cache changes

Author: kinjalh

lib/console/ai/tools/workbench/integration/teams/reply.ex

@@ -33,14 +33,12 @@ defmodule Console.AI.Tools.Workbench.Integration.Teams.Reply do
   end
 
   def implement(%__MODULE__{tool: %WorkbenchTool{configuration: %Configuration{teams: %TeamsConnection{} = conn}}, text: text}) do
-    case reply_context() do
-      %ChatbotMessage{service_url: url, conversation_id: cid} when is_binary(url) and is_binary(cid) ->
-        case Connector.reply(conn, url, cid, text) do
-          {:ok, resp} -> Jason.encode(resp)
-          {:error, reason} -> {:error, reason}
-        end
-      _ ->
-        {:error, "no teams chat context is available for this job; use teams_post_channel_message with explicit ids instead"}
+    with %ChatbotMessage{service_url: url, conversation_id: cid} when is_binary(url) and is_binary(cid) <- reply_context(),
+         {:ok, resp} <- Connector.reply(conn, url, cid, text) do
+      Jason.encode(resp)
+    else
+      {:error, _} = err -> err
+      _ -> {:error, "no teams chat context is available for this job; use teams_post_channel_message with explicit ids instead"}
     end
   end
   def implement(%__MODULE__{}), do: {:error, "Microsoft Teams app registration is not configured for this workbench tool."}

lib/console/chat/teams/auth.ex

@@ -11,16 +11,13 @@ defmodule Console.Chat.Teams.Auth do
   to discover the metadata, load + cache the JWKS, and validate the signature/issuer/audience/lifetime.  The
   Teams-specific `serviceurl` claim is checked separately.
   """
-  use Nebulex.Caching
-  require Logger
+  alias Console.OIDC.ProviderConfiguration
 
   # The connector publishes its metadata here.  Two quirks are needed to consume it via oidcc:
   #   * the document's declared issuer is `https://api.botframework.com` (not this url) -> allow_issuer_mismatch
   #   * the document omits several oidc-required fields (scopes/response_types/subject_types), so we backfill
   #     them via document_overrides purely to satisfy the parser - they do not affect token validation.
   @config_issuer "https://login.botframework.com/v1"
-  @cache_adapter Console.conf(:cache_adapter)
-  @ttl :timer.hours(1)
 
   @quirks %{
     quirks: %{
@@ -43,7 +40,7 @@ defmodule Console.Chat.Teams.Auth do
   def verify(token, audience, opts \\ [])
   def verify(token, audience, opts) when is_binary(token) and is_binary(audience) do
     with {:ok, _}             <- peek(token),
-         {:ok, {conf, jwks}}  <- provider_configuration(),
+         {:ok, {conf, jwks}}  <- ProviderConfiguration.fetch(@config_issuer, @quirks),
          ctx                  = Oidcc.ClientContext.from_manual(conf, jwks, audience, "dummy_secret", %{client_jwks: JOSE.JWK.generate_key(16)}),
          validate_opts        = %{signing_algs: ctx.provider_configuration.id_token_signing_alg_values_supported},
          {:ok, claims}        <- validate_jwt(token, ctx, validate_opts),
@@ -53,22 +50,6 @@ defmodule Console.Chat.Teams.Auth do
   end
   def verify(_, _, _), do: {:error, "missing teams bot token or audience"}
 
-  @doc """
-  Loads and caches the Bot Framework provider configuration + JWKS.  Cached so we don't round-trip Microsoft on
-  every webhook; the ttl also bounds how stale the signing keys can get across a key rotation.
-  """
-  @decorate cacheable(cache: @cache_adapter, key: :teams_bf_oidc_config, opts: [ttl: @ttl], match: &ok?/1)
-  def provider_configuration() do
-    with {:ok, {conf, _}} <- Oidcc.ProviderConfiguration.load_configuration(@config_issuer, @quirks),
-         {:ok, {jwks, _}} <- Oidcc.ProviderConfiguration.load_jwks(conf.jwks_uri) do
-      {:ok, {conf, jwks}}
-    else
-      err ->
-        Logger.warning("failed to load teams bot framework oidc configuration: #{inspect(err)}")
-        {:error, "could not load teams bot framework configuration"}
-    end
-  end
-
   # cheap, network-free rejection of obviously malformed tokens before we touch the provider config
   defp peek(token) do
     case Joken.peek_header(token) do
@@ -90,9 +71,6 @@ defmodule Console.Chat.Teams.Auth do
     do: check(String.trim_trailing(claim, "/") == String.trim_trailing(url, "/"), "teams jwt serviceUrl mismatch")
   defp validate_service_url(_claims, _url), do: {:error, "teams jwt is missing the serviceUrl claim"}
 
