fix: invalidate mutator cache on value change

[meysam81]

Related issue(s)

Checklist

• I have read the contributing guidelines.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  security@ory.com) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further Comments

the current behavior in mutator handler will make it impossible to change the value of a header unless you truly restart the server.

this change will ensure that the mutator handler, similar to id_token, is including the hashed version of the value as the cache key so that a change in the access rules will trigger a cache invalidation.

Summary by CodeRabbit

• Bug Fixes

  • Fixed header template caching to properly handle different template body configurations, ensuring variations are cached separately and not incorrectly reused from cache.

• Tests

  • Added test case to verify that header template caching correctly distinguishes between different template body variations and applies them appropriately.

[coderabbitai]

📝 Walkthrough

Walkthrough

MutatorHeader changes its per-header template cache key from ruleID:headerName to ruleID:headerName:<md5(templateString)> by importing crypto/md5 and hashing the template body. Tests are updated to match the new key format, and a new regression test verifies distinct template bodies produce distinct output.

Changes

Header Mutator Template Cache Key Fix

Layer / File(s)	Summary
Cache key computation with MD5 hash pipeline/mutate/mutator_header.go	Imports crypto/md5 and updates templateId to append <md5(templateString)> to the existing ruleID:headerName key, preventing template body collisions in the cache.
Test updates and regression test pipeline/mutate/mutator_header_test.go	Updates the cache-enabled subtest to compute templateId using the same MD5-based format, and adds TestCredentialsIssuerHeadersTemplateBodyChange to assert two different template bodies for the same header produce different mutated values.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description includes a clear explanation of the problem and solution, but the 'Related issue(s)' section lacks an explicit issue reference that would be expected for a bug fix.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately describes the main change: invalidating the mutator cache by incorporating a hash of the template body into the cache key, which is the core fix addressing the caching issue described in the PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}