Address code review feedback: single-flight JWK cache and add future-maintainer comment

Agent-Logs-Url: https://github.com/geturbackend/urBackend/sessions/b448bc8a-7b88-4981-bd67-1b8225e6973c

Co-authored-by: yash-pouranik <172860064+yash-pouranik@users.noreply.github.com>

Author: Copilot

apps/dashboard-api/src/controllers/project.controller.js

@@ -1345,6 +1345,8 @@ module.exports.toggleAuth = async (req, res) => {
 
     // Ensure user owns project, and load authProviders secrets so sanitizeAuthProviders
     // can correctly compute hasClientSecret in the response.
+    // NOTE: If new OAuth providers are added to SOCIAL_PROVIDER_KEYS, extend this select list
+    // to include their clientSecret fields as well.
     const project = await Project.findOne({
       _id: projectId,
       owner: req.user._id,

apps/public-api/src/controllers/userAuth.controller.js

@@ -75,11 +75,13 @@ const toBase64UrlBuffer = (input) => Buffer.from(input.replace(/-/g, '+').replac
 /**
  * In-memory cache for Google's public JWK keys.
  * Keys are refreshed when the cache expires (based on Cache-Control max-age).
+ * An in-flight promise is stored to prevent redundant concurrent fetches (single-flight).
  */
-const googleJwkCache = { keys: null, expiresAt: 0 };
+const googleJwkCache = { keys: null, expiresAt: 0, inflight: null };
 
 /**
  * Fetches Google's public JWK keys, using an in-memory cache keyed by Cache-Control max-age.
+ * Uses a single-flight pattern so that concurrent requests share one fetch instead of many.
  * @returns {Promise<Array>} Array of JWK key objects
  */
 const getGooglePublicKeys = async () => {
@@ -88,25 +90,38 @@ const getGooglePublicKeys = async () => {
         return googleJwkCache.keys;
     }
 
-    const certsResponse = await fetch('https://www.googleapis.com/oauth2/v3/certs');
-    if (!certsResponse.ok) {
-        throw new Error('Unable to fetch Google JWK keys');
+    // Single-flight: reuse in-flight promise if a fetch is already in progress.
+    if (googleJwkCache.inflight) {
+        return googleJwkCache.inflight;
     }
 
-    const certsPayload = await certsResponse.json();
-    const keys = certsPayload.keys || [];
+    googleJwkCache.inflight = (async () => {
+        try {
+            const certsResponse = await fetch('https://www.googleapis.com/oauth2/v3/certs');
+            if (!certsResponse.ok) {
+                throw new Error('Unable to fetch Google JWK keys');
+            }
+
+            const certsPayload = await certsResponse.json();
+            const keys = certsPayload.keys || [];
 
-    // Parse Cache-Control max-age from response headers to determine TTL.
-    const cacheControl = (typeof certsResponse.headers?.get === 'function')
-        ? (certsResponse.headers.get('cache-control') || '')
-        : '';
-    const maxAgeMatch = cacheControl.match(/max-age=(\d+)/);
-    const ttlMs = maxAgeMatch ? parseInt(maxAgeMatch[1], 10) * 1000 : 3600 * 1000;
+            // Parse Cache-Control max-age from response headers to determine TTL.
+            const cacheControl = (typeof certsResponse.headers?.get === 'function')
+                ? (certsResponse.headers.get('cache-control') || '')
+                : '';
+            const maxAgeMatch = cacheControl.match(/max-age=(\d+)/);
+            const ttlMs = maxAgeMatch ? parseInt(maxAgeMatch[1], 10) * 1000 : 3600 * 1000;
 
-    googleJwkCache.keys = keys;
-    googleJwkCache.expiresAt = now + ttlMs;
+            googleJwkCache.keys = keys;
+            googleJwkCache.expiresAt = Date.now() + ttlMs;
+
+            return keys;
+        } finally {
+            googleJwkCache.inflight = null;
+        }
+    })();
 
-    return keys;
+    return googleJwkCache.inflight;
 };
 
 /**