add a user hash function to serve as ID

core/clustersmngr/factory.go

@@ -460,8 +460,8 @@ func (cf *clustersManager) UpdateUserNamespaces(ctx context.Context, user *auth.
 	wg.Wait()
 }
 
-func (cf *clustersManager) UserLock(userID string) *sync.Mutex {
-	actual, _ := cf.usersLock.LoadOrStore(userID, &sync.Mutex{})
+func (cf *clustersManager) UserLock(user *auth.UserPrincipal) *sync.Mutex {
+	actual, _ := cf.usersLock.LoadOrStore(user.Hash(), &sync.Mutex{})
 	lock := actual.(*sync.Mutex)
 	lock.Lock()
 	return lock
@@ -472,7 +472,7 @@ func (cf *clustersManager) GetUserNamespaces(user *auth.UserPrincipal) map[strin
 }
 
 func (cf *clustersManager) userNsList(ctx context.Context, user *auth.UserPrincipal) map[string][]v1.Namespace {
-	userLock := cf.UserLock(user.ID)
+	userLock := cf.UserLock(user)
 	defer userLock.Unlock()
 
 	userNamespaces := cf.GetUserNamespaces(user)

core/clustersmngr/factory_caches.go

@@ -151,5 +151,5 @@ func (un *UsersNamespaces) Clear() {
 }
 
 func (un UsersNamespaces) cacheKey(user *auth.UserPrincipal, cluster string) uint64 {
-	return ttlcache.StringKey(fmt.Sprintf("%s:%s", user.ID, cluster))
+	return ttlcache.StringKey(fmt.Sprintf("%s:%s", user.Hash(), cluster))
 }

pkg/server/auth/auth.go

@@ -98,6 +98,11 @@ func (p *UserPrincipal) String() string {
 	return fmt.Sprintf("id=%q groups=%v", p.ID, p.Groups)
 }
 
+// Hash returns a unique string using user id,token and groups.
+func (p *UserPrincipal) Hash() string {
+	return fmt.Sprintf("%s/%s/%v", p.ID, p.Token(), p.Groups)
+}
+
 func (p *UserPrincipal) Valid() bool {
 	if p.ID == "" && p.Token() == "" {
 		return false

pkg/server/auth/auth_test.go

@@ -331,7 +331,19 @@ func TestUserPrincipal_String(t *testing.T) {
 	// principal is logged out.
 	p := auth.NewUserPrincipal(auth.ID("testing"), auth.Groups([]string{"group1", "group2"}), auth.Token("test-token"))
 
-	if s := p.String(); s != `id="testing" groups=[group1 group2]` {
-		t.Fatalf("principal.String() got %s, want %s", s, `id="testing" groups=[group1 group2]`)
+	want := `id="testing" groups=[group1 group2]`
+	if s := p.String(); s != want {
+		t.Fatalf("principal.String() got %s, want %s", s, want)
+	}
+}
+
+func TestUserPrincipal_Hash(t *testing.T) {
+	// This is primarily to guard against leaking the auth token if the
+	// principal is logged out.
+	p := auth.NewUserPrincipal(auth.ID("testing"), auth.Groups([]string{"group1", "group2"}), auth.Token("test-token"))
+
+	want := "testing/test-token/[group1 group2]"
+	if s := p.Hash(); s != want {
+		t.Fatalf("principal.String() got %s, want %s", s, want)
 	}
 }