Add tests for concurrent AccessControl store usage (#286)

* refactor(accesscontrol): use interface for AccessStore cache

* refactor(accesscontrol): early return when cache is disabled

* test(accesscontrol): add failing unit test

* test(accesscontrol): skip failing test

pkg/accesscontrol/access_store_test.go

@@ -3,7 +3,9 @@ package accesscontrol
 import (
 	"fmt"
 	"slices"
+	"sync"
 	"testing"
+	"time"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -274,6 +276,81 @@ func TestAccessStore_AccessFor(t *testing.T) {
 	}
 }
 
+type spyCache struct {
+	accessStoreCache
+
+	mu       sync.Mutex
+	setCalls map[any]int
+}
+
+func (c *spyCache) Add(k interface{}, v interface{}, ttl time.Duration) {
+	defer c.observeAdd(k)
+
+	time.Sleep(1 * time.Millisecond) // allow other routines to wake up, simulating heavy load
+	c.accessStoreCache.Add(k, v, ttl)
+}
+
+func (c *spyCache) observeAdd(k interface{}) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.setCalls == nil {
+		c.setCalls = make(map[any]int)
+	}
+	c.setCalls[k]++
+}
+
+func TestAccessStore_AccessFor_concurrent(t *testing.T) {
+	t.Skipf("TODO - Add a fix for this test")
+	testUser := &user.DefaultInfo{Name: "test-user"}
+	asCache := &spyCache{accessStoreCache: cache.NewLRUExpireCache(100)}
+	store := &AccessStore{
+		roles: roleRevisionsMock(func(ns, name string) string {
+			return fmt.Sprintf("%s%srev", ns, name)
+		}),
+		usersPolicyRules: &policyRulesMock{
+			getRBFunc: func(s string) []*rbacv1.RoleBinding {
+				return []*rbacv1.RoleBinding{
+					makeRB("testns", "testrb", testUser.Name, "testrole"),
+				}
+			},
+			getFunc: func(_ string) *AccessSet {
+				return &AccessSet{
+					set: map[key]resourceAccessSet{
+						{"get", corev1.Resource("ConfigMap")}: map[Access]bool{
+							{Namespace: All, ResourceName: All}: true,
+						},
+					},
+				}
+			},
+		},
+		cache: asCache,
+	}
+
+	const n = 5 // observation showed cases with up to 5 (or more) concurrent queries for the same user
+
+	wait := make(chan struct{})
+	var wg sync.WaitGroup
+	var id string
+	for range n {
+		wg.Add(1)
+		go func() {
+			<-wait
+			id = store.AccessFor(testUser).ID
+			wg.Done()
+		}()
+	}
+	close(wait)
+	wg.Wait()
+
+	if got, want := len(asCache.setCalls), 1; got != want {
+		t.Errorf("Unexpected number of cache entries: got %d, want %d", got, want)
+	}
+	if got, want := asCache.setCalls[id], 1; got != want {
+		t.Errorf("Unexpected number of calls to cache.Set(): got %d, want %d", got, want)
+	}
+}
+
 func makeRB(ns, name, user, role string) *rbacv1.RoleBinding {
 	return &rbacv1.RoleBinding{
 		ObjectMeta: metav1.ObjectMeta{Namespace: ns, Name: name},