Define safe token cache expiration and subject-token validity rules

[michaelw]

Scope

Prevent the cache from extending authorization beyond the lifetime of either the exchanged token or the original subject token.

Acceptance Conditions

• Effective cache TTL is the minimum of:
  • token response expires_in
  • configured max TTL
  • JWT exp from the exchanged access token, when parseable
  • JWT exp from the subject token, when parseable
  • minus configured expiry skew
• If no exchanged-token expiration can be derived, the response is not cached unless an explicit fallback TTL is configured.
• If the subject token is opaque or has no parseable exp, the response is not cached by default.
• Operators may explicitly allow opaque subject-token caching with a short max TTL, documented as a revocation/expiration tradeoff.
• Cache entries are invalidated passively by TTL; no OAuth error response may refresh an existing entry.
• Tests cover subject-token expiry shorter than exchanged-token expiry, missing expires_in, expired JWT subject token, and opaque subject token behavior.

Implementation Approach

• Parse JWT claims without trusting them for authorization; use exp only as an upper bound on cache lifetime.
• Do not validate JWT signatures in the cache layer; the token endpoint remains the authority.
• Document that caching opaque subject tokens can continue accepting a revoked/expired subject token until cache TTL expires.