dedup key vault ref in preload stage

Author: linglingye001

src/appConfigurationImpl.ts

@@ -111,6 +111,7 @@ export class AzureAppConfigurationImpl implements AzureAppConfiguration {
     #secretReferences: ConfigurationSetting[] = []; // cached key vault references
     #secretRefreshTimer: RefreshTimer | undefined = undefined;
     #resolveSecretsInParallel: boolean = false;
+    #keyVaultAdapter: AzureKeyVaultKeyValueAdapter;
 
     /**
      * Selectors of key-values obtained from @see AzureAppConfigurationOptions.selectors
@@ -204,7 +205,8 @@ export class AzureAppConfigurationImpl implements AzureAppConfiguration {
             }
             this.#resolveSecretsInParallel = options.keyVaultOptions.parallelSecretResolutionEnabled ?? false;
         }
-        this.#adapters.push(new AzureKeyVaultKeyValueAdapter(options?.keyVaultOptions, this.#secretRefreshTimer));
+        this.#keyVaultAdapter = new AzureKeyVaultKeyValueAdapter(options?.keyVaultOptions, this.#secretRefreshTimer);
+        this.#adapters.push(this.#keyVaultAdapter);
         this.#adapters.push(new JsonKeyValueAdapter());
     }
 
@@ -715,6 +717,8 @@ export class AzureAppConfigurationImpl implements AzureAppConfiguration {
             return Promise.resolve(false);
         }
 
+        // Invalidate cached secret values so the refresh round re-fetches them from Key Vault.
+        this.#keyVaultAdapter.clearCache();
         await this.#resolveSecretReferences(this.#secretReferences, (key, value) => {
             this.#configMap.set(key, value);
         });
@@ -895,22 +899,30 @@ export class AzureAppConfigurationImpl implements AzureAppConfiguration {
 
     async #resolveSecretReferences(secretReferences: ConfigurationSetting[], resultHandler: (key: string, value: unknown) => void): Promise<void> {
         if (this.#resolveSecretsInParallel) {
-            const secretResolutionPromises: Promise<void>[] = [];
+            // Preload phase: resolve each unique secret exactly once, in parallel, to warm the cache.
+            // References that resolve to the same secret identifier are deduplicated so that only a
+            // single Key Vault request is issued per unique secret.
+            const seenSecretIds = new Set<string>();
+            const uniqueSecretReferences: ConfigurationSetting[] = [];
             for (const setting of secretReferences) {
-                const secretResolutionPromise = this.#processKeyValue(setting)
-                    .then(([key, value]) => {
-                        resultHandler(key, value);
-                    });
-                secretResolutionPromises.push(secretResolutionPromise);
+                const secretId = this.#keyVaultAdapter.getSecretReferenceId(setting);
+                if (secretId === undefined) {
+                    // The reference cannot be parsed; resolve it individually so the appropriate error
+                    // is surfaced when it is processed below.
+                    uniqueSecretReferences.push(setting);
+                } else if (!seenSecretIds.has(secretId)) {
+                    seenSecretIds.add(secretId);
+                    uniqueSecretReferences.push(setting);
+                }
             }
+            await Promise.all(uniqueSecretReferences.map(setting => this.#processKeyValue(setting)));
+        }
 
-            // Wait for all secret resolution promises to be resolved
-            await Promise.all(secretResolutionPromises);
-        } else {
-            for (const setting of secretReferences) {
-                const [key, value] = await this.#processKeyValue(setting);
-                resultHandler(key, value);
-            }
+        // Resolve every reference. In parallel mode the values are served from the warmed cache
+        // without any additional I/O.
+        for (const setting of secretReferences) {
+            const [key, value] = await this.#processKeyValue(setting);
+            resultHandler(key, value);
         }
     }
 

src/keyvault/keyVaultKeyValueAdapter.ts

@@ -49,6 +49,28 @@ export class AzureKeyVaultKeyValueAdapter implements IKeyValueAdapter {
         }
     }
 
