Function createCachedRemoteJWKSet

apps/cloud/src/auth/jwks-cache.ts:115–183

(
  url: URL,
  options: CachedRemoteJWKSetOptions = {},
)

 * MCP auth path — see module header for why we don't just use jose's built-in.
 */
export const createCachedRemoteJWKSet = (
  url: URL,
  options: CachedRemoteJWKSetOptions = {},
): CachedRemoteJWKSet => {
  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
  // Capture the fetch impl lazily so consumers can swap globalThis.fetch
  // (tests do this) without us snapshotting a stale reference.
  const fetchImpl = (): typeof globalThis.fetch =>
    options.fetch ?? globalThis.fetch.bind(globalThis);

  let entry: CacheEntry | null = null;
  let inflight: Promise<CacheEntry> | null = null;

  const refresh = (): Promise<CacheEntry> => {
    if (inflight) return inflight;
    inflight = (async () => {
      const jwks = await fetchJwksOnce(url, fetchImpl(), timeoutMs);
      const next: CacheEntry = {
        jwks,
        fetchedAt: Date.now(),
        resolver: createLocalJWKSet(jwks),
      };
      entry = next;
      return next;
    })().finally(() => {
      inflight = null;
    });
    return inflight;
  };

  const ensureFresh = async (forceRefresh: boolean): Promise<CacheEntry> => {
    if (forceRefresh) return refresh();
    if (entry && Date.now() - entry.fetchedAt < ttlMs) return entry;
    return refresh();
  };

  const get: JWTVerifyGetKey = async (protectedHeader, token) => {
    const current = await ensureFresh(false);
    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: jose JWTVerifyGetKey retry path is defined by thrown resolver failures
    try {
      return await current.resolver(protectedHeader, token);
    } catch (error) {
      // Likely cause: keys rotated upstream after our TTL window started.
      // Refetch once and try again. Anything still failing bubbles up so
      // jose can classify it (we do not silently swallow real failures).
      if (!isJwksNoMatchingKey(error)) {
        // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: jose JWTVerifyGetKey requires preserving upstream resolver rejection
        throw error;
      }
      const refreshed = await ensureFresh(true);
      return refreshed.resolver(protectedHeader, token);
    }
  };

  const result = get as CachedRemoteJWKSet;
  Object.defineProperty(result, "forceRefresh", {
    value: () => {