Implement RepoAccessCache as a singleton pattern

Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>

Author: Copilot

internal/ghmcp/server.go

@@ -90,7 +90,7 @@ func NewMCPServer(cfg MCPServerConfig) (*server.MCPServer, error) {
 	}
 	var repoAccessCache *lockdown.RepoAccessCache
 	if cfg.LockdownMode {
-		repoAccessCache = lockdown.NewRepoAccessCache(gqlClient, repoAccessOpts...)
+		repoAccessCache = lockdown.GetInstance(gqlClient, repoAccessOpts...)
 	}
 
 	// When a client send an initialize request, update the user agent to include the client info.

pkg/lockdown/lockdown.go

@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/muesli/cache2go"
@@ -29,6 +30,13 @@ type repoAccessCacheEntry struct {
 
 const defaultRepoAccessTTL = 5 * time.Minute
 
+var (
+	instance       *RepoAccessCache
+	instanceOnce   sync.Once
+	instanceMu     sync.RWMutex
+	cacheIDCounter atomic.Uint64
+)
+
 // RepoAccessOption configures RepoAccessCache at construction time.
 type RepoAccessOption func(*RepoAccessCache)
 
@@ -47,11 +55,46 @@ func WithLogger(logger *slog.Logger) RepoAccessOption {
 	}
 }
 
-// NewRepoAccessCache returns a cache bound to the provided GitHub GraphQL
-// client. The cache is safe for concurrent use.
+// GetInstance returns the singleton instance of RepoAccessCache.
+// It initializes the instance on first call with the provided client and options.
+// Subsequent calls ignore the client and options parameters and return the existing instance.
+// This is the preferred way to access the cache in production code.
+func GetInstance(client *githubv4.Client, opts ...RepoAccessOption) *RepoAccessCache {
+	instanceOnce.Do(func() {
+		instance = newRepoAccessCache(client, opts...)
+	})
+	return instance
+}
+
+// ResetInstance clears the singleton instance. This is primarily for testing purposes.
+// It flushes the cache and allows re-initialization with different parameters.
+// Note: This should not be called while the instance is in use.
+func ResetInstance() {
+	instanceMu.Lock()
+	defer instanceMu.Unlock()
+	if instance != nil {
+		instance.cache.Flush()
+	}
+	instance = nil
+	instanceOnce = sync.Once{}
+}
+
+// NewRepoAccessCache returns a cache bound to the provided GitHub GraphQL client.
+// The cache is safe for concurrent use.
+//
+// For production code, consider using GetInstance() to ensure singleton behavior and
+// consistent configuration across the application. NewRepoAccessCache is appropriate
+// for testing scenarios where independent cache instances are needed.
 func NewRepoAccessCache(client *githubv4.Client, opts ...RepoAccessOption) *RepoAccessCache {
-	// Use a unique cache name for each instance to avoid sharing state between tests
-	cacheName := "repo-access-cache"
+	return newRepoAccessCache(client, opts...)
+}
+
+// newRepoAccessCache creates a new cache instance. This is a private helper function
+// used by GetInstance.
+func newRepoAccessCache(client *githubv4.Client, opts ...RepoAccessOption) *RepoAccessCache {
+	// Use a unique cache name for each instance to avoid sharing state between instances
+	cacheID := cacheIDCounter.Add(1)
+	cacheName := fmt.Sprintf("repo-access-cache-%d", cacheID)
 	c := &RepoAccessCache{
 		client: client,
 		cache:  cache2go.Cache(cacheName),

pkg/lockdown/lockdown_test.go

@@ -145,3 +145,58 @@ func TestRepoAccessCacheSetTTLReschedulesExistingEntry(t *testing.T) {
 	requireAccess(ctx, t, cache)
 	require.EqualValues(t, 2, transport.CallCount())
 }
+
+func TestGetInstanceReturnsSingleton(t *testing.T) {
+	// Reset any existing singleton
+	ResetInstance()
+	defer ResetInstance() // Clean up after test
+
+	gqlClient := githubv4.NewClient(nil)
+
+	// Get instance twice, should return the same instance
+	instance1 := GetInstance(gqlClient)
+	instance2 := GetInstance(gqlClient)
+
+	// Verify they're the same instance (same pointer)
+	require.Same(t, instance1, instance2, "GetInstance should return the same singleton instance")
+
+	// Verify subsequent calls with different options are ignored
+	instance3 := GetInstance(gqlClient, WithTTL(1*time.Second))
+	require.Same(t, instance1, instance3, "GetInstance should ignore options on subsequent calls")
+	require.Equal(t, defaultRepoAccessTTL, instance3.ttl, "TTL should remain unchanged after first initialization")
+}
+
+func TestResetInstanceClearsSingleton(t *testing.T) {
+	// Reset any existing singleton
+	ResetInstance()
+	defer ResetInstance() // Clean up after test
+
+	gqlClient := githubv4.NewClient(nil)
+
+	// Get first instance with default TTL
+	instance1 := GetInstance(gqlClient)
+	require.Equal(t, defaultRepoAccessTTL, instance1.ttl)
+
+	// Reset the singleton
+	ResetInstance()
+
+	// Get new instance with custom TTL
+	customTTL := 10 * time.Second
+	instance2 := GetInstance(gqlClient, WithTTL(customTTL))
+	require.NotSame(t, instance1, instance2, "After reset, GetInstance should return a new instance")
+	require.Equal(t, customTTL, instance2.ttl, "New instance should have the custom TTL")
+}
+
+func TestNewRepoAccessCacheCreatesIndependentInstances(t *testing.T) {
+	t.Parallel()
+
+	gqlClient := githubv4.NewClient(nil)
+
+	// NewRepoAccessCache should create independent instances
+	cache1 := NewRepoAccessCache(gqlClient, WithTTL(1*time.Second))
+	cache2 := NewRepoAccessCache(gqlClient, WithTTL(2*time.Second))
+
+	require.NotSame(t, cache1, cache2, "NewRepoAccessCache should create different instances")
+	require.Equal(t, 1*time.Second, cache1.ttl)
+	require.Equal(t, 2*time.Second, cache2.ttl)
+}