Fix JWT token caching

// .NET 8+; server-side only. Register ONE instance per credential/audience
// as a singleton, so the cache survives individual API requests.
using System;
using System.Net.Http;
using System.Net.Http.Json;
using System.Text.Json.Serialization;
using System.Threading;
using System.Threading.Tasks;

public sealed class VinqueryTokenCache
{
    private readonly IHttpClientFactory _clients;
    private readonly string _clientId, _clientSecret, _audience;
    private readonly TimeProvider _clock;
    private readonly SemaphoreSlim _refreshLock = new(1, 1);
    private CachedToken? _cached;

    public VinqueryTokenCache(IHttpClientFactory clients, string clientId,
        string clientSecret, string audience, TimeProvider? clock = null)
    {
        if (string.IsNullOrWhiteSpace(clientId) || string.IsNullOrWhiteSpace(clientSecret)
            || string.IsNullOrWhiteSpace(audience))
            throw new ArgumentException("Client ID, client secret and audience are required.");
        _clients = clients;
        _clientId = clientId;
        _clientSecret = clientSecret;
        _audience = audience;
        _clock = clock ?? TimeProvider.System;
    }

    public async Task<string> GetTokenAsync(CancellationToken cancellationToken = default)
    {
        var cached = Volatile.Read(ref _cached);
        if (cached != null && _clock.GetUtcNow() < cached.RefreshAt) return cached.Token;

        await _refreshLock.WaitAsync(cancellationToken);
        try
        {
            // Another caller may have refreshed while this caller was waiting.
            cached = Volatile.Read(ref _cached);
            if (cached != null && _clock.GetUtcNow() < cached.RefreshAt) return cached.Token;

            using var client = _clients.CreateClient("VinqueryIdentity");
            using var response = await client.PostAsJsonAsync(
                "https://identity.vinquery.com/connect/token",
                new { clientId = _clientId, clientSecret = _clientSecret, audience = _audience },
                cancellationToken);
            response.EnsureSuccessStatusCode();
            var token = await response.Content.ReadFromJsonAsync<TokenResponse>(
                cancellationToken: cancellationToken);
            var now = _clock.GetUtcNow();
            if (token == null || string.IsNullOrWhiteSpace(token.JwtToken) || token.ExpiresUtc <= now)
                throw new InvalidOperationException("VINquery returned an empty token or invalid expiry.");

            var bufferSeconds = Math.Min(60, (token.ExpiresUtc - now).TotalSeconds * 0.1);
            Volatile.Write(ref _cached, new CachedToken(token.JwtToken,
                token.ExpiresUtc.AddSeconds(-bufferSeconds)));
            return token.JwtToken;
        }
        finally { _refreshLock.Release(); }
    }

    public void Invalidate(string rejectedToken)
    {
        var cached = Volatile.Read(ref _cached);
        if (cached?.Token == rejectedToken)
            Interlocked.CompareExchange(ref _cached, null, cached);
    }

    private sealed record CachedToken(string Token, DateTimeOffset RefreshAt);
    private sealed class TokenResponse
    {
        [JsonPropertyName("jwtToken")] public string JwtToken { get; set; } = "";
        [JsonPropertyName("expiresUtc")] public DateTimeOffset ExpiresUtc { get; set; }
    }
}

// Node.js 18+; server-side only. Create ONE provider per credential/audience
// at application startup, outside request handlers. Keep secrets in configuration.
export function createTokenProvider({ clientId, clientSecret, audience }) {
  if (!clientId || !clientSecret || !audience) {
    throw new Error("Client ID, client secret and audience are required.");
  }

  let cached = null;
  let refreshInFlight = null;

  async function requestToken() {
    const response = await fetch("https://identity.vinquery.com/connect/token", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ clientId, clientSecret, audience }),
      signal: AbortSignal.timeout(30_000)
    });
    if (!response.ok) {
      throw new Error(`VINquery token request failed (HTTP ${response.status}).`);
    }

    const result = await response.json();
    const expiresAt = Date.parse(result.expiresUtc);
    const now = Date.now();
    if (typeof result.jwtToken !== "string" || !result.jwtToken.trim()
        || !Number.isFinite(expiresAt) || expiresAt <= now) {
      throw new Error("VINquery returned an empty token or invalid expiry.");
    }

