Struct KeySet 

pub struct KeySet { /* private fields */ }

A parsed set of verification keys.

Immutable once built. A set that has to change – a JWKS fetched again after its issuer rotated a key – is replaced whole through JwtKeys, so a request never sees half of one set and half of another.

Implementations

impl KeySet

pub fn from_secret( secret: &str, secret_is_base64: bool, ) -> Result<Self, JwtKeyError>

Read PGRST_JWT_SECRET.

Base64 is undone first when the configuration says the secret is base64, and what it decodes to is then read like any other secret – so a base64-encoded JWK is a JWK, as in PostgREST.

pub fn from_jwk_json(json: &str) -> Result<Self, JwtKeyError>

Read a JWK, or a JWK Set ({"keys": [...]}), from its JSON.

Keys that cannot verify a signature – "use": "enc", key_ops without verify, an encryption alg, a key type or curve this server does not implement – are set aside with a warning rather than failing the whole set, because an identity provider’s JWKS routinely mixes them in with its signing keys. A set left with no key at all is an error.

A key that claims to be usable and is malformed fails the set: that is a mistake in the configuration, not a key meant for something else.

pub fn len(&self) -> usize

How many keys the set holds.

pub fn is_empty(&self) -> bool

Whether the set holds no keys. Never true of a set parsed from a secret; true of the set a JWKS URL starts with, before its first fetch.

Trait Implementations

impl Debug for KeySet

fn fmt(&self, f: &mut Formatter<'_>) -> Result

The shape of the set, never the key material: a Debug of the configuration ends up in logs.