Struct MultiKeyVerifier 

pub struct MultiKeyVerifier { /* private fields */ }

Multi-key verifier supporting graceful key rotation

This verifier maintains multiple keys and attempts verification with each until one succeeds. This allows zero-downtime key rotation:

1. Generate new key pair
2. Add new key as primary, mark old key as secondary with grace period
3. Update JWKS to include both keys
4. After grace period, remove old key

Example

use hyperstack_auth::{MultiKeyVerifier, RotationKey, SigningKey};
use std::time::Duration;

// Generate key pairs
let old_signing_key = SigningKey::generate();
let old_verifying_key = old_signing_key.verifying_key();
let new_signing_key = SigningKey::generate();
let new_verifying_key = new_signing_key.verifying_key();

// Create rotation keys
let old_key = RotationKey::secondary(old_verifying_key, "key-1", Duration::from_secs(86400));
let new_key = RotationKey::primary(new_verifying_key, "key-2");

let verifier = MultiKeyVerifier::new(vec![old_key, new_key], "issuer", "audience")
    .with_cleanup_interval(Duration::from_secs(3600));

Implementations

impl MultiKeyVerifier

pub fn new( keys: Vec<RotationKey>, issuer: impl Into<String>, audience: impl Into<String>, ) -> Self

Create a new multi-key verifier

pub fn from_single_key( key: VerifyingKey, key_id: impl Into<String>, issuer: impl Into<String>, audience: impl Into<String>, ) -> Self

Create from a single key (for backward compatibility)

pub fn with_origin_validation(self) -> Self

Require origin validation

pub fn with_cleanup_interval(self, interval: Duration) -> Self

Set cleanup interval for expired keys

pub async fn add_key(&self, key: RotationKey)

Add a new key to the verifier

pub async fn remove_key(&self, key_id: &str)

Remove a key by ID

pub async fn key_ids(&self) -> Vec<String>

Get all key IDs

pub async fn primary_key_id(&self) -> Option<String>

Get primary key ID

pub async fn verify( &self, token: &str, expected_origin: Option<&str>, expected_client_ip: Option<&str>, ) -> Result<AuthContext, VerifyError>

Verify a token against all keys

pub async fn verify_fast( &self, token: &str, expected_origin: Option<&str>, expected_client_ip: Option<&str>, ) -> Result<AuthContext, VerifyError>

Verify without cleaning up (for high-throughput scenarios)