    // Normally renew one minute early; allow shorter token lifetimes too.
    const bufferMs = Math.min(60_000, (expiresAt - now) * 0.1);
    cached = { token: result.jwtToken, refreshAt: expiresAt - bufferMs };
    return cached.token;
  }

  async function getToken() {
    if (cached && Date.now() < cached.refreshAt) return cached.token;
    // All concurrent callers await the SAME token request.
    if (!refreshInFlight) {
      refreshInFlight = requestToken().finally(() => { refreshInFlight = null; });
    }
    return refreshInFlight;
  }

  function invalidate(rejectedToken) {
    // A late 401 for an old token must not remove a newer cached token.
    if (cached?.token === rejectedToken) cached = null;
  }

  return { getToken, invalidate };
}

<?php
declare(strict_types=1);

// PHP 8.2+ with ext-curl. For PHP-FPM/CGI workers on ONE server.
// Use a persistent LOCAL directory outside the web root, accessible only to
// the application OS account (0700 on Unix, equivalent Windows ACLs).
// Every request must use the same directory and this helper's file locking.
final class VinqueryTokenCache
{
    private string $cacheFile;
    private array $credentials;
    private Closure $fetch;
    private Closure $clock;

    public function __construct(string $clientId, string $clientSecret, string $audience, string $cacheDirectory)
    {
        if (trim($clientId) === '' || trim($clientSecret) === '' || trim($audience) === '') {
            throw new InvalidArgumentException('Client ID, client secret and audience are required.');
        }
        $directory = realpath($cacheDirectory);
        if ($directory === false || !is_dir($directory) || !is_writable($directory)) {
            throw new InvalidArgumentException('Create a private, writable cache directory first.');
        }
        $this->credentials = compact('clientId', 'clientSecret', 'audience');
        // Rotation or another audience gets a separate cache; no secrets in filenames.
        $key = hash('sha256', json_encode($this->credentials, JSON_THROW_ON_ERROR));
        $this->cacheFile = $directory . DIRECTORY_SEPARATOR . 'vinquery-' . $key . '.json';
        $this->fetch = fn(): array => $this->requestToken();
        $this->clock = fn(): float => microtime(true);
    }

    public function getToken(): string
    {
        return $this->withCache(function (array &$cached): string {
            $now = ($this->clock)();
            if (is_string($cached['token'] ?? null) && trim($cached['token']) !== ''
                && is_numeric($cached['refreshAt'] ?? null) && $now < $cached['refreshAt']) {
                return $cached['token'];
            }
            // This runs under the lock, after reading the latest saved cache.
            $result = ($this->fetch)();
            $token = $result['jwtToken'] ?? null;
            $rawExpiry = $result['expiresUtc'] ?? null;
            try {
                if (!is_string($rawExpiry) || !preg_match('/T.*(?:Z|[+-]\d{2}:\d{2})$/', $rawExpiry)) {
                    throw new RuntimeException();
                }
                $expires = new DateTimeImmutable($rawExpiry);
                $parseErrors = DateTimeImmutable::getLastErrors();
                if ($parseErrors !== false && ($parseErrors['warning_count'] || $parseErrors['error_count'])) {
                    throw new RuntimeException();
                }
                $expiresAt = (float)$expires->format('U.u');
            } catch (Exception $error) {
                throw new RuntimeException('VINquery returned an invalid expiry.');
            }
            $now = ($this->clock)();
            if (!is_string($token) || trim($token) === '' || $expiresAt <= $now) {
                throw new RuntimeException('VINquery returned an empty token or invalid expiry.');
            }
            $cached = ['token' => $token, 'refreshAt' => $expiresAt - min(60.0, ($expiresAt - $now) * 0.1)];
            return $token;
        });
    }

    public function invalidate(string $rejectedToken): void
    {
        $this->withCache(function (array &$cached) use ($rejectedToken): void {
            if (($cached['token'] ?? null) === $rejectedToken) $cached = [];
        });
    }

