def key

import bend-kit-jwt@0.11.0.1/jwt.bend as Jwt

import Base
import bend-kit-hairpin@0.13.0.1/hairpin.bend as Hairpin

870# The verify key named kid for alg a. A known key stays usable through the 60 s fetch cooldown even
871# when ttl is shorter. After that, refresh a stale set or an unknown kid at most once a minute.
872# ponytail: fixed 60 s cooldown; make it a Jwks field if an issuer rotates faster.
873def key(c: Hairpin.Client, s: Jwks, +kid: String, +a: Alg, +now: U32) -> IO(Hairpin.Client & Jwks & Result<&1, &1, Err, Key>):
874  Jwks{+url, +ttl, +live, +at, +tried, +ks} = s
875  +found = jwk.pick(ks, kid, a)
876  +fresh = Bool.and(live, Bool.and(U32.is_le(at, now), U32.is_lt((now - at : U32), Bool.pick(U32, U32.is_lt(ttl, 60), 60, ttl))))
877  +cached = Bool.and(fresh, Maybe.is_some(&2, Jwk, found))
878  key.go(cached, U32.is_le(60, since(now, tried)), c, Jwks{url, ttl, live, at, tried, ks}, found, kid, a, now)

Uses (20)

Used by (1)

bend-kit-jwt@0.11.0.1/jwt:jwks.kid