Struct TokenCache 

pub struct TokenCache { /* private fields */ }

Thread-safe JWT cache with near-expiry refresh and single-flight semantics.

Wrap in Arc<TokenCache> and share across tasks.

Implementations

impl TokenCache

pub fn new(source: Box<dyn TokenSource>, config: TokenCacheConfig) -> Self

Create a new cache backed by source.

pub fn with_clock(self, clock: ArcClock) -> Self

pub fn with_initial_token(self, token: impl Into<String>) -> Self

Seed the cache with an already-held token (e.g. loaded from disk), builder-style, before the cache is shared.

The stored expiry is derived from the token’s JWT exp claim (via parse_expiry) minus TokenCacheConfig::refresh_skew — the same discount the fetch path applies. Tokens without a parseable exp are ignored, and an already-stale seed is filtered by get()’s freshness check — either way the first get falls through to the source, which is the safe direction.

This exists so a seeded cache never confuses “still-valid stored token” with “freshly minted token”: seeding happens exactly once at construction, so invalidate always forces a genuine re-mint (a source that re-served stored state would hand the same dead token back after a 401).

pub async fn get(&self) -> Result<String, TokenCacheError>

Return the current token, refreshing via the source if near-expired.

pub async fn invalidate(&self)

Discard the cached token so the next get re-mints.

Call this when the server rejects the current token (a 401 / Unauthenticated): the token is dead — revoked, session-epoch-bumped, or rotated out from under a still-valid clock TTL — so clock-based expiry is the wrong staleness signal. Forcing a fetch lets a caller recover on its next request instead of waiting out the remaining TTL.