ppoppo-token 0.28.0

//! Server-pinned set of decoding keys indexed by `kid`.
//!
//! `kid` resolution is M12: the engine MUST look the key up in this struct
//! and never follow `jku`/`x5u` URLs (those headers fail M07/M08 first).

use jsonwebtoken::DecodingKey;
use std::collections::HashMap;

pub struct KeySet {
    keys: HashMap<String, DecodingKey>,
}

impl KeySet {
    #[must_use]
    pub fn new() -> Self {
        Self {
            keys: HashMap::new(),
        }
    }

    pub fn insert(&mut self, kid: impl Into<String>, key: DecodingKey) {
        self.keys.insert(kid.into(), key);
    }

    pub(crate) fn get(&self, kid: &str) -> Option<&DecodingKey> {
        self.keys.get(kid)
    }
}

impl Default for KeySet {
    fn default() -> Self {
        Self::new()
    }
}

/// Debug shows the `kid` list only — never the `DecodingKey` material.
impl std::fmt::Debug for KeySet {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("KeySet")
            .field("kids", &self.keys.keys().collect::<Vec<_>>())
            .finish_non_exhaustive()
    }
}