Module: Verikloak::JwksCacheRevalidation Private

Included in:

JwksCache

Defined in:

lib/verikloak/jwks_cache.rb

Overview

This module is part of a private API. You should avoid using this module if possible, as it may be removed or be changed in the future.

Revalidation-policy support for JwksCache: forced (TTL-bypassing) refreshes and server-TTL expiry checks used by the middleware throttle. Extracted from JwksCache to keep the class within length limits.

Instance Method Summary

• #force_fetch! ⇒ Array<Hash> private

  Revalidates the JWKs over HTTP regardless of TTL freshness.

• #ttl_expired? ⇒ Boolean private

  Whether the server-declared freshness lifetime has elapsed.

Instance Method Details

#force_fetch! ⇒ Array<Hash>

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Revalidates the JWKs over HTTP regardless of TTL freshness.

Used by the middleware's key-rotation retry path: a Cache-Control: max-age on the previous response must not delay picking up rotated keys when a token already failed with an unknown kid or bad signature.

Subclasses that override Verikloak::JwksCache#fetch! with the pre-1.1 zero-arg signature are detected via the override's parameter list and get a plain fetch! call instead of fetch!(force: true) (no TTL bypass, but no crash).

Returns:

• (Array<Hash>) —

  the cached JWKs after revalidation

# File 'lib/verikloak/jwks_cache.rb', line 29

def force_fetch!
  fetch_supports_force? ? fetch!(force: true) : fetch!
end

#ttl_expired? ⇒ Boolean

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Whether the server-declared freshness lifetime has elapsed.

Returns false when the server never sent Cache-Control: max-age (freshness is then governed solely by the caller's own policy). Reads the two timestamps without the mutex: they are only written together under it, and a torn pair merely shifts one revalidation by a single request.

Returns:

• (Boolean)

# File 'lib/verikloak/jwks_cache.rb', line 42

def ttl_expired?
  fetched_at = @fetched_at
  max_age = @max_age
  fetched_at && max_age ? (Time.now - fetched_at) >= max_age : false
end