Struct JwksCache 

pub struct JwksCache { /* private fields */ }

Caches JWKS decoding keys with a configurable TTL.

Thread-safe: all access goes through a parking_lot::RwLock. When the cache expires, the next call to get_key triggers a background-safe refresh. A tokio::sync::Mutex serialises concurrent refresh attempts to prevent thundering-herd behaviour.

Implementations

impl JwksCache

pub fn new(jwks_url: String, ttl: Duration) -> Self

Create a new cache that will fetch keys from jwks_url.

Does not fetch keys eagerly — the first call to get_key or refresh will populate the cache.

pub async fn from_oidc_issuer( issuer: &str, ttl: Duration, ) -> Result<Self, AuthError>

Create a cache by first performing OIDC discovery on the given issuer URL, then eagerly fetching the JWKS.

pub fn from_keys(keys: HashMap<String, CachedKey>) -> Self

Create a cache pre-populated with the given keys (useful for testing).

pub fn is_expired(&self) -> bool

Whether the cached keys have expired (or were never fetched).

pub fn len(&self) -> usize

Number of keys currently cached.

pub fn is_empty(&self) -> bool

Whether the cache is empty.

pub async fn refresh(&self) -> Result<(), AuthError>

Fetch the JWKS from the configured URL and update the cache.

On failure, previously cached keys are preserved (stale-on-error) so that transient network failures don’t immediately break JWT validation for all requests.

pub async fn get_key(&self, kid: &str) -> Result<CachedKey, AuthError>

Get a cached key by its kid (key ID).

If the cache has expired, it is refreshed first. Concurrent callers share a single refresh request (thundering-herd protection).

pub async fn get_all_keys(&self) -> Result<Vec<CachedKey>, AuthError>

Get all cached keys (useful when the JWT has no kid header).

If the cache has expired, it is refreshed first. Concurrent callers share a single refresh request (thundering-herd protection).

pub fn jwks_url(&self) -> &str

Returns the JWKS URL this cache is configured to fetch from.

Trait Implementations

impl Debug for JwksCache

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.