-  defp ok?({:ok, _}), do: true
-  defp ok?(_), do: false
-
   defp check(true, _), do: :ok
   defp check(_, msg), do: {:error, msg}
 end

lib/console/deployments/settings.ex

@@ -419,18 +419,10 @@ defmodule Console.Deployments.Settings do
   }
 
   @doc """
-  Fetches the issuer configuration from the issuer url
+  Fetches (and caches) the issuer configuration + jwks from the issuer url
   """
-  @decorate cacheable(
-              cache: @cache_adapter,
-              key: {:issuer_configuration, issuer},
-              opts: [ttl: :timer.minutes(60)]
-            )
-  def issuer_configuration(issuer) do
-    with {:ok, {conf, _}} <- Oidcc.ProviderConfiguration.load_configuration(issuer, @quirks),
-         {:ok, {jwks, _}} <- Oidcc.ProviderConfiguration.load_jwks(conf.jwks_uri),
-         do: {:ok, {conf, jwks}}
-  end
+  def issuer_configuration(issuer),
+    do: Console.OIDC.ProviderConfiguration.fetch(issuer, @quirks)
 
   @decorate cache_evict(cache: @cache_adapter, key: :deployment_settings)
   def update(attrs) do

lib/console/oidc/provider_configuration.ex

@@ -0,0 +1,58 @@
+defmodule Console.OIDC.ProviderConfiguration do
+  @moduledoc """
+  Fetches and caches an OpenID Connect provider's configuration + JWKS for an issuer.
+
+  `oidcc` normally recommends running a supervised `Oidcc.ProviderConfiguration.Worker` per provider (an in-memory
+  GenServer that background-refreshes).  We instead cache through Nebulex so the result is shared across the
+  cluster and we don't need a worker per issuer in the supervision tree.  The cache ttl is derived from the
+  `Cache-Control` max-age the provider advertises on its metadata/JWKS responses (`oidcc` returns this as a
+  relative millisecond expiry, falling back to its own 15m default), so entries refresh about when the signing
+  keys would otherwise go stale.  We take the sooner of the config/jwks expiries (jwks rotation is what matters
+  for signature validation) and clamp it to a sane window.
+
+  Callers pass their own `quirks` opts map (`%{quirks: %{...}}`) for atypical providers - e.g. document overrides
+  or `allow_issuer_mismatch` - since those are provider-specific.
+  """
+  require Logger
+
+  @cache_adapter Console.conf(:cache_adapter)
+  @min_ttl :timer.minutes(5)
+  @max_ttl :timer.hours(24)
+
+  @type provider :: {Oidcc.ProviderConfiguration.t(), :jose_jwk.key()}
+
+  @doc """
+  Loads (and caches) the provider configuration + jwks for `issuer`.  `quirks` is forwarded to
+  `Oidcc.ProviderConfiguration.load_configuration/2`.
+  """
+  @spec fetch(binary, map) :: {:ok, provider} | {:error, term}
+  def fetch(issuer, quirks \\ %{}) when is_binary(issuer) do
+    case @cache_adapter.get(key(issuer)) do
+      {_conf, _jwks} = hit -> {:ok, hit}
+      _ -> refresh(issuer, quirks)
+    end
+  end
+
+  defp refresh(issuer, quirks) do
+    with {:ok, {conf, conf_exp}} <- Oidcc.ProviderConfiguration.load_configuration(issuer, quirks),
+         {:ok, {jwks, jwks_exp}} <- Oidcc.ProviderConfiguration.load_jwks(conf.jwks_uri) do
+      @cache_adapter.put(key(issuer), {conf, jwks}, ttl: ttl(conf_exp, jwks_exp))
+      {:ok, {conf, jwks}}
+    else
+      err ->
+        Logger.warning("failed to load oidc provider configuration for #{issuer}: #{inspect(err)}")
+        normalize(err)
+    end
+  end
+
+  defp normalize({:error, _} = err), do: err
+  defp normalize(err), do: {:error, err}
+
+  defp key(issuer), do: {:oidc_provider_config, issuer}
+
+  defp ttl(conf_exp, jwks_exp) do
+    min(conf_exp, jwks_exp)
+    |> max(@min_ttl)
+    |> min(@max_ttl)
+  end
+end