Address bot comments

Author: imogenkraak

gateway/middleware.go

@@ -439,15 +439,17 @@ func (t *BaseMiddleware) OrgSessionExpiry(orgid string) int64 {
 		return val
 	}
 
-	// Cache miss, start async refresh in background, return default immediately
-	go t.refreshOrgSessionExpiry(orgid)
+	// Cache miss
+	go orgSessionExpiryCache.Do(orgid, func() (interface{}, error) {
+		return t.refreshOrgSessionExpiry(orgid)
+	})
 
 	t.Logger().Debug("no cached entry found, returning 7 days (async refresh started)")
 	return DEFAULT_ORG_SESSION_EXPIRATION
 }
 
 // refreshOrgSessionExpiry fetches org session expiry in the background
-func (t *BaseMiddleware) refreshOrgSessionExpiry(orgid string) {
+func (t *BaseMiddleware) refreshOrgSessionExpiry(orgid string) (interface{}, error) {
 	defer func() {
 		if r := recover(); r != nil {
 			t.Logger().Errorf("Panic recovered during org session expiry refresh for org %s: %v", orgid, r)
@@ -458,10 +460,12 @@ func (t *BaseMiddleware) refreshOrgSessionExpiry(orgid string) {
 	if found && t.Spec.GlobalConfig.EnforceOrgDataAge {
 		t.Logger().Debug("Background refresh: setting data expiry for org: ", orgid)
 		t.SetOrgExpiry(orgid, s.DataExpires)
-	} else {
-		t.Logger().Debug("Background refresh: org session not found, setting default expiry")
-		t.SetOrgExpiry(orgid, DEFAULT_ORG_SESSION_EXPIRATION)
+		return s.DataExpires, nil
 	}
+
+	t.Logger().Debug("Background refresh: org session not found, setting default expiry")
+	t.SetOrgExpiry(orgid, DEFAULT_ORG_SESSION_EXPIRATION)
+	return DEFAULT_ORG_SESSION_EXPIRATION, nil
 }
 
 func (t *BaseMiddleware) UpdateRequestSession(r *http.Request) bool {

gateway/middleware_test.go

@@ -24,6 +24,8 @@ type mockStore struct {
 	SessionHandler
 	//DetailNotFound is used to make mocked SessionDetail return (x,false), as if it doesn't find the session in the mocked storage.
 	DetailNotFound bool
+	// Delay simulates a slow RPC call for timeout testing
+	Delay time.Duration
 }
 
 var sess = user.SessionState{
@@ -32,6 +34,9 @@ var sess = user.SessionState{
 }
 
 func (m mockStore) SessionDetail(orgID string, keyName string, hashed bool) (user.SessionState, bool) {
+	if m.Delay > 0 {
+		time.Sleep(m.Delay)
+	}
 	return sess.Clone(), !m.DetailNotFound
 }
 
@@ -642,4 +647,41 @@ func TestBaseMiddleware_OrgSession(t *testing.T) {
 			assert.NotEmpty(t, session.OrgID)
 		}
 	})
+
+	t.Run("should timeout when RPC call takes too long", func(t *testing.T) {
+		timeoutOrgID := "timeout-org-" + uuid.New()
+
+		slowMockStore := mockStore{
+			DetailNotFound: false,
+			Delay:          3 * time.Second,
+		}
+
+		specSlow := &APISpec{
+			GlobalConfig: config.Config{
+				EnforceOrgDataAge: true,
+				LocalSessionCache: config.LocalSessionCacheConf{
+					DisableCacheSessionState: false,
+				},
+			},
+			OrgSessionManager: slowMockStore,
+		}
+
+		baseMidSlow := &BaseMiddleware{
+			Spec:   specSlow,
+			Gw:     ts.Gw,
+			logger: mainLog,
+		}
+
+		start := time.Now()
+		session, found := baseMidSlow.fetchOrgSessionWithTimeout(timeoutOrgID)
+		elapsed := time.Since(start)
+
+		// Should timeout and return false
+		assert.False(t, found, "Should timeout and return false")
+		assert.Empty(t, session.OrgID, "Session should be empty on timeout")
+
+		// Should timeout around 2 seconds, not wait for the full 3 second delay
+		assert.Less(t, elapsed, 3*time.Second, "Should timeout before slow RPC completes")
+		assert.GreaterOrEqual(t, elapsed, 2*time.Second, "Should wait for timeout duration")
+	})
 }