Repository: ray-project/ray
File: src/ray/rpc/authentication/authentication_token_loader.cc (C++)

Code before:
    return nullptr;
  }

  // Token auth is enabled (or we're ignoring auth mode), try to load from sources
  TokenLoadResult result = TryLoadTokenFromSources();

  // If there was an error loading (e.g., RAY_AUTH_TOKEN_PATH set but file missing), crash
  RAY_CHECK(!result.hasError()) << result.error_message;

  // If no token found and auth is enabled, fail with RAY_CHECK
  bool has_token = result.token.has_value() && !result.token->empty();
  RAY_CHECK(has_token || ignore_auth_mode) << kNoTokenErrorMessage;

  // Cache and return the loaded token
  if (has_token) {
    cached_token_ = std::make_shared<const AuthenticationToken>(std::move(*result.token));
    if (IsK8sTokenAuthEnabled()) {
      auto exp = GetTokenExpiration(cached_token_->GetRawValue());
      if (exp) {
        cached_token_expiration_time_ =
            *exp - std::chrono::seconds(kRaySATokenExpirationBufferSeconds);
      } else {
        cached_token_expiration_time_ =
            std::chrono::system_clock::now() +
            std::chrono::seconds(kRaySATokenDefaultTTLSeconds);
      }
    }
  }
  return cached_token_;
}

TokenLoadResult AuthenticationTokenLoader::TryLoadToken(bool ignore_auth_mode) {
  absl::MutexLock lock(&token_mutex_);
  TokenLoadResult result;

  // If k8s token auth is enabled, revoke cached token as Kubelet
  // will expire and auto rotate new service account tokens every hour by default.
  // Use 5 minutes as a default as users can configure the expiration time.
  if (IsK8sTokenAuthEnabled()) {
    if (cached_token_ &&
        std::chrono::system_clock::now() >= cached_token_expiration_time_) {
      cached_token_ = nullptr;
    }
  }

  // If already loaded, return cached value
  if (cached_token_) {
    result.token = *cached_token_;  // Copy from shared_ptr
    return result;
  }


Review comment (refactor):
nit: we can extract this into a function and reuse it in line 180-189 to reduce some code duplication.

Code after:
  }

  // Token auth is enabled (or we're ignoring auth mode), try to load from sources
  TokenLoadResult result = TryLoadTokenFromSources();

  // If there was an error loading (e.g., RAY_AUTH_TOKEN_PATH set but file missing), crash
  RAY_CHECK(!result.hasError()) << result.error_message;

  // If no token found and auth is enabled, fail with RAY_CHECK
  bool has_token = result.token.has_value() && !result.token->empty();
  RAY_CHECK(has_token || ignore_auth_mode) << kNoTokenErrorMessage;

  // Cache and return the loaded token
  if (has_token) {
    cached_token_ = std::make_shared<const AuthenticationToken>(std::move(*result.token));
    if (IsK8sTokenAuthEnabled()) {
      cached_token_expiration_time_ = GetJWTTokenExpiration(cached_token_->GetRawValue());
    }
  }
  return cached_token_;
}

TokenLoadResult AuthenticationTokenLoader::TryLoadToken(bool ignore_auth_mode) {
  absl::MutexLock lock(&token_mutex_);
  TokenLoadResult result;

  // If k8s token auth is enabled, revoke cached token as Kubelet
  // will expire and auto rotate new service account tokens every hour by default.
  // Use 5 minutes as a default as users can configure the expiration time.
  if (IsK8sTokenAuthEnabled()) {
    if (cached_token_ && cached_token_expiration_time_ &&
        std::chrono::system_clock::now() >= cached_token_expiration_time_) {
      cached_token_ = nullptr;
    }
  }

  // If already loaded, return cached value
  if (cached_token_) {
    result.token = *cached_token_;  // Copy from shared_ptr
    return result;
  }

  // If auth is disabled, return nullopt (no token needed)
  if (!ignore_auth_mode && GetAuthenticationMode() != AuthenticationMode::TOKEN) {
    result.token = std::nullopt;
    return result;
  }

  // Token auth is enabled, try to load from sources
  result = TryLoadTokenFromSources();
  if (result.hasError()) {