refactor(oidc): extract duplicate cache-update/refresh-scheduling into base class

containers/api-proxy/anthropic-oidc-token-provider.js

@@ -3,8 +3,6 @@
 const { mintGitHubOidcToken, httpPost } = require('./github-oidc');
 const {
   BaseOidcTokenProvider,
-  REFRESH_FACTOR,
-  MIN_REFRESH_MARGIN_SECS,
 } = require('./oidc-token-provider-base');
 
 /**
@@ -87,18 +85,7 @@ class AnthropicOidcTokenProvider extends BaseOidcTokenProvider {
 
     const { access_token, expires_in } = await this._exchangeForAnthropicToken(oidcJwt);
 
-    const now = Math.floor(Date.now() / 1000);
-    this._cachedToken = access_token;
-    this._expiresAt = now + expires_in;
-
-    const refreshInSecs = Math.max(
-      0,
-      Math.min(
-        expires_in * REFRESH_FACTOR,
-        expires_in - MIN_REFRESH_MARGIN_SECS
-      )
-    );
-    this._scheduleRefresh(Math.floor(refreshInSecs * 1000));
+    this._storeAndScheduleRefresh(access_token, expires_in);
   }
 
   async _doRefresh() {
@@ -109,6 +96,10 @@ class AnthropicOidcTokenProvider extends BaseOidcTokenProvider {
     return this._cachedToken;
   }
 
+  _setCachedValue(value) {
+    this._cachedToken = value;
+  }
+
   _getInitSuccessLogContext() {
     return {
       audience: this._oidcAudience,

containers/api-proxy/aws-oidc-token-provider.js

@@ -22,8 +22,6 @@
 const { mintGitHubOidcToken, httpGet } = require('./github-oidc');
 const {
   BaseOidcTokenProvider,
-  REFRESH_FACTOR,
-  MIN_REFRESH_MARGIN_SECS,
 } = require('./oidc-token-provider-base');
 
 /**
@@ -164,18 +162,7 @@ class AwsOidcTokenProvider extends BaseOidcTokenProvider {
 
     const { credentials, expires_in } = await this._assumeRoleWithWebIdentity(oidcJwt);
 
-    const now = Math.floor(Date.now() / 1000);
-    this._cachedCredentials = credentials;
-    this._expiresAt = now + expires_in;
-
-    const refreshInSecs = Math.max(
-      0,
-      Math.min(
-        expires_in * REFRESH_FACTOR,
-        expires_in - MIN_REFRESH_MARGIN_SECS
-      )
-    );
-    this._scheduleRefresh(Math.floor(refreshInSecs * 1000));
+    this._storeAndScheduleRefresh(credentials, expires_in);
   }
 
   async _doRefresh() {
@@ -186,6 +173,10 @@ class AwsOidcTokenProvider extends BaseOidcTokenProvider {
     return this._cachedCredentials;
   }
 
+  _setCachedValue(value) {
+    this._cachedCredentials = value;
+  }
+
   _getInitSuccessLogContext() {
     return {
       role_arn: this._roleArn,

containers/api-proxy/gcp-oidc-token-provider.js

@@ -18,8 +18,6 @@
 const { mintGitHubOidcToken, httpPost } = require('./github-oidc');
 const {
   BaseOidcTokenProvider,
-  REFRESH_FACTOR,
-  MIN_REFRESH_MARGIN_SECS,
 } = require('./oidc-token-provider-base');
 
 /**
@@ -158,18 +156,7 @@ class GcpOidcTokenProvider extends BaseOidcTokenProvider {
       expiresIn = federatedExpiresIn;
     }
 
-    const now = Math.floor(Date.now() / 1000);
-    this._cachedToken = accessToken;
-    this._expiresAt = now + expiresIn;
-
-    const refreshInSecs = Math.max(
-      0,
-      Math.min(
-        expiresIn * REFRESH_FACTOR,
-        expiresIn - MIN_REFRESH_MARGIN_SECS
-      )
-    );
-    this._scheduleRefresh(Math.floor(refreshInSecs * 1000));
+    this._storeAndScheduleRefresh(accessToken, expiresIn);
   }
 
   async _doRefresh() {
@@ -180,6 +167,10 @@ class GcpOidcTokenProvider extends BaseOidcTokenProvider {
     return this._cachedToken;
   }
 
+  _setCachedValue(value) {
+    this._cachedToken = value;
+  }
+
   _getInitSuccessLogContext() {
     return {
       workload_identity_provider: this._workloadIdentityProvider,

containers/api-proxy/oidc-token-provider-base.js

@@ -82,6 +82,26 @@ class BaseOidcTokenProvider {
     scheduleRefresh(this, delayMs, () => this._doRefresh(), this._providerPrefix);
   }
 
+  /**
+   * Store the new cached value, record expiry, and schedule the next refresh.
+   * @param {unknown} value - token string or credentials object to cache
+   * @param {number} expiresIn - token lifetime in seconds
+   */
+  _storeAndScheduleRefresh(value, expiresIn) {
+    const now = Math.floor(Date.now() / 1000);
+    this._setCachedValue(value);
+    this._expiresAt = now + expiresIn;
+
+    const refreshInSecs = Math.max(
+      0,
+      Math.min(
+        expiresIn * REFRESH_FACTOR,
+        expiresIn - MIN_REFRESH_MARGIN_SECS
+      )
+    );
+    this._scheduleRefresh(Math.floor(refreshInSecs * 1000));
+  }
+
   /** @param {number} ms */
   _sleep(ms) {
     return sleep(ms);
@@ -103,6 +123,14 @@ class BaseOidcTokenProvider {
     throw new Error('_getCachedValue() must be implemented by subclasses');
   }
 
+  /**
+   * @abstract
+   * @param {unknown} value
+   */
+  _setCachedValue(value) {
+    throw new Error('_setCachedValue() must be implemented by subclasses');
+  }
+
   /**
    * @abstract
    * @returns {Record<string, unknown>}

containers/api-proxy/oidc-token-provider.js

@@ -17,8 +17,6 @@
 const { mintGitHubOidcToken, httpPost } = require('./github-oidc');
 const {
   BaseOidcTokenProvider,
-  REFRESH_FACTOR,
-  MIN_REFRESH_MARGIN_SECS,
 } = require('./oidc-token-provider-base');
 
 /**
@@ -140,19 +138,7 @@ class OidcTokenProvider extends BaseOidcTokenProvider {
     const oidcJwt = await this._mintGitHubOidcToken();
     const { access_token, expires_in } = await this._exchangeForAzureToken(oidcJwt);
 
-    const now = Math.floor(Date.now() / 1000);
-    this._cachedToken = access_token;
-    this._expiresAt = now + expires_in;
-
-    // Schedule proactive refresh
-    const refreshInSecs = Math.max(
-      0,
-      Math.min(
-      expires_in * REFRESH_FACTOR,
-      expires_in - MIN_REFRESH_MARGIN_SECS
-      )
-    );
-    this._scheduleRefresh(Math.floor(refreshInSecs * 1000));
+    this._storeAndScheduleRefresh(access_token, expires_in);
   }
 
   /**
@@ -174,6 +160,10 @@ class OidcTokenProvider extends BaseOidcTokenProvider {
     return this._cachedToken;
   }
 
+  _setCachedValue(value) {
+    this._cachedToken = value;
+  }
+
   _getInitSuccessLogContext() {
     return {
       tenant_id: this._tenantId,