+    /**
+     * Returns the normalized Key Vault secret identifier (sourceId) for a secret reference setting,
+     * or undefined if the reference cannot be parsed. Used to deduplicate references that resolve to
+     * the same secret before resolving them.
+     */
+    getSecretReferenceId(setting: ConfigurationSetting): string | undefined {
+        try {
+            return parseKeyVaultSecretIdentifier(
+                parseSecretReference(setting).value.secretId
+            ).sourceId;
+        } catch {
+            return undefined;
+        }
+    }
+
+    /**
+     * Clears the cached secret values, throttled by the minimum secret refresh interval.
+     */
+    clearCache(): void {
+        this.#keyVaultSecretProvider.clearCache();
+    }
+
     async onChangeDetected(): Promise<void> {
         this.#keyVaultSecretProvider.clearCache();
         return;

src/keyvault/keyVaultSecretProvider.ts

@@ -9,11 +9,9 @@ import { KeyVaultReferenceErrorMessages } from "../common/errorMessages.js";
 
 export class AzureKeyVaultSecretProvider {
     #keyVaultOptions: KeyVaultOptions | undefined;
-    #secretRefreshTimer: RefreshTimer | undefined;
     #minSecretRefreshTimer: RefreshTimer;
     #secretClients: Map<string, SecretClient>; // map key vault hostname to corresponding secret client
     #cachedSecretValues: Map<string, any> = new Map<string, any>(); // map secret identifier to secret value
-    #inflightRequests: Map<string, Promise<unknown>> = new Map<string, Promise<unknown>>(); // map secret identifier to in-flight Key Vault request
 
     constructor(keyVaultOptions?: KeyVaultOptions, refreshTimer?: RefreshTimer) {
         if (keyVaultOptions?.secretRefreshIntervalInMs !== undefined) {
@@ -25,7 +23,6 @@ export class AzureKeyVaultSecretProvider {
             }
         }
         this.#keyVaultOptions = keyVaultOptions;
-        this.#secretRefreshTimer = refreshTimer;
         this.#minSecretRefreshTimer = new RefreshTimer(MIN_SECRET_REFRESH_INTERVAL_IN_MS);
         this.#secretClients = new Map();
         for (const client of this.#keyVaultOptions?.secretClients ?? []) {
@@ -37,27 +34,17 @@ export class AzureKeyVaultSecretProvider {
     async getSecretValue(secretIdentifier: KeyVaultSecretIdentifier): Promise<unknown> {
         const identifierKey = secretIdentifier.sourceId;
 
-        // If the refresh interval is not expired, return the cached value if available.
-        if (this.#cachedSecretValues.has(identifierKey) &&
-            (!this.#secretRefreshTimer || !this.#secretRefreshTimer.canRefresh())) {
-                return this.#cachedSecretValues.get(identifierKey);
+        // Return the cached value if available. The cache is invalidated externally (on secret refresh
+        // or when a key-value change is detected) so a stale value is never served.
+        if (this.#cachedSecretValues.has(identifierKey)) {
+            return this.#cachedSecretValues.get(identifierKey);
         }
 
-        // Deduplicate concurrent requests for the same secret: if a request is already in-flight, await it.
-        let pendingRequest = this.#inflightRequests.get(identifierKey);
-        if (pendingRequest === undefined) {
-            pendingRequest = this.#getSecretValueFromKeyVault(secretIdentifier)
-                .then((secretValue) => {
-                    this.#cachedSecretValues.set(identifierKey, secretValue);
-                    return secretValue;
-                })
-                .finally(() => {
-                    // Failures are not cached so subsequent calls can retry.
-                    this.#inflightRequests.delete(identifierKey);
-                });
-            this.#inflightRequests.set(identifierKey, pendingRequest);
-        }
-        return pendingRequest;
+        // Fetch the secret value from Key Vault and cache it. Failures are not cached, so a subsequent
+        // call will retry.
+        const secretValue = await this.#getSecretValueFromKeyVault(secretIdentifier);
+        this.#cachedSecretValues.set(identifierKey, secretValue);
+        return secretValue;
     }
 
     clearCache(): void {