Merge pull request #36 from bnema/fix/registry-auth-scope-and-cache

fix(auth): registry push failures with token cache and scope validation

commit: b3a38c8b5e32169d7930174bb99e14c661453384
author: bnema · 9mo ago · 2026-01-18 09:54 UTC
committer: GitHub · 9mo ago · 2026-01-18 09:54 UTC
merge of: b310320 + c57e4be · diff against the first parent
signature: GPG UnverifiedB5690EEEBB952194 The key is unknown
refs: tag: v2.7.1

5 files · +456 -39

M docs/getting-started.md +55 -7


@@ -7,6 +7,7 @@ Deploy your first app with Gordon in under 5 minutes.
7	7		- A Linux VPS with Docker or Podman installed
8	8		- A domain pointing to your VPS (DNS A record)
9	9		- Cloudflare account (free tier) for HTTPS termination
	10	+	- [pass](https://www.passwordstore.org/) (password manager) with GPG key initialized
10	11
11	12		## 1. Install Gordon
12	13

@@ -16,7 +17,7 @@ curl -fsSL https://gordon.bnema.dev/install \| bash
16	17
17	18		This script automatically detects your OS and architecture, downloads the appropriate binary, and installs it to `/usr/local/bin`.
18	19
19		-	## 2. Start Gordon
	20	+	## 2. Initialize Configuration
20	21
21	22		```bash
22	23		# First run creates the default config

@@ -26,7 +27,41 @@ gordon serve
26	27
27	28		Config is created at `~/.config/gordon/gordon.toml`.
28	29
29		-	## 3. Configure Your Registry Domain
	30	+	## 3. Set Up Authentication
	31	+
	32	+	Gordon requires a `token_secret` for JWT authentication. We recommend using `pass` to store secrets securely.
	33	+
	34	+	> Local development? If you just want to try Gordon locally, you can disable auth temporarily:
	35	+	> ```toml
	36	+	> [auth]
	37	+	> enabled = false
	38	+	> ```
	39	+	> Skip to [Step 4](#4-configure-your-registry-domain). For production, continue below.
	40	+
	41	+	Initialize pass (if not already done):
	42	+	```bash
	43	+	# Generate a GPG key if you don't have one
	44	+	gpg --gen-key
	45	+
	46	+	# Initialize pass with your GPG key ID
	47	+	pass init <your-gpg-key-id>
	48	+	```
	49	+
	50	+	Create the JWT token secret:
	51	+	```bash
	52	+	# Generate and store a random 32-character secret
	53	+	openssl rand -base64 32 \| pass insert -m gordon/auth/token_secret
	54	+	```
	55	+
	56	+	Update your config (`~/.config/gordon/gordon.toml`):
	57	+	```toml
	58	+	[auth]
	59	+	enabled = true
	60	+	secrets_backend = "pass"
	61	+	token_secret = "gordon/auth/token_secret"
	62	+	```
	63	+
	64	+	## 4. Configure Your Registry Domain
30	65
31	66		Edit `~/.config/gordon/gordon.toml`:
32	67

@@ -34,13 +69,13 @@ Edit `~/.config/gordon/gordon.toml`:
34	69		[server]
35	70		port = 8080 # Proxy port (use with Cloudflare)
36	71		registry_port = 5000 # Registry port
37		-	gordon_domain = "gordon.mydomain.com" # Your Gordon domain
	72	+	gordon_domain = "gordon.mydomain.com" # Your Gordon domain
38	73
39	74		[routes]
40	75		"app.mydomain.com" = "myapp:latest" # Domain → Image mapping
41	76		```
42	77
43		-	## 4. Set Up DNS
	78	+	## 5. Set Up DNS
44	79
45	80		In Cloudflare (or your DNS provider):
46	81

@@ -51,7 +86,7 @@ In Cloudflare (or your DNS provider):
51	86
52	87		Enable Cloudflare proxy (orange cloud) for HTTPS.
53	88
54		-	## 5. Start Gordon as a Service
	89	+	## 6. Start Gordon as a Service
55	90
56	91		```bash
57	92		# Create systemd user service

@@ -75,11 +110,24 @@ systemctl --user enable --now gordon
75	110		sudo loginctl enable-linger $USER
76	111		```
77	112
78		-	## 6. Deploy Your First App
	113	+	## 7. Generate a Deploy Token
	114	+
	115	+	Create a token for pushing images to your registry (skip if auth is disabled):
	116	+
	117	+	```bash
	118	+	gordon auth token generate --subject deploy --scopes push,pull --expiry 0
	119	+	```
	120	+
	121	+	Save this token securely - you'll need it for Docker login.
	122	+
	123	+	## 8. Deploy Your First App
79	124
80	125		On your local machine:
81	126
82	127		```bash
	128	+	# Log in to your Gordon registry (skip if auth is disabled)
	129	+	docker login -u deploy -p <your-token> registry.mydomain.com
	130	+
83	131		# Build your app
84	132		docker build -t myapp .
85	133

@@ -92,7 +140,7 @@ docker push registry.mydomain.com/myapp:latest
92	140
93	141		Your app is now live at `https://app.mydomain.com`!
94	142
95		-	## 7. Update Your App
	143	+	## 9. Update Your App
96	144
97	145		Push a new image to deploy with zero downtime:
98	146

 - A Linux VPS with Docker or Podman installed
 - A domain pointing to your VPS (DNS A record)
 - Cloudflare account (free tier) for HTTPS termination
+- [pass](https://www.passwordstore.org/) (password manager) with GPG key initialized
 ## 1. Install Gordon
 This script automatically detects your OS and architecture, downloads the appropriate binary, and installs it to `/usr/local/bin`.
-## 2. Start Gordon
+## 2. Initialize Configuration
 ```bash
 # First run creates the default config
 Config is created at `~/.config/gordon/gordon.toml`.
-## 3. Configure Your Registry Domain
+## 3. Set Up Authentication
+Gordon requires a `token_secret` for JWT authentication. We recommend using `pass` to store secrets securely.
+> **Local development?** If you just want to try Gordon locally, you can disable auth temporarily:
+> ```toml
+> [auth]
+> enabled = false
+> ```
+> Skip to [Step 4](#4-configure-your-registry-domain). For production, continue below.
