+ // Check behavior on 5xx/network errors (don't cache) vs 4xx
+ // (do cache)
+ {
+ call := oidcAuthorizer.WrapCalls(func(ctx context.Context, opts interface{}) (interface{}, error) {
+ return nil, nil
+ })
+
+ // If fakeProvider UserInfo endpoint returns 502, we
+ // should fail, return an error, and *not* cache the
+ // negative result.
+ tokenCacheNegativeTTL = time.Minute
+ s.fakeProvider.UserInfoErrorStatus = 502
+ _, err := call(ctx, nil)
+ c.Check(err, check.NotNil)
+
+ // The negative result was not cached, so retrying
+ // immediately (with UserInfo working now) should
+ // succeed.
+ s.fakeProvider.UserInfoErrorStatus = 0
+ _, err = call(ctx, nil)
+ c.Check(err, check.IsNil)
+ checkTokenInDB()
+
+ cleanup()
+
+ // UserInfo 401 => cache the negative result, but
+ // don't return an error (just pass the token through
+ // as a v1 token)
+ s.fakeProvider.UserInfoErrorStatus = 401
+ _, err = call(ctx, nil)
+ c.Check(err, check.IsNil)
+ ent, ok := oidcAuthorizer.cache.Get(accessToken)
+ c.Check(ok, check.Equals, true)
+ c.Check(ent, check.FitsTypeOf, time.Time{})
+
+ // UserInfo succeeds now, but we still have a cached
+ // negative result.
+ s.fakeProvider.UserInfoErrorStatus = 0
+ _, err = call(ctx, nil)
+ c.Check(err, check.IsNil)
+ ent, ok = oidcAuthorizer.cache.Get(accessToken)
+ c.Check(ok, check.Equals, true)
+ c.Check(ent, check.FitsTypeOf, time.Time{})
+
+ tokenCacheNegativeTTL = time.Millisecond
+ cleanup()
+ }
+
+ var exp1 time.Time