fix(invocation-plane): guard bearer credentials Close with sync.Once

[mesutoezdil]

TL;DR

BearerTokenCredentials.Close closed watcherDone unconditionally, so a second Close panicked with close of closed channel. Added a sync.Once guard to both the grpc-proxy and ratelimiter copies plus a TestCloseTwice in each package. go build and go test pass; the new tests panic without the fix.

Issues

Closes #301

Summary by CodeRabbit

• Bug Fixes

  • Improved shutdown handling for bearer-token credentials.
  • Repeated cleanup calls no longer cause errors or application panics.

• Tests

  • Added coverage confirming credentials can be closed multiple times safely.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0bf0b5e8-8d73-4573-a5fa-01cf7cf6fd61

📥 Commits

Reviewing files that changed from the base of the PR and between 404cf85 and c334d89.

📒 Files selected for processing (4)

• src/invocation-plane-services/grpc-proxy/proxy/credentials/bearer.go
• src/invocation-plane-services/grpc-proxy/proxy/credentials/bearer_test.go
• src/invocation-plane-services/ratelimiter/credentials/bearer.go
• src/invocation-plane-services/ratelimiter/credentials/bearer_test.go

🚧 Files skipped from review as they are similar to previous changes (4)

• src/invocation-plane-services/ratelimiter/credentials/bearer_test.go
• src/invocation-plane-services/grpc-proxy/proxy/credentials/bearer_test.go
• src/invocation-plane-services/ratelimiter/credentials/bearer.go
• src/invocation-plane-services/grpc-proxy/proxy/credentials/bearer.go

---

📝 Walkthrough

Walkthrough

Bearer credential shutdown in the gRPC proxy and rate limiter now uses sync.Once to make Close() safe for repeated calls. New tests verify that closing credentials twice returns no error.

Changes

Bearer credential close safety

Layer / File(s)	Summary
Guard watcher shutdown src/invocation-plane-services/grpc-proxy/proxy/credentials/bearer.go, src/invocation-plane-services/ratelimiter/credentials/bearer.go	Both credential implementations add a sync.Once guard and close watcherDone only once.
Validate repeated Close calls src/invocation-plane-services/grpc-proxy/proxy/credentials/bearer_test.go, src/invocation-plane-services/ratelimiter/credentials/bearer_test.go	New tests construct temporary credentials and verify that calling Close() twice returns no error.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: balajinvda

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title concisely describes the main change: guarding bearer credential Close with sync.Once.
Linked Issues check	✅ Passed	The PR fixes the double-Close panic by adding sync.Once guards and tests in both requested packages.
Out of Scope Changes check	✅ Passed	The changes stay within the requested Close panic fix and related tests, with no unrelated scope added.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

_{Comment @coderabbitai help to get the list of available commands.}

[balajinvda]

LGTM — sync.Once guard correctly fixes the double-Close panic (#301); tests added in both credential packages. CI green.

[balajinvda]

🎉 This PR is included in version nvcf-grpc-proxy-v1.30.3 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[balajinvda]

🎉 This PR is included in version nvcf-ratelimiter-v1.15.6 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