[Feature] Improve Session Handling

CHANGELOG.md

@@ -13,6 +13,7 @@
 - (Bugfix) Enable Platform Operator on EE Chart
 - (Feature) Improve GRPC JSON Handling
 - (Bugfix) Fix Operator Pod Resources
+- (Feature) Improve Session & Route Handling
 
 ## [1.3.0](https://github.com/arangodb/kube-arangodb/tree/1.3.0) (2025-08-01)
 - (Feature) (Platform) Storage Debug

integrations/envoy/auth/v3/impl/auth_custom/openid/impl.go

@@ -329,6 +329,10 @@ func (i *impl) handleOpenIDAuthentication(ctx context.Context, request *pbEnvoyA
 				},
 			})
 
+			if _, err := i.session.Invalidate(ctx, cookie.Value); err != nil {
+				return err
+			}
+
 			continue
 		}
 
@@ -355,20 +359,31 @@ func (i *impl) handleOpenIDAuthentication(ctx context.Context, request *pbEnvoyA
 				continue
 			}
 
-			session, cookie, err := i.handleOpenIDRefresh(ctx, cfg, ocfg, session)
+			session, ok, _, err := i.session.Refresh(ctx, cookie.Value)
 			if err != nil {
 				return err
 			}
 
-			current.User = session.AsResponse()
+			if ok {
+				newSession, newCookie, err := i.handleOpenIDRefresh(ctx, cfg, ocfg, session)
+				if err != nil {
+					return err
+				}
 
-			if cookie != nil {
-				current.ResponseHeaders = append(current.ResponseHeaders, &pbEnvoyCoreV3.HeaderValueOption{
-					Header: &pbEnvoyCoreV3.HeaderValue{
-						Key:   "Set-Cookie",
-						Value: cookie.String(),
-					},
-				})
+				current.User = newSession.AsResponse()
+
+				if newCookie != nil {
+					current.ResponseHeaders = append(current.ResponseHeaders, &pbEnvoyCoreV3.HeaderValueOption{
+						Header: &pbEnvoyCoreV3.HeaderValue{
+							Key:   "Set-Cookie",
+							Value: newCookie.String(),
+						},
+					})
+				}
+
+				if _, err := i.session.Invalidate(ctx, cookie.Value); err != nil {
+					return err
+				}
 			}
 
 			continue

integrations/envoy/auth/v3/impl/session/session.go

@@ -38,7 +38,7 @@ import (
 func NewManager[T any](ctx context.Context, t Type, client cache.Object[arangodb.Collection]) Manager[T] {
 	return manager[T]{
 		t:     t,
-		cache: cache.NewRemoteCache[*session](client),
+		cache: cache.NewRemoteCacheWithTTL[*session](client, 5*time.Second),
 	}
 }
 
@@ -47,6 +47,8 @@ type Manager[T any] interface {
 
 	Get(ctx context.Context, key string) (T, bool, time.Duration, error)
 
+	Refresh(ctx context.Context, key string) (T, bool, time.Duration, error)
+
 	Invalidate(ctx context.Context, key string) (bool, error)
 }
 
@@ -55,6 +57,12 @@ type manager[T any] struct {
 	cache cache.RemoteCache[*session]
 }
 
+func (m manager[T]) Refresh(ctx context.Context, key string) (T, bool, time.Duration, error) {
+	m.cache.Invalidate(ctx, key)
+
+	return m.Get(ctx, key)
+}
+
 func (m manager[T]) Put(ctx context.Context, expires time.Time, obj T) (string, error) {
 	data, err := sharedApi.NewAny(obj)
 	if err != nil {

integrations/shared/v1/definition/errors.proto

@@ -0,0 +1,40 @@
+//
+// DISCLAIMER
+//
+// Copyright 2024 ArangoDB GmbH, Cologne, Germany
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Copyright holder is ArangoDB GmbH, Cologne, Germany
+//
+
+syntax = "proto3";
+
+package shared;
+
+option go_package = "github.com/arangodb/kube-arangodb/integrations/shared/v1/definition";
+
+// Path Error Details
+message PathError {
+  // Path
+  string path = 1;
+  // Message
+  string message = 2;
+}
+
+// Path Error Details
+message Error {
+  // Message
+  string message = 1;
+}
+

pkg/apis/shared/errors.go

@@ -24,6 +24,7 @@ import (
 	"fmt"
 	"io"
 
+	pbSharedV1 "github.com/arangodb/kube-arangodb/integrations/shared/v1/definition"
 	"github.com/arangodb/kube-arangodb/pkg/util/errors"
 )
 
@@ -32,6 +33,13 @@ type ResourceError struct {
 	Err    error
 }
 
+func (p ResourceError) AsGRPCError() *pbSharedV1.PathError {
+	return &pbSharedV1.PathError{
+		Path:    p.Prefix,
+		Message: p.Err.Error(),
+	}
+}
+
 // Error return string representation of error
 func (p ResourceError) Error() string {
 	return fmt.Sprintf("%s: %s", p.Prefix, p.Err.Error())