Zoltan Kochan 3bca7ffd2b fix(pnpr): record a token's last use off the request path, at most once a minute (#17266) ...

Every token-authenticated request awaited an UPDATE of last_used_at before
the handler ran. With the libsql backend that is a round trip to the primary
even when an embedded replica answers the lookup locally, so a replica
removed almost none of the latency for authenticated traffic.

LastUsedWriter in pnpr-auth now owns the write. It skips the write while the
stored time, which the authenticating lookup already read, is under a minute
old; claims the interval per token in memory so a burst of concurrent
requests from one token writes once even before the first write lands or the
replica syncs it back; and runs the write in a spawned task the request never
waits for. Both middleware sites, bearer tokens and OCI tokens' parents, go
through it. GET /-/npm/v1/tokens therefore reports a last-used time accurate
to within a minute.

Related to https://github.com/pnpm/tasks/issues/194

2026-10-23 09:45:07 +02:00

..

src

fix(pnpr): record a token's last use off the request path, at most once a minute (#17266)

2026-10-23 09:45:07 +02:00

tests/fixtures

feat(pnpr): add oidc and keyless publishing (#14666)

2026-09-07 20:45:28 +02:00

Cargo.toml

fix(pnpr): gate server-only error variants behind server feature (#16972)

2026-10-18 14:45:10 +02:00