Struct RemoteJwksVerifier 

pub struct RemoteJwksVerifier<P>
where
    P: Serialize + DeserializeOwned + Clone + Send + Sync + 'static,
{ /* private fields */ }

Transport-agnostic remote JWKS verifier.

Clone-cheap: all state is behind Arc.

Implementations

impl<P> RemoteJwksVerifier<P>

where P: Serialize + DeserializeOwned + Clone + Send + Sync + 'static,

pub async fn bootstrap( config: RemoteJwksVerifierConfig, ) -> Result<Self, RemoteJwksVerifierError>

Bootstrap the verifier: attempt a live JWKS fetch, fall back to cache, fail closed when neither source provides valid ES384 keys.

Errors

Returns RemoteJwksVerifierError::StartupNoKeys when no keys are available from either the live endpoint or the persistent cache.

pub fn start_background_refresh(&self) -> JoinHandle<()>

Spawn a background task that refreshes the JWKS document on the configured interval.

The returned JoinHandle should be kept alive for the lifetime of the service. Dropping it cancels the background refresh.

pub async fn refresh(&self) -> Result<(), RemoteJwksVerifierError>

Perform a single JWKS refresh: fetch, parse, optionally persist, and swap in.

Errors

Returns an error if the fetch, parse, or cache write fails.

pub async fn verify_token( &self, token: &str, ) -> Result<P, RemoteJwksVerifierError>

Verify a JWT token string against the current in-memory key set.

On a first failure caused by an unknown kid, performs one bounded refresh before retrying. All verification is local; no per-request network I/O is performed on the happy path.

Errors

Returns a RemoteJwksVerifierError when the token is invalid, the kid is unknown after refresh, or no keys are loaded.

Trait Implementations

impl<P> Clone for RemoteJwksVerifier<P>

where P: Serialize + DeserializeOwned + Clone + Send + Sync + 'static + Clone,

fn clone(&self) -> RemoteJwksVerifier<P>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.