tarpit-${clientId}-${audienceType}-${hash}.json`
 		)
 		expect(fs.existsSync(tarpitFile)).toBe(true)
 		server.close()

src/oauth/lib/OAuthProvider.ts

@@ -365,6 +365,8 @@ export class OAuthProvider implements IHeadersProvider {
 										timestamp: Date.now(),
 										error: e,
 									}
+									// Suppress token endpoint backoff/failure counters for permanent SaaS 401 responses.
+									// This ensures we do not apply retry delays for credentials that are permanently invalid.
 									this.failed = false
 									delete this.inflightTokenRequests[credentialKey]
 									return reject(e)
@@ -786,14 +788,14 @@ export class OAuthProvider implements IHeadersProvider {
 				fs.unlinkSync(file)
 			}
 			// Best-effort in-memory cleanup for existing instances
-			for (const inst of OAuthProvider.instances ?? []) {
+			for (const inst of OAuthProvider.instances) {
 				try {
-					inst.tarpit401?.delete(file)
+					inst.tarpit401.delete(file)
 					const credentialKey = inst.getCredentialAudienceKey({
 						clientId,
 						audienceType,
 					})
-					delete inst.memoized401?.[credentialKey]
+					delete inst.memoized401[credentialKey]
 				} catch (_) {
 					/* ignore */
 				}