[Feature] Add thread-safe token caching with auto-renewal for confidential clients

[mynameispathak]

Summary

This PR introduces enhanced token caching capabilities for confidential clients, providing thread-safe token storage with automatic renewal to improve performance and reduce unnecessary network requests.

Changes Made

New Features

• EnhancedClient: New client type with built-in token caching
• Thread-safe token cache: Concurrent access protection with sync.RWMutex
• Auto-renewal: Configurable renewal buffer (default: 2 minutes before expiry)
• Cache management: Methods for clearing, checking, and getting cache statistics

New Methods

• NewEnhancedClient() - Creates enhanced client with default settings
• NewEnhancedClientWithOptions() - Creates enhanced client with custom renewal buffer
• AcquireTokenByCredentialWithCaching() - Token acquisition with automatic caching
• ForceRefreshToken() - Force refresh and cache new token
• ClearTokenCache() - Clear all cached tokens
• IsTokenCached() - Check if valid token exists in cache
• GetCacheStats() - Get cache statistics

Implementation Details

• TokenCache: New internal package for token storage and management
• CachedTokenData: Structure storing token, expiry, scopes, and tenant info
• Thread safety: All cache operations protected with read/write locks
• Expiry handling: Proper token expiry tracking and validation

Benefits

• Performance: Reduces network calls by reusing valid cached tokens
• Thread safety: Safe for concurrent access from multiple goroutines
• Automatic renewal: Proactive token refresh before expiry
• Backward compatibility: Existing Client remains unchanged

Usage Example

// Create enhanced client
client, err := confidential.NewEnhancedClient(
    "https://login.microsoftonline.com/tenant",
    "client-id",
    credential,
)

// Acquire token with caching
result, err := client.AcquireTokenByCredentialWithCaching(
    ctx,
    []string{"https://graph.microsoft.com/.default"},
)

Testing

• Unit tests for cache operations
• Concurrent access testing
• Expiry validation testing
• Integration tests with real token acquisition

Related Issues

Closes #587

Breaking Changes

None - this is purely additive functionality.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mynameispathak]

@microsoft-github-policy-service agree company="Sprinklr"

[bgavrilMS]

Hi @mynameispathak , thanks for the PR. Today, MSAL Go caches tokens in memory, associated with each ConfidentialClientApplication object. What are you trying to achieve that you cannot do with MSAL Go today?

Note:

• We can add a "WithForceRefresh()" modifier, like other MSAL libs, but we would like to understand your scenario first.
• Tokens are refreshed at 5 min interval.

[bgavrilMS]

Not consistent with other MSALs

[4gust]

Hi @mynameispathak , apologies for the delayed response — I wanted to ensure I reviewed everything thoroughly.

Regarding issue #587, here are my thoughts:

1. Thread-safe caching:
   We already have thread-safe caching in place. I believe the confusion may come from the fact that AcquireTokenByCredential intentionally does not perform a cache lookup. For cache usage, AcquireTokenSilent should be used instead.

2. Automatic token renewal:
   This is also handled internally. A silent call (AcquireTokenSilent) will attempt to refresh the token when needed.
   The second point you raised relates to proactive token refresh — in some scenarios, the token will contain information indicating when the client should proactively refresh it.

3. Token reuse:
   AcquireTokenSilent will return a cached token when the parameters match, ensuring reuse.

4. Force refresh capability:
   If you want to bypass the cache and force a new token, AcquireTokenByCredential gives you that control.

5. Cache statistics:
   The client supports this via the WithCacheAccessor method, which accepts your custom cache implementation. You can run various statistics on the cache without requiring the client itself to handle the analysis.

6. As Bogdan mentioned that this does not consistent with other MSAL's

Lastly, regarding the issues you linked at the bottom in #587 — #569 and #570 — please note that these are related to Managed Identity, not Confidential Client. They don't share the same implementation.