+**Initialize pass (if not already done):**
+```bash
+# Generate a GPG key if you don't have one
+gpg --gen-key
+# Initialize pass with your GPG key ID
+pass init <your-gpg-key-id>
+```
+**Create the JWT token secret:**
+```bash
+# Generate and store a random 32-character secret
+openssl rand -base64 32 | pass insert -m gordon/auth/token_secret
+```
+**Update your config** (`~/.config/gordon/gordon.toml`):
+```toml
+[auth]
+enabled = true
+secrets_backend = "pass"
+token_secret = "gordon/auth/token_secret"
+```
+## 4. Configure Your Registry Domain
 Edit `~/.config/gordon/gordon.toml`:
 [server]
 port = 8080                              # Proxy port (use with Cloudflare)
 registry_port = 5000                     # Registry port
-gordon_domain = "gordon.mydomain.com"      # Your Gordon domain
+gordon_domain = "gordon.mydomain.com"    # Your Gordon domain
 [routes]
 "app.mydomain.com" = "myapp:latest"      # Domain → Image mapping
 ```
-## 4. Set Up DNS
+## 5. Set Up DNS
 In Cloudflare (or your DNS provider):
 Enable Cloudflare proxy (orange cloud) for HTTPS.
-## 5. Start Gordon as a Service
+## 6. Start Gordon as a Service
 ```bash
 # Create systemd user service
 sudo loginctl enable-linger $USER
 ```
-## 6. Deploy Your First App
+## 7. Generate a Deploy Token
+Create a token for pushing images to your registry (skip if auth is disabled):
+```bash
+gordon auth token generate --subject deploy --scopes push,pull --expiry 0
+```
+Save this token securely - you'll need it for Docker login.
+## 8. Deploy Your First App
 On your local machine:
 ```bash
+# Log in to your Gordon registry (skip if auth is disabled)
+docker login -u deploy -p <your-token> registry.mydomain.com
 # Build your app
 docker build -t myapp .
 Your app is now live at `https://app.mydomain.com`!
-## 7. Update Your App
+## 9. Update Your App
 Push a new image to deploy with zero downtime:

M internal/adapters/in/cli/auth.go +39 -5


@@ -352,6 +352,44 @@ The hash can be stored in your secrets backend and referenced in the config:
352	352		}
353	353
354	354		// runTokenGenerate generates a new authentication token.
	355	+	// parseAndConvertScopes parses a comma-separated scope string and converts
	356	+	// simple scopes (push, pull, ) to Docker v2 format (repository::action).
	357	+	func parseAndConvertScopes(scopesStr string) []string {
	358	+	rawScopes := strings.Split(scopesStr, ",")
	359	+	for i := range rawScopes {
	360	+	rawScopes[i] = strings.TrimSpace(rawScopes[i])
	361	+	}
	362	+
	363	+	// Check if scopes are already in v2 format (contain colons)
	364	+	hasSimpleScope := false
	365	+	for _, s := range rawScopes {
	366	+	if !strings.Contains(s, ":") && (s == "push" \|\| s == "pull" \|\| s == "*") {
	367	+	hasSimpleScope = true
	368	+	break
	369	+	}
	370	+	}
	371	+
	372	+	if !hasSimpleScope {
	373	+	return rawScopes
	374	+	}
	375	+
	376	+	// Convert simple scopes to v2 format: repository:*:push,pull
	377	+	var scopes []string
	378	+	var actions []string
	379	+	for _, s := range rawScopes {
	380	+	if s == "push" \|\| s == "pull" \|\| s == "*" {
	381	+	actions = append(actions, s)
	382	+	} else {
	383	+	// Keep non-simple scopes as-is (e.g., admin scopes)
	384	+	scopes = append(scopes, s)
	385	+	}
	386	+	}
	387	+	if len(actions) > 0 {
	388	+	scopes = append(scopes, "repository:*:"+strings.Join(actions, ","))
	389	+	}
	390	+	return scopes
	391	+	}
	392	+
355	393		func runTokenGenerate(subject, scopesStr, expiryStr, configPath string) error {
356	394		cfg, err := loadAuthConfig(configPath)
357	395		if err != nil {

@@ -367,11 +405,7 @@ func runTokenGenerate(subject, scopesStr, expiryStr, configPath string) error {
367	405		}
368	406		}
369	407
370		-	// Parse scopes
371		-	scopes := strings.Split(scopesStr, ",")
372		-	for i := range scopes {
373		-	scopes[i] = strings.TrimSpace(scopes[i])
374		-	}
	408	+	scopes := parseAndConvertScopes(scopesStr)
375	409
376	410		// Create auth service
377	411		log := zerowrap.New(zerowrap.Config{Level: "warn"})


@@ -352,6 +352,44 @@ The hash can be stored in your secrets backend and referenced in the config:
352		}	352		}
353			353
354		// runTokenGenerate generates a new authentication token.	354		// runTokenGenerate generates a new authentication token.
			355	+	// parseAndConvertScopes parses a comma-separated scope string and converts
			356	+	// simple scopes (push, pull, ) to Docker v2 format (repository::action).
			357	+	func parseAndConvertScopes(scopesStr string) []string {
			358	+	rawScopes := strings.Split(scopesStr, ",")
			359	+	for i := range rawScopes {
			360	+	rawScopes[i] = strings.TrimSpace(rawScopes[i])
			361	+	}
			362	+
			363	+	// Check if scopes are already in v2 format (contain colons)
			364	+	hasSimpleScope := false
			365	+	for _, s := range rawScopes {
			366	+	if !strings.Contains(s, ":") && (s == "push" \|\| s == "pull" \|\| s == "*") {
			367	+	hasSimpleScope = true
			368	+	break
			369	+	}
			370	+	}
			371	+
			372	+	if !hasSimpleScope {
			373	+	return rawScopes
			374	+	}
			375	+
			376	+	// Convert simple scopes to v2 format: repository:*:push,pull
			377	+	var scopes []string
			378	+	var actions []string
			379	+	for _, s := range rawScopes {
			380	+	if s == "push" \|\| s == "pull" \|\| s == "*" {
			381	+	actions = append(actions, s)
			382	+	} else {
			383	+	// Keep non-simple scopes as-is (e.g., admin scopes)
			384	+	scopes = append(scopes, s)
			385	+	}
			386	+	}
			387	+	if len(actions) > 0 {
			388	+	scopes = append(scopes, "repository:*:"+strings.Join(actions, ","))
			389	+	}
			390	+	return scopes
			391	+	}
			392	+
355		func runTokenGenerate(subject, scopesStr, expiryStr, configPath string) error {	393		func runTokenGenerate(subject, scopesStr, expiryStr, configPath string) error {
356		cfg, err := loadAuthConfig(configPath)	394		cfg, err := loadAuthConfig(configPath)
357		if err != nil {	395		if err != nil {

@@ -367,11 +405,7 @@ func runTokenGenerate(subject, scopesStr, expiryStr, configPath string) error {
367		}	405		}
368		}	406		}
369			407
370	-	// Parse scopes	408	+	scopes := parseAndConvertScopes(scopesStr)
371	-	scopes := strings.Split(scopesStr, ",")
372	-	for i := range scopes {
373	-	scopes[i] = strings.TrimSpace(scopes[i])
374	-	}
375			409
376		// Create auth service	410		// Create auth service
377		log := zerowrap.New(zerowrap.Config{Level: "warn"})	411		log := zerowrap.New(zerowrap.Config{Level: "warn"})

M internal/adapters/in/http/middleware/auth.go +36 -21


@@ -312,33 +312,28 @@ func isInternalRegistryAuth(r *http.Request, internalAuth InternalRegistryAuth)
312	312		return usernameMatch && passwordMatch
313	313		}
314	314
315		-	// checkScopeAccess verifies the token has permission for the requested operation.
