Summary
RedisTokenStore#initialize deletes :redis and :prefix directly from the caller's options hash. Reusing or freezing a configuration hash therefore changes later behavior or raises FrozenError.
Proposed correction
Duplicate the options hash before consuming constructor-only keys. Candidate: 0c78985a6dc8de3f53ca9b80e2b4065d02311ce2 on 1.17.4/current main (01431c9ecd59e1efc5d262694971ded925044fdc).
The focused model covers preserved caller state, frozen hashes and explicit Redis objects without a live server. The cumulative suite passes 659 RSpec examples (20 expected pending), 103 Minitest runs /201 assertions and four integration runs /41 assertions, plus RuboCop, syntax, YARD and package/install checks.
I used an AI coding assistant during source review and verification. I am opening an issue first because repository policy requires tests, a changelog and a Google CLA for pull requests; this audit cannot alter repository tests and no CLA was signed as part of it.
Summary
RedisTokenStore#initializedeletes:redisand:prefixdirectly from the caller's options hash. Reusing or freezing a configuration hash therefore changes later behavior or raisesFrozenError.Proposed correction
Duplicate the options hash before consuming constructor-only keys. Candidate:
0c78985a6dc8de3f53ca9b80e2b4065d02311ce2on 1.17.4/currentmain(01431c9ecd59e1efc5d262694971ded925044fdc).The focused model covers preserved caller state, frozen hashes and explicit Redis objects without a live server. The cumulative suite passes 659 RSpec examples (20 expected pending), 103 Minitest runs /201 assertions and four integration runs /41 assertions, plus RuboCop, syntax, YARD and package/install checks.
I used an AI coding assistant during source review and verification. I am opening an issue first because repository policy requires tests, a changelog and a Google CLA for pull requests; this audit cannot alter repository tests and no CLA was signed as part of it.