Revert "chore: Fix unbounded channel"

This reverts merge request !1952

Reverting this change. This was an unbuffered channel before, which does not mean "unbounded". The channel was effectively blocking until a receiver read the value.

quicktunnelauth/jwks.go

@@ -27,9 +27,6 @@ const (
 	quickTunnelAuthBrokerJWKSRefreshCooldown = time.Minute
 	// Three attempts allow one initial request and two transient-failure retries.
 	quickTunnelAuthBrokerJWKSMaxFetchAttempts = 3
-	// One pending notification is sufficient because the worker serializes
-	// refreshes and rechecks the cache before fetching.
-	quickTunnelAuthBrokerJWKSRefreshNotificationCapacity = 1
 	// Backoffs of 100ms and 200ms add at most 300ms within the five-second
 	// refresh budget while giving brief transient failures time to clear.
 	quickTunnelAuthBrokerJWKSInitialRetryBackoff = 100 * time.Millisecond
@@ -86,7 +83,7 @@ func NewQuickTunnelAuthAssertionValidator() (*QuickTunnelAuthAssertionValidator,
 		return nil, fmt.Errorf("parse Quick Tunnel authentication broker JWKS URL: %w", err)
 	}
 
-	workerCtx, cancelRefreshWorker := context.WithCancel(context.Background()) //nolint:gosec
+	workerCtx, cancelRefreshWorker := context.WithCancel(context.Background())
 	validator := &QuickTunnelAuthAssertionValidator{
 		jwksURL: *jwksURL,
 		httpClient: &http.Client{
@@ -96,7 +93,7 @@ func NewQuickTunnelAuthAssertionValidator() (*QuickTunnelAuthAssertionValidator,
 			},
 		},
 		now:                  time.Now,
-		refreshNotifications: make(chan quickTunnelAuthBrokerJWKSRefreshNotification, quickTunnelAuthBrokerJWKSRefreshNotificationCapacity),
+		refreshNotifications: make(chan quickTunnelAuthBrokerJWKSRefreshNotification),
 		cancelRefreshWorker:  cancelRefreshWorker,
 		refreshWorkerStopped: make(chan struct{}),
 	}
@@ -165,8 +162,6 @@ func (v *QuickTunnelAuthAssertionValidator) notifyJWKSRefresh(ctx context.Contex
 	select {
 	case err := <-notification.result:
 		return err
-	case <-v.refreshWorkerStopped:
-		return errQuickTunnelAuthBrokerJWKSRefreshWorkerStopped
 	case <-ctx.Done():
 		return ctx.Err()
 	}

quicktunnelauth/jwks_test.go

@@ -37,7 +37,6 @@ func TestNewQuickTunnelAuthAssertionValidator(t *testing.T) {
 	require.ErrorIs(t, validator.httpClient.CheckRedirect(nil, nil), http.ErrUseLastResponse)
 	require.NotNil(t, validator.now)
 	assert.Empty(t, validator.jwks.keySet.Keys)
-	assert.Equal(t, quickTunnelAuthBrokerJWKSRefreshNotificationCapacity, cap(validator.refreshNotifications))
 }
 
 func TestQuickTunnelAuthAssertionValidatorCloseStopsRefreshWorker(t *testing.T) {
@@ -53,27 +52,6 @@ func TestQuickTunnelAuthAssertionValidatorCloseStopsRefreshWorker(t *testing.T)
 	assert.Nil(t, key)
 }
 
-func TestQuickTunnelAuthAssertionValidatorQueuedRefreshObservesStoppedWorker(t *testing.T) {
-	t.Parallel()
-
-	validator := &QuickTunnelAuthAssertionValidator{
-		refreshNotifications: make(chan quickTunnelAuthBrokerJWKSRefreshNotification, quickTunnelAuthBrokerJWKSRefreshNotificationCapacity),
-		refreshWorkerStopped: make(chan struct{}),
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	refreshResult := make(chan error, 1)
-	go func() {
-		refreshResult <- validator.notifyJWKSRefresh(ctx, "test-key")
-	}()
-
-	require.Eventually(t, func() bool {
-		return len(validator.refreshNotifications) == quickTunnelAuthBrokerJWKSRefreshNotificationCapacity
-	}, time.Second, time.Millisecond)
-	close(validator.refreshWorkerStopped)
-	require.ErrorIs(t, <-refreshResult, errQuickTunnelAuthBrokerJWKSRefreshWorkerStopped)
-}
-
 func TestQuickTunnelAuthAssertionValidatorVerificationKeyCachesAndRefreshes(t *testing.T) {
 	t.Parallel()