316		-	// Maps HTTP method to registry action and checks if any token scope grants access.
317		-	func checkScopeAccess(r http.Request, claims domain.TokenClaims, log zerowrap.Logger) bool {
318		-	// Determine required action from HTTP method
319		-	var action string
320		-	switch r.Method {
	315	+	// actionFromMethod returns the registry action for an HTTP method.
	316	+	func actionFromMethod(method string) string {
	317	+	switch method {
321	318		case http.MethodGet, http.MethodHead:
322		-	action = domain.ScopeActionPull
	319	+	return domain.ScopeActionPull
323	320		case http.MethodPut, http.MethodPost, http.MethodPatch, http.MethodDelete:
324		-	action = domain.ScopeActionPush
	321	+	return domain.ScopeActionPush
325	322		default:
326		-	action = domain.ScopeActionPull // Default to pull for unknown methods
	323	+	return domain.ScopeActionPull
327	324		}
	325	+	}
328	326
329		-	// Extract repository name from URL path
330		-	// Paths are like /v2/{name}/manifests/{reference} or /v2/{name}/blobs/{digest}
331		-	path := r.URL.Path
	327	+	// extractRepoName extracts the repository name from a registry path.
	328	+	// Returns empty string if the path is not a valid registry path or should be allowed.
	329	+	func extractRepoName(path string) (repoName string, shouldAllow bool) {
332	330		if !strings.HasPrefix(path, "/v2/") {
333		-	// Not a registry path, allow
334		-	return true
	331	+	return "", true // Not a registry path, allow
335	332		}
336	333
337		-	// Remove /v2/ prefix and find repository name
338	334		pathParts := strings.Split(strings.TrimPrefix(path, "/v2/"), "/")
339	335		if len(pathParts) < 2 {
340		-	// Malformed path or /v2/ root, allow
341		-	return true
	336	+	return "", true // Malformed path or /v2/ root, allow
342	337		}
343	338
344	339		// Find the boundary between repo name and route (manifests, blobs, tags)

@@ -350,17 +345,37 @@ func checkScopeAccess(r http.Request, claims domain.TokenClaims, log zerowrap.
350	345		}
351	346		}
352	347		if len(repoNameParts) == 0 {
353		-	// Could be a special route like /v2/token, allow
354		-	return true
	348	+	return "", true // Special route like /v2/token, allow
355	349		}
356	350
357		-	repoName := strings.Join(repoNameParts, "/")
	351	+	return strings.Join(repoNameParts, "/"), false
	352	+	}
	353	+
	354	+	// checkScopeAccess verifies the token has permission for the requested operation.
	355	+	// Maps HTTP method to registry action and checks if any token scope grants access.
	356	+	func checkScopeAccess(r http.Request, claims domain.TokenClaims, log zerowrap.Logger) bool {
	357	+	action := actionFromMethod(r.Method)
	358	+
	359	+	repoName, shouldAllow := extractRepoName(r.URL.Path)
	360	+	if shouldAllow {
	361	+	return true
	362	+	}
358	363
359	364		// Check if any token scope grants access
360	365		for _, scopeStr := range claims.Scopes {
	366	+	// Handle simple scopes (e.g., "push", "pull") for backwards compatibility
	367	+	if scopeStr == action \|\| scopeStr == "*" {
	368	+	log.Debug().
	369	+	Str("repo", repoName).
	370	+	Str("action", action).
	371	+	Str("scope", scopeStr).
	372	+	Msg("simple scope access granted")
	373	+	return true
	374	+	}
	375	+
	376	+	// Handle Docker v2 format scopes (e.g., "repository:myrepo:push,pull")
361	377		scope, err := domain.ParseScope(scopeStr)
362	378		if err != nil {
363		-	log.Debug().Err(err).Str("scope", scopeStr).Msg("failed to parse scope")
364	379		continue
365	380		}
366	381

 	return usernameMatch && passwordMatch
 }
-// checkScopeAccess verifies the token has permission for the requested operation.
+// actionFromMethod returns the registry action for an HTTP method.
-// Maps HTTP method to registry action and checks if any token scope grants access.
+func actionFromMethod(method string) string {
-func checkScopeAccess(r *http.Request, claims *domain.TokenClaims, log zerowrap.Logger) bool {
+	switch method {
-	// Determine required action from HTTP method
-	var action string
-	switch r.Method {
 	case http.MethodGet, http.MethodHead:
-		action = domain.ScopeActionPull
+		return domain.ScopeActionPull
 	case http.MethodPut, http.MethodPost, http.MethodPatch, http.MethodDelete:
-		action = domain.ScopeActionPush
+		return domain.ScopeActionPush
 	default:
-		action = domain.ScopeActionPull // Default to pull for unknown methods
+		return domain.ScopeActionPull
 	}
+}
-	// Extract repository name from URL path
+// extractRepoName extracts the repository name from a registry path.
-	// Paths are like /v2/{name}/manifests/{reference} or /v2/{name}/blobs/{digest}
+// Returns empty string if the path is not a valid registry path or should be allowed.
-	path := r.URL.Path
+func extractRepoName(path string) (repoName string, shouldAllow bool) {
 	if !strings.HasPrefix(path, "/v2/") {
-		// Not a registry path, allow
+		return "", true // Not a registry path, allow
-		return true
 	}
-	// Remove /v2/ prefix and find repository name
 	pathParts := strings.Split(strings.TrimPrefix(path, "/v2/"), "/")
 	if len(pathParts) < 2 {
-		// Malformed path or /v2/ root, allow
+		return "", true // Malformed path or /v2/ root, allow
-		return true
 	}
 	// Find the boundary between repo name and route (manifests, blobs, tags)
 		}
 	}
 	if len(repoNameParts) == 0 {
-		// Could be a special route like /v2/token, allow
+		return "", true // Special route like /v2/token, allow
-		return true
 	}
-	repoName := strings.Join(repoNameParts, "/")
+	return strings.Join(repoNameParts, "/"), false
+}
+// checkScopeAccess verifies the token has permission for the requested operation.
+// Maps HTTP method to registry action and checks if any token scope grants access.
