[token] Reduce DB reads on tracked validations

[mfittko]

Summary

Reduce unnecessary DB reads on the uncached request path by ensuring token caching applies to tracked validations, while keeping quota enforcement correct.

Changes

• Populate token cache after successful ValidateTokenWithTracking() to avoid repeated token DB lookups.
• For cached limited tokens, perform usage increment (quota enforcement) without an extra DB read.
• Tighten IncrementTokenUsage DB update gating for is_active and expires_at, and return semantic errors.
• Add/adjust tests for limited-token caching behavior and inactive/expired increment behavior.

Testing

• make test
• make lint

Notes

This targets proxy-side latency under concurrency for uncached calls; limited tokens still require a per-request DB write to enforce max_requests.

[Copilot]

Pull request overview

This PR optimizes token validation performance by extending cache usage to tracked validations (previously only used for non-tracking validation). The key insight is that for limited tokens, the cached metadata (active/expiry/project) can be reused while still enforcing max_requests through a synchronous DB write that avoids an extra DB read.

• Caches tokens after successful tracked validation to avoid redundant DB reads on subsequent requests
• For cached limited tokens, uses cached metadata but still calls IncrementTokenUsage for quota enforcement
• Tightens DB-level enforcement by adding is_active and expires_at checks to the UPDATE's WHERE clause, returning semantic errors when these constraints aren't met

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/token/cache.go	Implements limited-token caching by calling IncrementTokenUsage directly on cache hits; replaces IsValid() with new isCacheableTokenValid() helper that excludes quota checks; populates cache after successful tracking
internal/database/token.go	Adds is_active and expires_at guards to the UPDATE WHERE clause in IncrementTokenUsage; expands error-path SELECT to return ErrTokenInactive or ErrTokenExpired when appropriate
internal/token/cache_test.go	Adds countingStore mock and test verifying that limited tokens hit the cache on second call with only one increment and no extra DB read
internal/token/token_integration_test.go	Updates MockStore.IncrementTokenUsage to match new DB behavior (check active/expired/quota before incrementing)
internal/database/token_test.go	Adds test cases verifying IncrementTokenUsage returns ErrTokenInactive and ErrTokenExpired when appropriate

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.