| 74 | } |
| 75 | |
| 76 | const fetchJwksOnce = async ( |
| 77 | url: URL, |
| 78 | fetchImpl: typeof globalThis.fetch, |
| 79 | timeoutMs: number, |
| 80 | ): Promise<JSONWebKeySet> => { |
| 81 | const controller = new AbortController(); |
| 82 | const timer = setTimeout(() => controller.abort(), timeoutMs); |
| 83 | // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: fetch adapter must clear abort timer while preserving promise rejection behavior |
| 84 | try { |
| 85 | const response = await fetchImpl(url.toString(), { |
| 86 | method: "GET", |
| 87 | headers: { accept: "application/json" }, |
| 88 | signal: controller.signal, |
| 89 | }); |
| 90 | |
| 91 | if (!response.ok) { |
| 92 | // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: fetch-backed JWT key resolver must reject with the existing Error cause shape |
| 93 | throw new Error(`JWKS fetch failed: ${response.status} ${response.statusText}`); |
| 94 | } |
| 95 | |
| 96 | const body = await response.json(); |
| 97 | // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: fetch JSON validation maps Schema failures to the existing malformed JWKS rejection |
| 98 | try { |
| 99 | await decodeJsonWebKeySetPayload(body); |
| 100 | return body as JSONWebKeySet; |
| 101 | } catch { |
| 102 | // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: fetch JSON validation preserves the existing malformed JWKS rejection |
| 103 | throw new Error("JWKS fetch returned malformed payload"); |
| 104 | } |
| 105 | } finally { |
| 106 | clearTimeout(timer); |
| 107 | } |
| 108 | }; |
| 109 | |
| 110 | /** |
| 111 | * Creates a cached, single-flight, force-refreshable JWKS resolver compatible |