+func checkScopeAccess(r *http.Request, claims *domain.TokenClaims, log zerowrap.Logger) bool {
+	action := actionFromMethod(r.Method)
+	repoName, shouldAllow := extractRepoName(r.URL.Path)
+	if shouldAllow {
+		return true
+	}
 	// Check if any token scope grants access
 	for _, scopeStr := range claims.Scopes {
+		// Handle simple scopes (e.g., "push", "pull") for backwards compatibility
+		if scopeStr == action || scopeStr == "*" {
+			log.Debug().
+				Str("repo", repoName).
+				Str("action", action).
+				Str("scope", scopeStr).
+				Msg("simple scope access granted")
+			return true
+		}
+		// Handle Docker v2 format scopes (e.g., "repository:myrepo:push,pull")
 		scope, err := domain.ParseScope(scopeStr)
 		if err != nil {
-			log.Debug().Err(err).Str("scope", scopeStr).Msg("failed to parse scope")
 			continue
 		}

M internal/adapters/out/tokenstore/pass.go +66 -6


@@ -8,6 +8,7 @@ import (
8	8		"os/exec"
9	9		"regexp"
10	10		"strings"
	11	+	"sync"
11	12		"time"
12	13
13	14		"github.com/bnema/zerowrap"

@@ -25,17 +26,31 @@ const (
25	26		passRevokedPath = "gordon/registry/revoked"
26	27		)
27	28
	29	+	// cachedToken holds a token and its JWT in memory.
	30	+	type cachedToken struct {
	31	+	jwt string
	32	+	token *domain.Token
	33	+	}
	34	+
28	35		// PassStore implements TokenStore using the pass password manager.
29	36		type PassStore struct {
30	37		timeout time.Duration
31	38		log zerowrap.Logger
	39	+
	40	+	// In-memory cache to avoid repeated pass calls
	41	+	cacheMu sync.RWMutex
	42	+	tokenCache map[string]*cachedToken // keyed by subject
	43	+	revokedList []string // cached revocation list
	44	+	revokedSet map[string]struct{} // for O(1) lookup
32	45		}
33	46
34	47		// NewPassStore creates a new pass-based token store.
35	48		func NewPassStore(log zerowrap.Logger) *PassStore {
36	49		return &PassStore{
37		-	timeout: 10 * time.Second,
38		-	log: log,
	50	+	timeout: 10 * time.Second,
	51	+	log: log,
	52	+	tokenCache: make(map[string]*cachedToken),
	53	+	revokedSet: make(map[string]struct{}),
39	54		}
40	55		}
41	56

@@ -79,6 +94,11 @@ func (s PassStore) SaveToken(ctx context.Context, token domain.Token, jwt stri
79	94		return fmt.Errorf("failed to store token metadata: %w", err)
80	95		}
81	96
	97	+	// Update cache
	98	+	s.cacheMu.Lock()
	99	+	s.tokenCache[token.Subject] = &cachedToken{jwt: jwt, token: token}
	100	+	s.cacheMu.Unlock()
	101	+
82	102		s.log.Debug().
83	103		Str(zerowrap.FieldLayer, "adapter").
84	104		Str(zerowrap.FieldAdapter, "tokenstore").

@@ -91,6 +111,14 @@ func (s PassStore) SaveToken(ctx context.Context, token domain.Token, jwt stri
91	111
92	112		// GetToken retrieves token JWT by subject from pass.
93	113		func (s PassStore) GetToken(ctx context.Context, subject string) (string, domain.Token, error) {
	114	+	// Check cache first
	115	+	s.cacheMu.RLock()
	116	+	if cached, ok := s.tokenCache[subject]; ok {
	117	+	s.cacheMu.RUnlock()
	118	+	return cached.jwt, cached.token, nil
	119	+	}
	120	+	s.cacheMu.RUnlock()
	121	+
94	122		ctx, cancel := context.WithTimeout(ctx, s.timeout)
95	123		defer cancel()
96	124

@@ -122,6 +150,11 @@ func (s PassStore) GetToken(ctx context.Context, subject string) (string, doma
122	150		Revoked: meta.Revoked,
123	151		}
124	152
	153	+	// Cache the token
	154	+	s.cacheMu.Lock()
	155	+	s.tokenCache[subject] = &cachedToken{jwt: jwt, token: token}
	156	+	s.cacheMu.Unlock()
	157	+
125	158		return jwt, token, nil
126	159		}
127	160

@@ -206,6 +239,15 @@ func (s *PassStore) Revoke(ctx context.Context, tokenID string) error {
206	239		return fmt.Errorf("failed to store revocation list: %w", err)
207	240		}
208	241
	242	+	// Update cache
	243	+	s.cacheMu.Lock()
	244	+	s.revokedList = revokedList
	245	+	s.revokedSet = make(map[string]struct{}, len(revokedList))
	246	+	for _, id := range revokedList {
	247	+	s.revokedSet[id] = struct{}{}
	248	+	}
	249	+	s.cacheMu.Unlock()
	250	+
209	251		s.log.Info().
210	252		Str(zerowrap.FieldLayer, "adapter").
211	253		Str(zerowrap.FieldAdapter, "tokenstore").

@@ -217,6 +259,15 @@ func (s *PassStore) Revoke(ctx context.Context, tokenID string) error {
217	259
218	260		// IsRevoked checks if token ID is in revocation list.
219	261		func (s *PassStore) IsRevoked(ctx context.Context, tokenID string) (bool, error) {
	262	+	// Check cache first
	263	+	s.cacheMu.RLock()
	264	+	if s.revokedList != nil {
	265	+	_, revoked := s.revokedSet[tokenID]
	266	+	s.cacheMu.RUnlock()
	267	+	return revoked, nil
	268	+	}
	269	+	s.cacheMu.RUnlock()
	270	+
220	271		ctx, cancel := context.WithTimeout(ctx, s.timeout)
221	272		defer cancel()
222	273

@@ -225,13 +276,17 @@ func (s *PassStore) IsRevoked(ctx context.Context, tokenID string) (bool, error)
225	276		return false, err
226	277		}
227	278
	279	+	// Cache the revocation list
	280	+	s.cacheMu.Lock()
	281	+	s.revokedList = revokedList
	282	+	s.revokedSet = make(map[string]struct{}, len(revokedList))
228	283		for _, id := range revokedList {
229		-	if id == tokenID {
230		-	return true, nil
231		-	}
	284	+	s.revokedSet[id] = struct{}{}
232	285		}
	286	+	_, revoked := s.revokedSet[tokenID]
	287	+	s.cacheMu.Unlock()
233	288
234		-	return false, nil
	289	+	return revoked, nil
235	290		}
236	291
237	292		// DeleteToken removes token from pass.

