auth_cache negative 缓存加上限防 DoS + relay/flared 删除重复 authenticateAccessToken 改用 agent 共享缓存版

Result: {"status":"keep","total_issues":8,"eslint_errors":0,"eslint_problems":0,"eslint_warnings":0,"golint_canonicalheader":0,"golint_errname":0,"golint_errorlint":1,"golint_exhaustive":0,"golint_forcetypeassert":0,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":0,"golint_recvcheck":1,"golint_test_testifylint":0,"golint_test_thelper":0,"golint_test_total":0,"golint_test_usetesting":0,"golint_total":8,"golint_usestdlibvars":0,"golint_vetx_total":0,"golint_wastedassign":0,"measure_s":76,"tsc_errors":0,"vitest_failed":0,"vitest_total":126}

internal/apps/openflare/agent/auth_cache.go

@@ -19,6 +19,8 @@ import (
 const (
 	agentTokenPositiveCacheTTL = 2 * time.Minute
 	agentTokenNegativeCacheTTL = 10 * time.Minute
+	// ponytail: 上限仅防未授权口伪造 token 撑爆内存；打满后放弃缓存（回退 DB 查询），行为不变
+	maxAgentTokenNegativeCacheEntries = 10_000
 )
 
 type cachedAgentNode struct {
@@ -118,9 +120,24 @@ func (c *accessTokenAuthCache) storeMissing(token string, expiresAt time.Time) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	delete(c.positive, token)
+	if len(c.negative) >= maxAgentTokenNegativeCacheEntries {
+		c.evictExpiredMissingLocked(c.now())
+		if len(c.negative) >= maxAgentTokenNegativeCacheEntries {
+			return // 缓存满：放弃缓存该 token，认证仍走 DB，仅防内存无限增长
+		}
+	}
 	c.negative[token] = expiresAt
 }
 
+// evictExpiredMissingLocked 清理已过期的 negative 条目，须持写锁调用。
+func (c *accessTokenAuthCache) evictExpiredMissingLocked(now time.Time) {
+	for token, expiresAt := range c.negative {
+		if now.After(expiresAt) {
+			delete(c.negative, token)
+		}
+	}
+}
+
 func (c *accessTokenAuthCache) reset() {
 	c.mu.Lock()
 	defer c.mu.Unlock()