    private function withCache(Closure $action): mixed
    {
        $file = fopen($this->cacheFile, 'c+b'); // Do not truncate before locking.
        if ($file === false) throw new RuntimeException('Cannot open the private token cache.');
        try {
            if (PHP_OS_FAMILY !== 'Windows' && !chmod($this->cacheFile, 0600)) {
                throw new RuntimeException('Cannot restrict token cache permissions.');
            }
            $deadline = hrtime(true) + 35_000_000_000;
            while (!flock($file, LOCK_EX | LOCK_NB)) {
                if (hrtime(true) >= $deadline) throw new RuntimeException('Timed out waiting for token renewal.');
                usleep(10_000);
            }
            rewind($file);
            $stored = stream_get_contents($file);
            if ($stored === false) throw new RuntimeException('Cannot read the token cache.');
            $cached = json_decode($stored, true);
            $cached = is_array($cached) ? $cached : [];
            $before = $cached;
            $result = $action($cached);
            if ($cached !== $before) {
                $serialized = json_encode($cached, JSON_THROW_ON_ERROR);
                if (!rewind($file) || !ftruncate($file, 0)
                    || fwrite($file, $serialized) !== strlen($serialized) || !fflush($file)) {
                    throw new RuntimeException('Cannot save the token cache.');
                }
            }
            return $result;
        } finally {
            // Close releases the lock, including after HTTP/parse/write failures.
            fclose($file);
        }
    }

    private function requestToken(): array
    {
        $curl = curl_init('https://identity.vinquery.com/connect/token');
        if ($curl === false) throw new RuntimeException('Cannot initialize the token request.');
        try {
            curl_setopt_array($curl, [
                CURLOPT_POST => true,
                CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
                CURLOPT_POSTFIELDS => json_encode($this->credentials, JSON_THROW_ON_ERROR),
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_CONNECTTIMEOUT => 10,
                CURLOPT_TIMEOUT => 30,
            ]);
            $body = curl_exec($curl);
            $status = curl_getinfo($curl, CURLINFO_RESPONSE_CODE);
            if ($body === false || $status < 200 || $status >= 300) {
                throw new RuntimeException('VINquery token request failed (HTTP ' . $status . ').');
            }
            $result = json_decode($body, true);
            if (!is_array($result)) throw new RuntimeException('VINquery returned an invalid token response.');
            return $result;
        } finally {
            unset($curl); // Release the CurlHandle (PHP 8+).
        }
    }
}

"""Python 3.10+, standard library only. Server-side synchronous helper.
Create ONE TokenProvider per credential/audience at application startup.
"""
import json
import re
import threading
import time
from datetime import datetime
from urllib.error import HTTPError, URLError
from urllib.request import Request, urlopen


class TokenProvider:
    def __init__(self, client_id: str, client_secret: str, audience: str):
        if not all(isinstance(x, str) and x.strip()
                   for x in (client_id, client_secret, audience)):
            raise ValueError("Client ID, client secret and audience are required.")
        self._credentials = dict(clientId=client_id, clientSecret=client_secret,
                                 audience=audience)
        self._lock = threading.Lock()
        self._token = None
        self._refresh_at = 0.0

    def get_token(self) -> str:
        # Check AFTER acquiring the lock: waiting callers reuse the replacement.
        with self._lock:
            if self._token and time.time() < self._refresh_at:
                return self._token
            request = Request(
                "https://identity.vinquery.com/connect/token",
                data=json.dumps(self._credentials).encode("utf-8"),
                headers={"Content-Type": "application/json"}, method="POST")
            try:
                with urlopen(request, timeout=30) as response:
                    result = json.load(response)
            except HTTPError as error:
                status = error.code
                error.close()
                raise RuntimeError(f"VINquery token request failed (HTTP {status}).") from None
            except URLError:
                raise RuntimeError("VINquery token request failed.") from None
            except (ValueError, UnicodeError):
                raise RuntimeError("VINquery returned an invalid token response.") from None

            try:
                token = result["jwtToken"]
                # .NET can return seven fractional digits; Python 3.10 accepts
                # three or six. Truncate/pad to microseconds before parsing.
                raw_expiry = re.sub(r"\.(\d+)(?=Z$|[+-]\d{2}:\d{2}$)",
                                    lambda m: "." + m[1].ljust(6, "0")[:6], result["expiresUtc"])
                expiry = datetime.fromisoformat(raw_expiry.replace("Z", "+00:00"))
                now = time.time()
                expires_at = expiry.timestamp()
                if (not isinstance(token, str) or not token.strip()
                        or expiry.tzinfo is None or expires_at <= now):
                    raise ValueError()
            except (KeyError, TypeError, AttributeError, ValueError, OverflowError, OSError):
                raise RuntimeError("VINquery returned an empty token or invalid expiry.") from None

            self._token = token
            self._refresh_at = expires_at - min(60.0, (expires_at - now) * 0.1)
            return token

    def invalidate(self, rejected_token: str) -> None:
        with self._lock:
            # A late 401 for an old token must not remove a newer token.
            if self._token == rejected_token:
                self._token = None
                self._refresh_at = 0.0

