pub async fn ensure_keys(auth_header: Option<&str>, config: &JwtConfig)Expand description
Make sure the keys the request’s token needs are loaded, before the
synchronous authenticate (or JwtCache::authenticate) runs.
The one asynchronous step in verifying a token, and a no-op unless keys
come from a JWKS URL (JwtConfig::jwks). Even then it awaits nothing
for a token whose key is already held, which is every request but the few
after the identity provider rotates a key. See jwks for when it
fetches. Never fails: a token it could not find a key for is refused by
the check that follows, as it would have been without it.
Every place a token is verified awaits this first: the REST pipeline, and the server’s GraphQL handlers.