mirror of
https://github.com/stablyai/orca.git
synced 2026-10-30 16:47:34 +00:00
Jinwoo Hong
7ce15106f3
* fix(relay): keep verifying host tokens from the last served keys while auth is down jose refetches the relay JWKS once its cache is 10 min old and rejects the token when that fetch fails, so an auth outage turned every still-valid host token into a 4401. The cell now falls back to the last set auth served for up to an hour, skips refetching for 30 s after a failure, and still rejects any key that set never had. A fresh set replaces it as soon as auth answers, so a rotation takes effect at the first successful fetch. * fix(relay): bound stale relay keys at 30 min and document the emergency purge Thirty minutes still covers a full auth outage (no token the stale keys could accept outlives ~16 min of one) and halves how long a rotated-out key stays trusted on a cell kept from auth. A restarted process holds no set and refuses host tokens until a fetch succeeds; the ops doc names that as the purge after a signing-key leak, and a test pins the fail-closed start. * test(relay): pin the 30 min stale relay key bound (29 min accepts, 31 min rejects)