Struct JwksCache 

pub struct JwksCache { /* private fields */ }

Refresh-on-demand JWKS cache. Constructed by super::JwtVerifier::from_jwks_url and consumed via Self::snapshot on every verify.

Implementations

impl JwksCache

pub fn with_clock(self, clock: Arc<dyn Clock>) -> JwksCache

Swap the clock used for TTL calculation.

Defaults to WallClock. Tests inject a frozen clock to control the stale-check without sleeping.

impl JwksCache

pub async fn fetch(url: impl Into<String>) -> Result<JwksCache, VerifyError>

Initial fetch + cache. Returns VerifyError::KeysetUnavailable if the first fetch fails or the response is not a parseable JWKS — the caller cannot proceed without at least one usable keyset, by design.

pub fn for_test_empty() -> JwksCache

Test-support ctor — bypasses JWKS fetch entirely. The cache holds an empty keyset so any engine verify path rejects on KidUnknown.

pub fn for_test_with_keys(keyset: KeySet) -> JwksCache

Test-support ctor holding a caller-supplied keyset, so a full signature-passing verify can be exercised without a live JWKS fetch (this crate deliberately avoids wiremock for boundary checks). Pair with SigningKey::test_pair() to reach engine checks that run after signature verification — the sv epoch gate, in particular.

pub async fn snapshot(&self) -> Arc<KeySet>

Snapshot — refreshes if the TTL has expired, then returns an Arc to the current engine keyset.

Trait Implementations

impl Clone for JwksCache

fn clone(&self) -> JwksCache

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for JwksCache

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.