From 11942d6756fb079c6bea1fb686c52dde61ddc4bc Mon Sep 17 00:00:00 2001
From: jay brown <jay.a.brown@gmail.com>
Date: Fri, 18 Apr 2025 12:29:02 -0700
Subject: [PATCH] pr changes

---
 internal/cognitoauth/jwks.go  | 9 +++++++--
 internal/cognitoauth/token.go | 4 +++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/internal/cognitoauth/jwks.go b/internal/cognitoauth/jwks.go
index 4f6cce10..21897edf 100644
--- a/internal/cognitoauth/jwks.go
+++ b/internal/cognitoauth/jwks.go
@@ -10,6 +10,11 @@ import (
 	"github.com/lestrrat-go/jwx/v2/jwk"
 )
 
+const (
+	JWKS_CACHE_TTL      = 24 * time.Hour
+	JWKS_CLIENT_TIMEOUT = 10 * time.Second
+)
+
 // GetJWKS returns the cached JWKS or fetches a new one if needed
 // This function implements caching logic to minimize external requests
 // Used during token validation to get the key set for signature verification
@@ -45,7 +50,7 @@ func GetJWKS(jwksURL string, logger *slog.Logger) (jwk.Set, error) {
 
 	jwksCache.KeySet = keySet
 	// Cache for 24 hours - you can adjust this based on your needs
-	jwksCache.ExpiresAt = time.Now().Add(24 * time.Hour)
+	jwksCache.ExpiresAt = time.Now().Add(JWKS_CACHE_TTL)
 
 	return keySet, nil
 }
@@ -54,7 +59,7 @@ func GetJWKS(jwksURL string, logger *slog.Logger) (jwk.Set, error) {
 // Used to get the public keys needed to verify token signatures
 // Makes an HTTP request to the JWKS URL and returns the raw JSON
 func fetchJWKS(jwksURL string) (string, error) {
-	client := &http.Client{Timeout: 10 * time.Second}
+	client := &http.Client{Timeout: JWKS_CLIENT_TIMEOUT}
 	req, err := http.NewRequest("GET", jwksURL, nil)
 	if err != nil {
 		return "", err
diff --git a/internal/cognitoauth/token.go b/internal/cognitoauth/token.go
index 3b37e924..ca447f4e 100644
--- a/internal/cognitoauth/token.go
+++ b/internal/cognitoauth/token.go
@@ -16,6 +16,8 @@ import (
 	"github.com/lestrrat-go/jwx/v2/jwt"
 )
 
+const PKCE_SESSION_TTL = 5 * time.Minute
+
 // verifyToken verifies the JWT token and returns its claims
 // Used during both OAuth callback and subsequent API requests with bearer token
 // Verifies signature, expiration, issuer, and other JWT claims
@@ -104,7 +106,7 @@ func storePKCESession(state, codeVerifier string, logger *slog.Logger) {
 	session := &PKCESession{
 		CodeVerifier: codeVerifier,
 		CreatedAt:    time.Now(),
-		ExpiresAt:    time.Now().Add(5 * time.Minute),
+		ExpiresAt:    time.Now().Add(PKCE_SESSION_TTL),
 	}
 
 	pkceSessionMap.sessions[state] = session