[anabobillo3]

cupsOAuthGetUserId keeps the user ID for an access token in the OAuth store, keyed by the token's urn:token: URI. Refiled from GHSA-84cm-m3c6-56gp as a regular report, as asked there.

What it does now (master 5e60665):

• Key: oauth_make_path handles a urn:token: URI the way it handles an IPPS URI: it copies the text from offset 7 (en: and the token) into a 1024-byte buffer, cuts it at the first / and hashes the rest. So the key covers only the token up to its first /, and at most its first 1020 characters; two access tokens that agree up to there share one cached user ID.
• Lifetime: the user ID that cupsOAuthSaveTokens stores for an access token has no expiration time, and cupsOAuthGetUserId returns a cached value without checking one, so it is still returned after the access token's access_expires has passed. cupsOAuthClearTokens clears the user ID stored for the resource URI, not the one stored for the access token.
• userinfo: when nothing is cached, the userinfo_endpoint response is used whenever its JSON has no error member, whatever the HTTP status, and without a sub claim. The result is then not cached, since cupsJWTExportString returns NULL for the unsigned JWT and oauth_save_value takes NULL as a delete. The connection to the endpoint is not closed.

What this changes:

• oauth_make_path hashes the whole urn:token: URI.
• oauth_save_value takes an optional expiration time, written on a second line after the value. cupsOAuthSaveTokens uses it for the access token (instead of formatting it in a 16k buffer) and for the user ID it stores for the access token, with the access token's expiration time, otherwise five minutes (_CUPS_OAUTH_USERID_TIMEOUT); cupsOAuthGetUserId uses it for the user ID from the userinfo endpoint, with five minutes. cupsOAuthGetUserId uses a cached user ID only before that time and only with a sub claim; otherwise it removes it and asks the userinfo endpoint again. A user ID cached by an earlier version has no expiration time, so it is fetched again once.
• From the userinfo endpoint, only a 200 OK response with a sub claim is used. Its claims are cached as JSON (cupsJSONExportString) and made into a JWT again with cupsJWTNew when loaded. The connection is closed.
• The cupsOAuthGetUserId documentation says how long the user ID is cached.

Testing: checked offline with a private store: cupsOAuthGetUserId returns the cached user ID for its own access token, but no longer for a different token with the same text before its /, for a 1100-byte token that differs only in its last character, or once the access token has expired (without the oauth.c changes it returns the cached ID in those three cases). make test results are unchanged. As asked in the review, the PR adds no separate test of the caching code.

Assisted-by: Claude Code:claude-opus-5-5

[michaelrsweet]

Needs work, and I really don't want to add more (separate) tests of the caching code.

Will provide more feedback as time allows (dealing with a rather high volume of reports these days with no end in sight...)

[anabobillo3]

Thanks for taking a look. I've removed the separate cache test and the Makefile change, so the PR now only touches cups/oauth.c. Whenever you have time to say what else needs work, I'll update it.

[michaelrsweet]

OK, I think I want to extend oauth_save_value to accept a time_t argument that provides an (optional) value that is written on a second line - we do that in cupsOAuthSaveTokens already for the access token expiration time...

Otherwise I like your changes.

[anabobillo3]

Done: oauth_save_value now takes a time_t argument, and when it is non-zero it is written on a second line after the value. cupsOAuthSaveTokens uses it for the access token (so the temp buffer is gone) and for the user ID it saves for the access token, and cupsOAuthGetUserId uses it for the user ID it gets from the userinfo endpoint. oauth_save_user_id is removed, and the PR still only touches cups/oauth.c.

[michaelrsweet]

OK, largely taken as-is, but the oauth_make_path needed to retain the ipps: handling (HTTPS/IPPS equivalency) and I made some editorial changes:

[master ca531c0] Add expiration time to user_id cache (Issue #190)