Function fetch_and_cache

nodedb/src/control/security/jwks/fetch.rs:28–67

Fetch JWKS from a provider's endpoint and update the cache. Returns the number of keys successfully parsed. On HTTP or parse failure, logs a warning and returns 0 (cache unchanged).

(
    provider_name: &str,
    jwks_url: &str,
    cache: &JwksCache,
    policy: &JwksPolicy,
)

/// Returns the number of keys successfully parsed.
/// On HTTP or parse failure, logs a warning and returns 0 (cache unchanged).
pub async fn fetch_and_cache(
    provider_name: &str,
    jwks_url: &str,
    cache: &JwksCache,
    policy: &JwksPolicy,
) -> usize {
    match fetch_jwks(jwks_url, policy).await {
        Ok(keys) => {
            let count = keys.len();
            if count > 0 {
                info!(
                    provider = %provider_name,
                    url = %jwks_url,
                    keys = count,
                    "JWKS fetched successfully"
                );
                cache.update_provider(provider_name, keys);
            } else {
                warn!(
                    provider = %provider_name,
                    url = %jwks_url,
                    "JWKS response contained no usable signature keys"
                );
            }
            count
        }
        Err(e) => {
            // Log only the variant (no embedded body bytes) — error bodies
            // could carry cloud-metadata contents if SSRF guards ever fail
            // open. We never want that material in the log pipeline.
            warn!(
                provider = %provider_name,
                url = %jwks_url,
                error = e.category(),
                "JWKS fetch failed — using cached keys if available"
            );
            0
        }
    }
}

/// Fetch and parse JWKS from a URL, with full SSRF defense.
async fn fetch_jwks(