Add this configuration to your application's package and constructor-inject VinqueryTokenCache into your existing service. A bean is shared within its Spring container by default. This example uses Jackson 2.x as described above.

import java.net.http.HttpClient;
import java.time.Duration;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;

@Configuration
class VinqueryConfiguration {
    @Bean
    VinqueryTokenCache vinqueryTokens(Environment env) {
        return new VinqueryTokenCache(
            HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(10)).build(),
            env.getRequiredProperty("VINQUERY_CLIENT_ID"),
            env.getRequiredProperty("VINQUERY_CLIENT_SECRET"),
            "vinquery:api:vindecode");
    }
}

// Java 11+ with Jackson 2.x databind. Server-side only.
// Keep ONE instance per credential/audience for the application's lifetime.
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.io.IOException;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Clock;
import java.time.Duration;
import java.time.OffsetDateTime;
import java.time.format.DateTimeParseException;
import java.util.Map;
import java.util.Objects;

public final class VinqueryTokenCache {
    private final HttpClient http;
    private final ObjectMapper json = new ObjectMapper();
    private final Map<String, String> credentials;
    private final Clock clock;
    private String token;
    private long refreshAt;

    public VinqueryTokenCache(HttpClient http, String clientId, String clientSecret, String audience) {
        this(http, clientId, clientSecret, audience, Clock.systemUTC());
    }

    // Package-private clock overload for offline tests.
    VinqueryTokenCache(HttpClient http, String clientId, String clientSecret, String audience, Clock clock) {
        for (String value : new String[] { clientId, clientSecret, audience }) {
            if (value == null || value.isBlank())
                throw new IllegalArgumentException("Client ID, client secret and audience are required.");
        }
        this.http = Objects.requireNonNull(http);
        this.clock = Objects.requireNonNull(clock);
        this.credentials = Map.of("clientId", clientId, "clientSecret", clientSecret, "audience", audience);
    }

    public synchronized String getToken() throws IOException, InterruptedException {
        // Check under the same lock used for renewal and invalidation.
        if (token != null && clock.millis() < refreshAt) return token;
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://identity.vinquery.com/connect/token"))
            .timeout(Duration.ofSeconds(30))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(json.writeValueAsString(credentials)))
            .build();
        HttpResponse<String> response = http.send(request, HttpResponse.BodyHandlers.ofString());
        if (response.statusCode() < 200 || response.statusCode() >= 300)
            throw new IOException("VINquery token request failed (HTTP " + response.statusCode() + ").");
        try {
            JsonNode result = json.readTree(response.body());
            if (result == null || !result.path("jwtToken").isTextual() || !result.path("expiresUtc").isTextual())
                throw new IllegalArgumentException();
            String replacement = result.path("jwtToken").textValue();
            long expiresAt = OffsetDateTime.parse(result.path("expiresUtc").textValue()).toInstant().toEpochMilli();
            long now = clock.millis();
            if (replacement.isBlank() || expiresAt <= now) throw new IllegalArgumentException();
            long buffer = Math.min(60_000L, (expiresAt - now) / 10);
            token = replacement;
            refreshAt = expiresAt - buffer;
            return token;
        } catch (IOException | IllegalArgumentException | DateTimeParseException | ArithmeticException error) {
            // Do not include response bodies (which can contain tokens) in errors.
            throw new IOException("VINquery returned an empty token or invalid expiry.");
        }
    }

    public synchronized void invalidate(String rejectedToken) {
        if (token != null && token.equals(rejectedToken)) {
            token = null;
            refreshAt = 0;
        }
    }
}

// Server-side Go, standard library only. Keep ONE *TokenProvider per
// credential/audience at startup. Do not copy the provider by value.
package vinquery

