Source: openagent-sdk/bridges/oidc/rust/src/jwks.rs. SHA-256: 583b82e1c77b4208cb57a512763eaf62cbc3717254074494ff48e308a2abba22.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

jwks::JwksClient

JWKS client with per-URI caching and rotation-aware refresh.

#[derive(Debug, Clone)]
pub struct JwksClient {

}

Source line: 28.

jwks::JwksClient::new

Create a new JWKS client.

pub fn new(timeout: Duration, cache_ttl: Duration) -> Self;

Source line: 36.

jwks::JwksClient::with_defaults

Create a client with default settings (10s timeout, 1h cache TTL).

pub fn with_defaults() -> Self;

Source line: 51.

jwks::JwksClient::fetch_jwks

Fetch (or return cached) the JWKS for the given URI.

Errors

Returns [OidcBridgeError::Jwks] on network or parse failure.

pub async fn fetch_jwks(&self, jwks_uri: &str) -> Result<JwkSet>;

Source line: 60.

jwks::JwksClient::refresh

Force-refresh the JWKS for the given URI (key rotation scenario).

Call this when JWT signature verification fails — the IdP may have rotated keys since we last fetched the JWKS.

pub async fn refresh(&self, jwks_uri: &str) -> Result<JwkSet>;

Source line: 78.

jwks::JwksClient::select_key

Select a [DecodingKey] from the JWKS that matches the JWT header.

Matches on kid (key ID) first, then falls back to alg matching if there is exactly one key for that algorithm.

Errors

Returns [OidcBridgeError::Jwks] if no matching key is found.

pub fn select_key(jwks: &JwkSet, header: &Header) -> Result<DecodingKey>;

Source line: 91.

jwks::JwksClient::invalidate

Invalidate a specific JWKS cache entry.

pub async fn invalidate(&self, jwks_uri: &str);

Source line: 178.