Закрыли часть проблем с безопасностью + мелкие починки

codebase/backend/api-backend/app/main.py

@@ -113,6 +113,21 @@ async def refresh_settings_cache(app: FastAPI) -> None:
         await asyncio.sleep(30)
 
 
+async def refresh_jwks_cache(app: FastAPI) -> None:
+    retry_delay = 5
+    refresh_delay = max(30, app.state.settings.jwks_cache_ttl_seconds)
+    delay = refresh_delay if app.state.jwks.has_keys else retry_delay
+    while True:
+        await asyncio.sleep(delay)
+        try:
+            await app.state.jwks.refresh()
+        except Exception:
+            log.warning("jwks.refresh_failed")
+            delay = retry_delay
+        else:
+            delay = refresh_delay
+
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     settings = get_settings()
@@ -142,12 +157,14 @@ async def lifespan(app: FastAPI):
         await app.state.jwks.refresh()
     except Exception:
         structlog.get_logger().warning("jwks.warmup_failed")
+    jwks_task = asyncio.create_task(refresh_jwks_cache(app))
     try:
         yield
     finally:
-        settings_task.cancel()
-        with suppress(asyncio.CancelledError):
-            await settings_task
+        for task in (settings_task, jwks_task):
+            task.cancel()
+            with suppress(asyncio.CancelledError):
+                await task
         await app.state.http.aclose()
         await app.state.redis.aclose()
         await app.state.redis_rt.aclose()
@@ -462,7 +479,7 @@ async def ready(request: Request, db: Session):
             components[name] = "ok"
         except Exception:
             components[name] = "failed"
-    components["jwks"] = "ok" if request.app.state.jwks._keys else "failed"
+    components["jwks"] = "ok" if request.app.state.jwks.has_keys else "failed"
     try:
         safety_response = await request.app.state.http.get(
             f"{str(request.app.state.settings.message_safety_url).rstrip('/')}/health/ready",