@@ -256,6 +311,11 @@ func (s *PassStore) DeleteToken(ctx context.Context, subject string) error {
256	311		s.log.Warn().Err(err).Msg("failed to delete token metadata")
257	312		}
258	313
	314	+	// Clear from cache
	315	+	s.cacheMu.Lock()
	316	+	delete(s.tokenCache, subject)
	317	+	s.cacheMu.Unlock()
	318	+
259	319		s.log.Debug().
260	320		Str(zerowrap.FieldLayer, "adapter").
261	321		Str(zerowrap.FieldAdapter, "tokenstore").

 	"os/exec"
 	"regexp"
 	"strings"
+	"sync"
 	"time"
 	"github.com/bnema/zerowrap"
 	passRevokedPath = "gordon/registry/revoked"
 )
+// cachedToken holds a token and its JWT in memory.
+type cachedToken struct {
+	jwt   string
+	token *domain.Token
+}
 // PassStore implements TokenStore using the pass password manager.
 type PassStore struct {
 	timeout time.Duration
 	log     zerowrap.Logger
+	// In-memory cache to avoid repeated pass calls
+	cacheMu     sync.RWMutex
+	tokenCache  map[string]*cachedToken // keyed by subject
+	revokedList []string                // cached revocation list
+	revokedSet  map[string]struct{}     // for O(1) lookup
 }
 // NewPassStore creates a new pass-based token store.
 func NewPassStore(log zerowrap.Logger) *PassStore {
 	return &PassStore{
-		timeout: 10 * time.Second,
+		timeout:    10 * time.Second,
-		log:     log,
+		log:        log,
+		tokenCache: make(map[string]*cachedToken),
+		revokedSet: make(map[string]struct{}),
 	}
 }
 		return fmt.Errorf("failed to store token metadata: %w", err)
 	}
+	// Update cache
+	s.cacheMu.Lock()
+	s.tokenCache[token.Subject] = &cachedToken{jwt: jwt, token: token}
+	s.cacheMu.Unlock()
 	s.log.Debug().
 		Str(zerowrap.FieldLayer, "adapter").
 		Str(zerowrap.FieldAdapter, "tokenstore").
 // GetToken retrieves token JWT by subject from pass.
 func (s *PassStore) GetToken(ctx context.Context, subject string) (string, *domain.Token, error) {
+	// Check cache first
+	s.cacheMu.RLock()
+	if cached, ok := s.tokenCache[subject]; ok {
+		s.cacheMu.RUnlock()
+		return cached.jwt, cached.token, nil
+	}
+	s.cacheMu.RUnlock()
 	ctx, cancel := context.WithTimeout(ctx, s.timeout)
 	defer cancel()
 		Revoked:   meta.Revoked,
 	}
+	// Cache the token
+	s.cacheMu.Lock()
+	s.tokenCache[subject] = &cachedToken{jwt: jwt, token: token}
+	s.cacheMu.Unlock()
 	return jwt, token, nil
 }
 		return fmt.Errorf("failed to store revocation list: %w", err)
 	}
+	// Update cache
+	s.cacheMu.Lock()
+	s.revokedList = revokedList
+	s.revokedSet = make(map[string]struct{}, len(revokedList))
+	for _, id := range revokedList {
+		s.revokedSet[id] = struct{}{}
+	}
+	s.cacheMu.Unlock()
 	s.log.Info().
 		Str(zerowrap.FieldLayer, "adapter").
 		Str(zerowrap.FieldAdapter, "tokenstore").
 // IsRevoked checks if token ID is in revocation list.
 func (s *PassStore) IsRevoked(ctx context.Context, tokenID string) (bool, error) {
+	// Check cache first
+	s.cacheMu.RLock()
+	if s.revokedList != nil {
+		_, revoked := s.revokedSet[tokenID]
+		s.cacheMu.RUnlock()
+		return revoked, nil
+	}
+	s.cacheMu.RUnlock()
 	ctx, cancel := context.WithTimeout(ctx, s.timeout)
 	defer cancel()
 		return false, err
 	}
+	// Cache the revocation list
+	s.cacheMu.Lock()
+	s.revokedList = revokedList
+	s.revokedSet = make(map[string]struct{}, len(revokedList))
 	for _, id := range revokedList {
-		if id == tokenID {
+		s.revokedSet[id] = struct{}{}
-			return true, nil
-		}
 	}
+	_, revoked := s.revokedSet[tokenID]
+	s.cacheMu.Unlock()
-	return false, nil
+	return revoked, nil
 }
 // DeleteToken removes token from pass.
 		s.log.Warn().Err(err).Msg("failed to delete token metadata")
 	}
+	// Clear from cache
+	s.cacheMu.Lock()
+	delete(s.tokenCache, subject)
+	s.cacheMu.Unlock()
 	s.log.Debug().
 		Str(zerowrap.FieldLayer, "adapter").
 		Str(zerowrap.FieldAdapter, "tokenstore").

A internal/adapters/out/tokenstore/pass_test.go +260 -0

@@ -0,0 +1,260 @@
	1	+	package tokenstore
	2	+
	3	+	import (
	4	+	"context"
	5	+	"sync"
	6	+	"testing"
	7	+	"time"
	8	+
	9	+	"github.com/stretchr/testify/assert"
	10	+	"github.com/stretchr/testify/require"
	11	+
	12	+	"gordon/internal/domain"
	13	+	)
	14	+
	15	+	// These tests verify the in-memory caching behavior of PassStore.
	16	+	// They directly manipulate the cache to test cache hit/miss logic
	17	+	// without requiring the actual pass binary.
