fix: updates jwx library to use its thread-safe jwks cache

[ctran88]

What's New?

Problem:
Our jwks cache was a map, so it is not thread safe.

If the passage.App struct was being called via passage.New in multiple threads, i.e. it is being initialized per request thread in an API server, then it would throw a fatal "concurrent map writes" error.

Solution:
Use a thread-safe data structure to cache the jwks.

Our existing jwt/jwks library, https://github.com/lestrrat-go/jwx, has its own thread-safe (via RW mutex) caching implementation that we can make use of by upgrading from v1 to v2.

Tests:
Adding and running this test on main will fail because it detects a race condition (concurrent writes to the jwkCache map variable). It will pass on this branch

go test -race -run TestAppJWKSCacheWriteConcurrency

WARNING: DATA RACE
Write at 0x00c0000013a8 by goroutine 9:
  github.com/passageidentity/passage-go.(*App).fetchJWKS()
      /Users/christran/repos/passage-go/authentication.go:70 +0x100
  github.com/passageidentity/passage-go.New()
      /Users/christran/repos/passage-go/app.go:41 +0x208
  github.com/passageidentity/passage-go_test.TestAppJWKSCacheWriteConcurrency.func1()
      /Users/christran/repos/passage-go/app_test.go:54 +0x138

Previous write at 0x00c0000013a8 by goroutine 8:
  github.com/passageidentity/passage-go.(*App).fetchJWKS()
      /Users/christran/repos/passage-go/authentication.go:70 +0x100
  github.com/passageidentity/passage-go.New()
      /Users/christran/repos/passage-go/app.go:41 +0x208
  github.com/passageidentity/passage-go_test.TestAppJWKSCacheWriteConcurrency.func1()
      /Users/christran/repos/passage-go/app_test.go:54 +0x138

Goroutine 9 (running) created at:
  github.com/passageidentity/passage-go_test.TestAppJWKSCacheWriteConcurrency()
      /Users/christran/repos/passage-go/app_test.go:51 +0x5c
  testing.tRunner()
      /usr/local/go/src/testing/testing.go:1689 +0x180
  testing.(*T).Run.gowrap1()
      /usr/local/go/src/testing/testing.go:1742 +0x40

Goroutine 8 (finished) created at:
  github.com/passageidentity/passage-go_test.TestAppJWKSCacheWriteConcurrency()
      /Users/christran/repos/passage-go/app_test.go:51 +0x5c
  testing.tRunner()
      /usr/local/go/src/testing/testing.go:1689 +0x180
  testing.(*T).Run.gowrap1()
      /usr/local/go/src/testing/testing.go:1742 +0x40
==================
--- FAIL: TestAppJWKSCacheWriteConcurrency (0.20s)
    testing.go:1398: race detected during execution of test
FAIL
exit status 1
FAIL	github.com/passageidentity/passage-go	0.812s

passage-go/app_test.go

Lines 52 to 70 in 795b803

	func TestAppJWKSCacheWriteConcurrency(t *testing.T) {
	goRoutineCount := 2
	var wg sync.WaitGroup
	wg.Add(goRoutineCount)
	for i := 0; i < goRoutineCount; i++ {
	go func() {
	defer wg.Done()
	_, err := passage.New(PassageAppID, &passage.Config{
	APIKey: PassageApiKey, // An API_KEY environment variable is required for testing.
	})
	require.Nil(t, err)
	}()
	}
	wg.Wait()
	}

References:

• jwk.Cache example
• jwk.Cache definition
• jwk.Cache's underlying cache store

Screenshots (if appropriate):

Please attach any screenshots that would help illustrate the changes.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have manually tested my code thoroughly
• I have added/updated inline documentation for public facing interfaces if relevant
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing integration and unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

Additional context

Add any other context or screenshots about the pull request here.

[bertrmz]

This link can perhaps be omitted, as the example is surfaced in the package's docs here.

But I'm also good with keeping it if it feels like a good point of reference.

[ctran88]

removed in 058e8d4

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud