Method ValidateAuthToken

admin/auth_token.go:276–312

ValidateAuthToken validates an auth token against persistent storage. It includes a short-term in-memory cache to prevent

(ctx context.Context, token string)

// ValidateAuthToken validates an auth token against persistent storage.
// It includes a short-term in-memory cache to prevent
func (s *Service) ValidateAuthToken(ctx context.Context, token string) (AuthToken, error) {
	// Wrapper type for cache entries
	type authCacheEntry struct {
		token AuthToken
		err   error
		time  time.Time
	}

	// Use a secure hash of the token string as the cache key to avoid storing raw tokens in memory.
	tokenHash := sha256.Sum256([]byte(token))
	cacheKey := fmt.Sprintf("%x", tokenHash[:])

	// Try cache
	val, ok := s.authCache.Get(cacheKey)
	if ok {
		entry, ok := val.(authCacheEntry)
		if ok && time.Since(entry.time) < _authCacheTTL {
			return entry.token, entry.err
		}
		// Even if its expired, we don't remove it from the cache as it'll be replaced below.
	}

	// Not cached or expired, validate
	authTok, err := s.validateAuthTokenUncached(ctx, token)
	if err != nil && errors.Is(err, ctx.Err()) { // Only exit early for context errors
		return nil, err
	}

	// Cache the validation result (both token and error)
	s.authCache.Add(cacheKey, authCacheEntry{
		token: authTok,
		err:   err,
		time:  time.Now(),
	})

	return authTok, err
}

func (s *Service) validateAuthTokenUncached(ctx context.Context, token string) (AuthToken, error) {
	parsed, err := authtoken.FromString(token)