	18	+
	19	+	func newTestPassStore() *PassStore {
	20	+	return &PassStore{
	21	+	timeout: 10 * time.Second,
	22	+	tokenCache: make(map[string]*cachedToken),
	23	+	revokedSet: make(map[string]struct{}),
	24	+	}
	25	+	}
	26	+
	27	+	func TestPassStore_GetToken_CacheHit(t *testing.T) {
	28	+	store := newTestPassStore()
	29	+
	30	+	// Pre-populate cache
	31	+	expectedToken := &domain.Token{
	32	+	ID: "test-id",
	33	+	Subject: "test-subject",
	34	+	Scopes: []string{"push", "pull"},
	35	+	IssuedAt: time.Now(),
	36	+	ExpiresAt: time.Now().Add(24 * time.Hour),
	37	+	}
	38	+	expectedJWT := "cached-jwt-token"
	39	+
	40	+	store.cacheMu.Lock()
	41	+	store.tokenCache["test-subject"] = &cachedToken{
	42	+	jwt: expectedJWT,
	43	+	token: expectedToken,
	44	+	}
	45	+	store.cacheMu.Unlock()
	46	+
	47	+	// Should return cached value without calling pass
	48	+	jwt, token, err := store.GetToken(context.Background(), "test-subject")
	49	+
	50	+	require.NoError(t, err)
	51	+	assert.Equal(t, expectedJWT, jwt)
	52	+	assert.Equal(t, expectedToken.ID, token.ID)
	53	+	assert.Equal(t, expectedToken.Subject, token.Subject)
	54	+	assert.Equal(t, expectedToken.Scopes, token.Scopes)
	55	+	}
	56	+
	57	+	func TestPassStore_GetToken_CacheMiss_ReturnsNotFound(t *testing.T) {
	58	+	store := newTestPassStore()
	59	+
	60	+	// Cache miss should try to call pass (which will fail in test env)
	61	+	_, _, err := store.GetToken(context.Background(), "nonexistent")
	62	+
	63	+	// Should return ErrTokenNotFound since pass won't have this token
	64	+	assert.ErrorIs(t, err, domain.ErrTokenNotFound)
	65	+	}
	66	+
	67	+	func TestPassStore_IsRevoked_CacheHit_Revoked(t *testing.T) {
	68	+	store := newTestPassStore()
	69	+
	70	+	// Pre-populate revocation cache
	71	+	store.cacheMu.Lock()
	72	+	store.revokedList = []string{"revoked-token-1", "revoked-token-2"}
	73	+	store.revokedSet = map[string]struct{}{
	74	+	"revoked-token-1": {},
	75	+	"revoked-token-2": {},
	76	+	}
	77	+	store.cacheMu.Unlock()
	78	+
	79	+	// Check revoked token
	80	+	revoked, err := store.IsRevoked(context.Background(), "revoked-token-1")
	81	+	require.NoError(t, err)
	82	+	assert.True(t, revoked)
	83	+	}
	84	+
	85	+	func TestPassStore_IsRevoked_CacheHit_NotRevoked(t *testing.T) {
	86	+	store := newTestPassStore()
	87	+
	88	+	// Pre-populate revocation cache with some revoked tokens
	89	+	store.cacheMu.Lock()
	90	+	store.revokedList = []string{"revoked-token-1"}
	91	+	store.revokedSet = map[string]struct{}{
	92	+	"revoked-token-1": {},
	93	+	}
	94	+	store.cacheMu.Unlock()
	95	+
	96	+	// Check non-revoked token (cache is populated, so no pass call)
	97	+	revoked, err := store.IsRevoked(context.Background(), "valid-token")
	98	+	require.NoError(t, err)
	99	+	assert.False(t, revoked)
	100	+	}
	101	+
	102	+	func TestPassStore_CacheUpdate_OnSave(t *testing.T) {
	103	+	store := newTestPassStore()
	104	+
	105	+	token := &domain.Token{
	106	+	ID: "new-token-id",
	107	+	Subject: "new-subject",
	108	+	Scopes: []string{"push"},
	109	+	IssuedAt: time.Now(),
	110	+	ExpiresAt: time.Now().Add(24 * time.Hour),
	111	+	}
	112	+	jwt := "new-jwt-token"
	113	+
	114	+	// Simulate what SaveToken does to the cache
	115	+	store.cacheMu.Lock()
	116	+	store.tokenCache[token.Subject] = &cachedToken{jwt: jwt, token: token}
	117	+	store.cacheMu.Unlock()
	118	+
	119	+	// Verify cache was updated - subsequent GetToken should hit cache
	120	+	gotJWT, gotToken, err := store.GetToken(context.Background(), "new-subject")
	121	+
	122	+	require.NoError(t, err)
	123	+	assert.Equal(t, jwt, gotJWT)
	124	+	assert.Equal(t, token.ID, gotToken.ID)
	125	+	}
	126	+
	127	+	func TestPassStore_CacheClear_OnDelete(t *testing.T) {
	128	+	store := newTestPassStore()
	129	+
	130	+	// Pre-populate cache
	131	+	store.cacheMu.Lock()
	132	+	store.tokenCache["to-delete"] = &cachedToken{
	133	+	jwt: "some-jwt",
	134	+	token: &domain.Token{ID: "id", Subject: "to-delete"},
	135	+	}
	136	+	store.cacheMu.Unlock()
	137	+
	138	+	// Simulate what DeleteToken does to the cache
	139	+	store.cacheMu.Lock()
	140	+	delete(store.tokenCache, "to-delete")
	141	+	store.cacheMu.Unlock()
	142	+
	143	+	// Verify cache entry was removed
	144	+	store.cacheMu.RLock()
	145	+	_, ok := store.tokenCache["to-delete"]
	146	+	store.cacheMu.RUnlock()
	147	+
	148	+	assert.False(t, ok)
	149	+	}
	150	+
	151	+	func TestPassStore_GetToken_ConcurrentAccess(t *testing.T) {
	152	+	store := newTestPassStore()
	153	+
	154	+	// Pre-populate cache
	155	+	expectedToken := &domain.Token{
	156	+	ID: "concurrent-id",
	157	+	Subject: "concurrent-subject",
	158	+	Scopes: []string{"push", "pull"},
	159	+	}
	160	+	expectedJWT := "concurrent-jwt"
	161	+
	162	+	store.cacheMu.Lock()
	163	+	store.tokenCache["concurrent-subject"] = &cachedToken{
	164	+	jwt: expectedJWT,
	165	+	token: expectedToken,
	166	+	}
	167	+	store.cacheMu.Unlock()
	168	+
	169	+	// Simulate concurrent access (like Docker buildx parallel requests)
	170	+	var wg sync.WaitGroup
	171	+	errors := make([]error, 0)
	172	+	var errMu sync.Mutex
	173	+
	174	+	for i := 0; i < 100; i++ {
	175	+	wg.Add(1)
	176	+	go func() {
	177	+	defer wg.Done()
	178	+	jwt, token, err := store.GetToken(context.Background(), "concurrent-subject")
	179	+	if err != nil {
	180	+	errMu.Lock()
	181	+	errors = append(errors, err)
