Auto-merged main into fix/gmail-settings-scopes on deployment.

Rhys Sullivan committed 2 months ago

Commit e77e09c2 parents 46cea2c c0d25e42 files · +23 −1Browse files

Unified · Split

2 files

apps/cloud/src/auth/jwks-cache.ts +14 −1
apps/cloud/src/auth/workos.ts +9 −0

     blockingFetchCount: number;
     storeHitCount: number;
     lastFetchDurationMs: number | null;
+    /** Wall-clock of the last cross-isolate store read (I/O). */
+    lastStoreReadMs: number | null;
+    /** Wall-clock of the last key resolution — WebCrypto `importKey`. */
+    lastResolveMs: number | null;
   };
 }
   let blockingFetchCount = 0;
   let storeHitCount = 0;
   let lastFetchDurationMs: number | null = null;
+  let lastStoreReadMs: number | null = null;
+  let lastResolveMs: number | null = null;
   const isFresh = (candidate: CacheEntry): boolean => Date.now() - candidate.fetchedAt < ttlMs;
   const isUsable = (candidate: CacheEntry): boolean =>
     if (!store) return null;
     // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: the L2 store is an optimization; any failure degrades to an upstream fetch
     try {
+      const storeReadStartedAt = Date.now();
       const stored = await store.get(url);
+      lastStoreReadMs = Date.now() - storeReadStartedAt;
       if (!stored) return null;
       const candidate = entryFrom(stored);
       if (!isUsable(candidate)) return null;
     const current = await ensureFresh(false);
     // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: jose JWTVerifyGetKey retry path is defined by thrown resolver failures
     try {
-      return await current.resolver(protectedHeader, token);
+      const resolveStartedAt = Date.now();
+      const key = await current.resolver(protectedHeader, token);
+      lastResolveMs = Date.now() - resolveStartedAt;
+      return key;
     } catch (error) {
       // Likely cause: keys rotated upstream after our TTL window started, or
       // we answered from a stale entry. Refetch once and try again. Anything
       blockingFetchCount,
       storeHitCount,
       lastFetchDurationMs,
+      lastStoreReadMs,
+      lastResolveMs,
     }),
   });
   return result;

apps/cloud/src/auth/workos.ts+9−0

@@ -277,6 +277,15 @@ const verifySealedSessionLocally = ( · 276 unmodified lines
277	...(jwksAfter.lastFetchDurationMs === null	277	...(jwksAfter.lastFetchDurationMs === null
278	? {}	278	? {}
279	: { "jwks.last_fetch_ms": jwksAfter.lastFetchDurationMs }),	279	: { "jwks.last_fetch_ms": jwksAfter.lastFetchDurationMs }),
		280	// Splits the ~3.4s that sits inside jwt_verify with zero upstream
		281	// fetches: the cross-isolate store read (I/O) vs WebCrypto key
		282	// import vs the signature check itself.
		283	...(jwksAfter.lastStoreReadMs === null
		284	? {}
		285	: { "jwks.store_read_ms": jwksAfter.lastStoreReadMs }),
		286	...(jwksAfter.lastResolveMs === null
		287	? {}
		288	: { "jwks.key_resolve_ms": jwksAfter.lastResolveMs }),
280	});	289	});
281	}),	290	}),
282	);	291	);

Auto-merged main into fix/gmail-settings-scopes on deployment.

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code