Add in-memory IAM introspection and JWKS cache

[cassi-volkova]

Summary

• add a small Go reverse proxy that caches successful IAM token introspection responses by hashed access token and indexes them by token UUID for invalidation
• cache JWKS independently, coalesce concurrent misses, bound both caches with configurable LRU capacities, and cap introspection lifetime at the token expiration
• forward non-cacheable IAM requests and every request carrying X-OTP directly to Core
• expose a loopback-only idempotent invalidation endpoint; Core integration with this endpoint is intentionally deferred from the first implementation
• route IAM client traffic through the cache in the Core manifest and install/start the service during image deployment and upgrades
• build a stripped static binary with a temporary checksummed Go toolchain, then remove the toolchain and build caches from the image
• add example configuration with 15-second introspection and 1-minute JWKS defaults, plus race-enabled CI coverage

Validation

• go test -race ./...
• go vet ./...
• tox -e ruff-check
• bash -n exordos/images/install.sh exordos/images/bootstrap.sh
• Markdown lint for services/iam-cache/README.md
• workflow YAML and example JSON parsing
• git diff --check
• full Core image build and in-place deployment in an isolated lab environment
• live health, routing, cache expiration, invalidation, pass-through, and service restart checks

Lab benchmark

Warm-cache measurements used concurrency 32:

Endpoint	Requests	Direct Core	Through cache	Upstream calls
Introspection	2,000	513 rps, p50 56.23 ms, p95 98.15 ms	10,376 rps, p50 2.04 ms, p95 8.92 ms	2,000 -> 1
JWKS	1,000	1,586 rps, p50 18.97 ms, p95 28.17 ms	8,292 rps, p50 2.50 ms, p95 9.22 ms	1,000 -> 1

Measured total Core-plus-cache CPU time decreased by approximately 98.2% for introspection and 94.0% for JWKS in this synthetic workload.

Summary by Sourcery

Introduce a dedicated in-memory IAM reverse proxy service that caches introspection and JWKS responses and integrate it into the Core deployment and routing configuration.

New Features:

• Add the exordos-iam-cache Go service providing cached IAM introspection and JWKS endpoints with a separate internal cache invalidation API.

Enhancements:

• Wire IAM client traffic through the new cache in the Core load balancer manifest while preserving non-cacheable and X-OTP requests as direct Core pass-through.
• Install and manage the exordos-iam-cache binary and systemd service as part of Core image build, install, bootstrap, and upgrade workflows.
• Document the IAM cache behaviour, configuration, and usage in a new README with an example JSON configuration file.

Build:

• Build a stripped static exordos-iam-cache Go binary using a temporary, checksummed toolchain during image installation and remove the toolchain and build caches afterward.

CI:

• Add a Go-focused CI job to run race-enabled tests and go vet for the IAM cache module.

Documentation:

• Add README documentation describing the IAM cache endpoints, caching semantics, configuration, and test commands.

Tests:

• Introduce unit and integration-style tests for IAM cache configuration parsing, caching behaviour, concurrency coalescing, invalidation, and HTTP proxy routing semantics.

[sourcery-ai]

🧙 Sourcery is reviewing your pull request!

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.