	182	+	errMu.Unlock()
	183	+	return
	184	+	}
	185	+	if jwt != expectedJWT \|\| token.ID != expectedToken.ID {
	186	+	errMu.Lock()
	187	+	errors = append(errors, assert.AnError)
	188	+	errMu.Unlock()
	189	+	}
	190	+	}()
	191	+	}
	192	+
	193	+	wg.Wait()
	194	+	assert.Empty(t, errors, "concurrent access should not produce errors")
	195	+	}
	196	+
	197	+	func TestPassStore_IsRevoked_ConcurrentAccess(t *testing.T) {
	198	+	store := newTestPassStore()
	199	+
	200	+	// Pre-populate revocation cache
	201	+	store.cacheMu.Lock()
	202	+	store.revokedList = []string{"revoked-1"}
	203	+	store.revokedSet = map[string]struct{}{"revoked-1": {}}
	204	+	store.cacheMu.Unlock()
	205	+
	206	+	// Simulate concurrent access
	207	+	var wg sync.WaitGroup
	208	+	errors := make([]error, 0)
	209	+	var errMu sync.Mutex
	210	+
	211	+	for i := 0; i < 100; i++ {
	212	+	wg.Add(1)
	213	+	go func() {
	214	+	defer wg.Done()
	215	+	revoked, err := store.IsRevoked(context.Background(), "revoked-1")
	216	+	if err != nil {
	217	+	errMu.Lock()
	218	+	errors = append(errors, err)
	219	+	errMu.Unlock()
	220	+	return
	221	+	}
	222	+	if !revoked {
	223	+	errMu.Lock()
	224	+	errors = append(errors, assert.AnError)
	225	+	errMu.Unlock()
	226	+	}
	227	+	}()
	228	+	}
	229	+
	230	+	wg.Wait()
	231	+	assert.Empty(t, errors, "concurrent access should not produce errors")
	232	+	}
	233	+
	234	+	func TestPassStore_RevokeUpdatesCache(t *testing.T) {
	235	+	store := newTestPassStore()
	236	+
	237	+	// Initialize revocation cache with an older revoked token
	238	+	store.cacheMu.Lock()
	239	+	store.revokedList = []string{"oldly-revoked"}
	240	+	store.revokedSet = make(map[string]struct{})
	241	+	store.cacheMu.Unlock()
	242	+
	243	+	// Simulate what Revoke does to the cache
	244	+	tokenID := "newly-revoked"
	245	+	store.cacheMu.Lock()
	246	+	store.revokedList = append(store.revokedList, tokenID)
	247	+	store.revokedSet = make(map[string]struct{}, len(store.revokedList))
	248	+	for _, id := range store.revokedList {
	249	+	store.revokedSet[id] = struct{}{}
	250	+	}
	251	+	store.cacheMu.Unlock()
	252	+
	253	+	// Verify IsRevoked now returns true from cache
	254	+	revoked, err := store.IsRevoked(context.Background(), tokenID)
	255	+	require.NoError(t, err)
	256	+	assert.True(t, revoked)
	257	+	revoked, err = store.IsRevoked(context.Background(), "oldly-revoked")
	258	+	require.NoError(t, err)
	259	+	assert.True(t, revoked)
	260	+	}

@@ -0,0 +1,260 @@
	1	+	package tokenstore
	2	+
	3	+	import (
	4	+	"context"
	5	+	"sync"
	6	+	"testing"
	7	+	"time"
	8	+
	9	+	"github.com/stretchr/testify/assert"
	10	+	"github.com/stretchr/testify/require"
	11	+
	12	+	"gordon/internal/domain"
	13	+	)
	14	+
	15	+	// These tests verify the in-memory caching behavior of PassStore.
	16	+	// They directly manipulate the cache to test cache hit/miss logic
	17	+	// without requiring the actual pass binary.
	18	+
	19	+	func newTestPassStore() *PassStore {
	20	+	return &PassStore{
	21	+	timeout: 10 * time.Second,
	22	+	tokenCache: make(map[string]*cachedToken),
	23	+	revokedSet: make(map[string]struct{}),
	24	+	}
	25	+	}
	26	+
	27	+	func TestPassStore_GetToken_CacheHit(t *testing.T) {
	28	+	store := newTestPassStore()
	29	+
	30	+	// Pre-populate cache
	31	+	expectedToken := &domain.Token{
	32	+	ID: "test-id",
	33	+	Subject: "test-subject",
	34	+	Scopes: []string{"push", "pull"},
	35	+	IssuedAt: time.Now(),
	36	+	ExpiresAt: time.Now().Add(24 * time.Hour),
	37	+	}
	38	+	expectedJWT := "cached-jwt-token"
	39	+
	40	+	store.cacheMu.Lock()
	41	+	store.tokenCache["test-subject"] = &cachedToken{
	42	+	jwt: expectedJWT,
	43	+	token: expectedToken,
	44	+	}
	45	+	store.cacheMu.Unlock()
	46	+
	47	+	// Should return cached value without calling pass
	48	+	jwt, token, err := store.GetToken(context.Background(), "test-subject")
	49	+
	50	+	require.NoError(t, err)
	51	+	assert.Equal(t, expectedJWT, jwt)
	52	+	assert.Equal(t, expectedToken.ID, token.ID)
	53	+	assert.Equal(t, expectedToken.Subject, token.Subject)
	54	+	assert.Equal(t, expectedToken.Scopes, token.Scopes)
	55	+	}
	56	+
	57	+	func TestPassStore_GetToken_CacheMiss_ReturnsNotFound(t *testing.T) {
	58	+	store := newTestPassStore()
	59	+
	60	+	// Cache miss should try to call pass (which will fail in test env)
	61	+	_, _, err := store.GetToken(context.Background(), "nonexistent")
	62	+
	63	+	// Should return ErrTokenNotFound since pass won't have this token
	64	+	assert.ErrorIs(t, err, domain.ErrTokenNotFound)
	65	+	}
	66	+
	67	+	func TestPassStore_IsRevoked_CacheHit_Revoked(t *testing.T) {
	68	+	store := newTestPassStore()
	69	+
	70	+	// Pre-populate revocation cache
	71	+	store.cacheMu.Lock()
	72	+	store.revokedList = []string{"revoked-token-1", "revoked-token-2"}
	73	+	store.revokedSet = map[string]struct{}{
	74	+	"revoked-token-1": {},
	75	+	"revoked-token-2": {},
	76	+	}
	77	+	store.cacheMu.Unlock()
	78	+
	79	+	// Check revoked token
	80	+	revoked, err := store.IsRevoked(context.Background(), "revoked-token-1")
	81	+	require.NoError(t, err)
	82	+	assert.True(t, revoked)
	83	+	}
	84	+
	85	+	func TestPassStore_IsRevoked_CacheHit_NotRevoked(t *testing.T) {
	86	+	store := newTestPassStore()
	87	+
	88	+	// Pre-populate revocation cache with some revoked tokens
	89	+	store.cacheMu.Lock()
	90	+	store.revokedList = []string{"revoked-token-1"}
