[OID4VCI]: Harden JSON-LD context loading for LD-VC signing - #51448

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/JdkHttpClient.java:76

• This no-op violates the response close contract and leaves unread bodies open on redirects, HTTP errors, or parse failures, preventing connection reuse and leaking resources. Close the JDK response body stream here.

        void close() {
            // The body stream is consumed and closed by the document reader.
        }

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/JsonLdContextDocumentLoader.java:117

• Concurrent failures are not coalesced: if the first fetch times out or throws, each waiter enters this monitor in turn and performs another full-timeout request, so the last issuance can wait numberOfWaiters × requestTimeout. Represent the in-flight load with a shared future/result (including its exception) so all callers in the same burst complete after the first attempt.

        Object lock = locks.computeIfAbsent(url, u -> new Object());
        synchronized (lock) {
            cached = getCached(url);
            if (cached == null) {
                cached = delegate.loadDocument(url, options);

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/JdkHttpClient.java:89

• When the response has no Link header, Map.get returns null, but Titanium's response API expects an empty collection and may iterate it while processing non-application/ld+json responses. allValues is also case-insensitive, so use it rather than looking up a raw map key.

        Collection<String> links() {
            return delegate.headers().map().get("link");
        }

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/JsonLdContextDocumentLoader.java:120

• If delegate.loadDocument throws (including the new timeout and size-limit failures), locks.remove is skipped, so every distinct failed context URI remains in this unbounded map for the server lifetime. Use exception-safe single-flight state (for example, a future per URI) and remove completed or failed entries without allowing concurrent retries to bypass coalescing.

                cached = delegate.loadDocument(url, options);
                putCached(url, cached);
            }
            locks.remove(url, lock);

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/JdkHttpClient.java:140

• Map.get("link") returns null when the response has no Link header, but the Titanium HttpResponse contract exposes a collection that its loader can consume. Return allValues("link") so absent headers produce an empty collection and header-name matching is handled by HttpHeaders.

        Collection<String> links() {
            return delegate.headers().map().get("link");
        }

services/src/test/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/Ed255192018SuiteTest.java:54

• This caller-supplied fixed thread pool is never shut down by HttpServer.stop, leaving non-daemon worker threads after the test class completes. This server does not need concurrent handlers, so use the server-managed default executor as the surrounding tests do.

        server.setExecutor(Executors.newFixedThreadPool(2));

services/src/test/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/JsonLdContextDocumentLoaderTest.java:98

• This fixed thread pool is never shut down: HttpServer.stop does not own or terminate a caller-supplied executor, and newFixedThreadPool creates non-daemon threads. Retain the ExecutorService and call shutdownNow() in stopServer, especially to interrupt the 30-second handlers.

        // A dedicated pool so the blocking /slow handler cannot starve other tests.
        server.setExecutor(Executors.newFixedThreadPool(4));