vestibule_apple/jwks

Apple JWKS (JSON Web Key Set) fetching and caching.

Fetches Apple’s public keys from https://appleid.apple.com/auth/keys and caches them in a bravo ETS table for reuse. Keys are used to verify the signature of Apple’s ID token JWTs.

Types

JwksCache

Opaque cache for Apple’s JWKS keys.

Backed by a bravo USet ETS table, but the underlying storage is hidden so the dependency can be swapped without breaking consumers.

pub type JwksCache

JwksCacheError

Errors returned by checked JWKS cache operations.

pub type JwksCacheError {
  JwksTableCreateFailed
}

Functions

get_keys

Get Apple’s public verification keys, using cached keys if available. Falls back to fetching from Apple’s JWKS endpoint.

pub fn get_keys(JwksCache) -> Result(List(verify_key.VerifyKey), error.AuthError(a))

init

Initialize the JWKS cache. Call once per VM at application startup.

pub fn init() -> JwksCache

init_named

Initialize a named JWKS cache. Useful for testing.

pub fn init_named(String) -> JwksCache

parse_jwks

Parse a JWKS JSON response into a list of verification keys.

pub fn parse_jwks(String) -> Result(List(verify_key.VerifyKey), error.AuthError(a))

refresh_keys

Force refresh the cached keys from Apple’s endpoint.

pub fn refresh_keys(JwksCache) -> Result(List(verify_key.VerifyKey), error.AuthError(a))

try_init

Try to initialize the JWKS cache.

pub fn try_init() -> Result(JwksCache, JwksCacheError)

try_init_named

Try to initialize a named JWKS cache. Returns an error if the table already exists or cannot be created.

pub fn try_init_named(String) -> Result(JwksCache, JwksCacheError)