	91	+	store.revokedSet = map[string]struct{}{
	92	+	"revoked-token-1": {},
	93	+	}
	94	+	store.cacheMu.Unlock()
	95	+
	96	+	// Check non-revoked token (cache is populated, so no pass call)
	97	+	revoked, err := store.IsRevoked(context.Background(), "valid-token")
	98	+	require.NoError(t, err)
	99	+	assert.False(t, revoked)
	100	+	}
	101	+
	102	+	func TestPassStore_CacheUpdate_OnSave(t *testing.T) {
	103	+	store := newTestPassStore()
	104	+
	105	+	token := &domain.Token{
	106	+	ID: "new-token-id",
	107	+	Subject: "new-subject",
	108	+	Scopes: []string{"push"},
	109	+	IssuedAt: time.Now(),
	110	+	ExpiresAt: time.Now().Add(24 * time.Hour),
	111	+	}
	112	+	jwt := "new-jwt-token"
	113	+
	114	+	// Simulate what SaveToken does to the cache
	115	+	store.cacheMu.Lock()
	116	+	store.tokenCache[token.Subject] = &cachedToken{jwt: jwt, token: token}
	117	+	store.cacheMu.Unlock()
	118	+
	119	+	// Verify cache was updated - subsequent GetToken should hit cache
	120	+	gotJWT, gotToken, err := store.GetToken(context.Background(), "new-subject")
	121	+
	122	+	require.NoError(t, err)
	123	+	assert.Equal(t, jwt, gotJWT)
	124	+	assert.Equal(t, token.ID, gotToken.ID)
	125	+	}
	126	+
	127	+	func TestPassStore_CacheClear_OnDelete(t *testing.T) {
	128	+	store := newTestPassStore()
	129	+
	130	+	// Pre-populate cache
	131	+	store.cacheMu.Lock()
	132	+	store.tokenCache["to-delete"] = &cachedToken{
	133	+	jwt: "some-jwt",
	134	+	token: &domain.Token{ID: "id", Subject: "to-delete"},
	135	+	}
	136	+	store.cacheMu.Unlock()
	137	+
	138	+	// Simulate what DeleteToken does to the cache
	139	+	store.cacheMu.Lock()
	140	+	delete(store.tokenCache, "to-delete")
	141	+	store.cacheMu.Unlock()
	142	+
	143	+	// Verify cache entry was removed
	144	+	store.cacheMu.RLock()
	145	+	_, ok := store.tokenCache["to-delete"]
	146	+	store.cacheMu.RUnlock()
	147	+
	148	+	assert.False(t, ok)
	149	+	}
	150	+
	151	+	func TestPassStore_GetToken_ConcurrentAccess(t *testing.T) {
	152	+	store := newTestPassStore()
	153	+
	154	+	// Pre-populate cache
	155	+	expectedToken := &domain.Token{
	156	+	ID: "concurrent-id",
	157	+	Subject: "concurrent-subject",
	158	+	Scopes: []string{"push", "pull"},
	159	+	}
	160	+	expectedJWT := "concurrent-jwt"
	161	+
	162	+	store.cacheMu.Lock()
	163	+	store.tokenCache["concurrent-subject"] = &cachedToken{
	164	+	jwt: expectedJWT,
	165	+	token: expectedToken,
	166	+	}
	167	+	store.cacheMu.Unlock()
	168	+
	169	+	// Simulate concurrent access (like Docker buildx parallel requests)
	170	+	var wg sync.WaitGroup
	171	+	errors := make([]error, 0)
	172	+	var errMu sync.Mutex
	173	+
	174	+	for i := 0; i < 100; i++ {
	175	+	wg.Add(1)
	176	+	go func() {
	177	+	defer wg.Done()
	178	+	jwt, token, err := store.GetToken(context.Background(), "concurrent-subject")
	179	+	if err != nil {
	180	+	errMu.Lock()
	181	+	errors = append(errors, err)
	182	+	errMu.Unlock()
	183	+	return
	184	+	}
	185	+	if jwt != expectedJWT \|\| token.ID != expectedToken.ID {
	186	+	errMu.Lock()
	187	+	errors = append(errors, assert.AnError)
	188	+	errMu.Unlock()
	189	+	}
	190	+	}()
	191	+	}
	192	+
	193	+	wg.Wait()
	194	+	assert.Empty(t, errors, "concurrent access should not produce errors")
	195	+	}
	196	+
	197	+	func TestPassStore_IsRevoked_ConcurrentAccess(t *testing.T) {
	198	+	store := newTestPassStore()
	199	+
	200	+	// Pre-populate revocation cache
	201	+	store.cacheMu.Lock()
	202	+	store.revokedList = []string{"revoked-1"}
	203	+	store.revokedSet = map[string]struct{}{"revoked-1": {}}
	204	+	store.cacheMu.Unlock()
	205	+
	206	+	// Simulate concurrent access
	207	+	var wg sync.WaitGroup
	208	+	errors := make([]error, 0)
	209	+	var errMu sync.Mutex
	210	+
	211	+	for i := 0; i < 100; i++ {
	212	+	wg.Add(1)
	213	+	go func() {
	214	+	defer wg.Done()
	215	+	revoked, err := store.IsRevoked(context.Background(), "revoked-1")
	216	+	if err != nil {
	217	+	errMu.Lock()
	218	+	errors = append(errors, err)
	219	+	errMu.Unlock()
	220	+	return
	221	+	}
	222	+	if !revoked {
	223	+	errMu.Lock()
	224	+	errors = append(errors, assert.AnError)
	225	+	errMu.Unlock()
	226	+	}
	227	+	}()
	228	+	}
	229	+
	230	+	wg.Wait()
	231	+	assert.Empty(t, errors, "concurrent access should not produce errors")
	232	+	}
	233	+
	234	+	func TestPassStore_RevokeUpdatesCache(t *testing.T) {
	235	+	store := newTestPassStore()
	236	+
	237	+	// Initialize revocation cache with an older revoked token
	238	+	store.cacheMu.Lock()
	239	+	store.revokedList = []string{"oldly-revoked"}
	240	+	store.revokedSet = make(map[string]struct{})
	241	+	store.cacheMu.Unlock()
	242	+
	243	+	// Simulate what Revoke does to the cache
	244	+	tokenID := "newly-revoked"
	245	+	store.cacheMu.Lock()
	246	+	store.revokedList = append(store.revokedList, tokenID)
	247	+	store.revokedSet = make(map[string]struct{}, len(store.revokedList))
	248	+	for _, id := range store.revokedList {
	249	+	store.revokedSet[id] = struct{}{}
	250	+	}
	251	+	store.cacheMu.Unlock()
	252	+
	253	+	// Verify IsRevoked now returns true from cache
	254	+	revoked, err := store.IsRevoked(context.Background(), tokenID)
	255	+	require.NoError(t, err)
	256	+	assert.True(t, revoked)
	257	+	revoked, err = store.IsRevoked(context.Background(), "oldly-revoked")
	258	+	require.NoError(t, err)
	259	+	assert.True(t, revoked)
	260	+	}