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"strings"
	"time"
)

type TokenProvider struct {
	http        *http.Client
	credentials map[string]string
	gate        chan struct{}
	now         func() time.Time
	token       string
	refreshAt   time.Time
}

func NewTokenProvider(client *http.Client, clientID, clientSecret, audience string) (*TokenProvider, error) {
	if strings.TrimSpace(clientID) == "" || strings.TrimSpace(clientSecret) == "" || strings.TrimSpace(audience) == "" {
		return nil, errors.New("client ID, client secret and audience are required")
	}
	if client == nil {
		client = &http.Client{Timeout: 30 * time.Second}
	}
	return &TokenProvider{
		http: client, credentials: map[string]string{"clientId": clientID, "clientSecret": clientSecret, "audience": audience},
		gate: make(chan struct{}, 1), now: time.Now,
	}, nil
}

func (p *TokenProvider) GetToken(ctx context.Context) (string, error) {
	// Waiting callers may cancel without interrupting another caller's renewal.
	select {
	case p.gate <- struct{}{}:
		defer func() { <-p.gate }()
	case <-ctx.Done():
		return "", ctx.Err()
	}
	if err := ctx.Err(); err != nil {
		return "", err
	}
	if p.token != "" && p.now().Before(p.refreshAt) {
		return p.token, nil
	}
	body, err := json.Marshal(p.credentials)
	if err != nil {
		return "", err
	}
	requestCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
	defer cancel()
	request, err := http.NewRequestWithContext(requestCtx, http.MethodPost,
		"https://identity.vinquery.com/connect/token", bytes.NewReader(body))
	if err != nil {
		return "", err
	}
	request.Header.Set("Content-Type", "application/json")
	response, err := p.http.Do(request)
	if err != nil {
		return "", errors.New("VINquery token request failed")
	}
	defer response.Body.Close()
	if response.StatusCode < 200 || response.StatusCode >= 300 {
		return "", fmt.Errorf("VINquery token request failed (HTTP %d)", response.StatusCode)
	}
	var result struct {
		Token   string    `json:"jwtToken"`
		Expires time.Time `json:"expiresUtc"`
	}
	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
		return "", errors.New("VINquery returned an invalid token response")
	}
	now := p.now()
	if strings.TrimSpace(result.Token) == "" || !result.Expires.After(now) {
		return "", errors.New("VINquery returned an empty token or invalid expiry")
	}
	buffer := result.Expires.Sub(now) / 10
	if buffer > time.Minute {
		buffer = time.Minute
	}
	p.token, p.refreshAt = result.Token, result.Expires.Add(-buffer)
	return p.token, nil
}

func (p *TokenProvider) Invalidate(rejectedToken string) {
	p.gate <- struct{}{}
	defer func() { <-p.gate }()
	if p.token == rejectedToken {
		p.token, p.refreshAt = "", time.Time{}
	}
}

// Server-side TypeScript with Node.js 22+ and DOM fetch types.
// Create ONE provider per credential/audience outside request handlers.
export interface TokenProviderOptions {
  clientId: string;
  clientSecret: string;
  audience: string;
}

export interface TokenProvider {
  getToken(): Promise<string>;
  invalidate(rejectedToken: string): void;
}

export function createTokenProvider({ clientId, clientSecret, audience }: TokenProviderOptions): TokenProvider {
  if (![clientId, clientSecret, audience].every(value => typeof value === "string" && value.trim())) {
    throw new Error("Client ID, client secret and audience are required.");
  }
  let cached: { token: string; refreshAt: number } | null = null;
  let refreshInFlight: Promise<string> | null = null;

  async function requestToken(): Promise<string> {
    const response = await fetch("https://identity.vinquery.com/connect/token", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ clientId, clientSecret, audience }),
      signal: AbortSignal.timeout(30_000)
    });
    if (!response.ok) {
      throw new Error(`VINquery token request failed (HTTP ${response.status}).`);
    }
    const result: unknown = await response.json();
    if (typeof result !== "object" || result === null) {
      throw new Error("VINquery returned an invalid token response.");
    }
    const { jwtToken, expiresUtc } = result as { jwtToken?: unknown; expiresUtc?: unknown };
    const expiresAt = typeof expiresUtc === "string" ? Date.parse(expiresUtc) : NaN;
    const now = Date.now();
    if (typeof jwtToken !== "string" || !jwtToken.trim()
        || !Number.isFinite(expiresAt) || expiresAt <= now) {
      throw new Error("VINquery returned an empty token or invalid expiry.");
    }
    cached = { token: jwtToken, refreshAt: expiresAt - Math.min(60_000, (expiresAt - now) * 0.1) };
    return cached.token;
  }

  async function getToken(): Promise<string> {
    if (cached && Date.now() < cached.refreshAt) return cached.token;
    if (!refreshInFlight) {
      refreshInFlight = requestToken().finally(() => { refreshInFlight = null; });
    }
    return refreshInFlight;
  }

  function invalidate(rejectedToken: string): void {
    if (cached?.token === rejectedToken) cached = null;
  }

  return { getToken, invalidate };
}