(protectedHeader, token)
| 150 | }; |
| 151 | |
| 152 | const get: JWTVerifyGetKey = async (protectedHeader, token) => { |
| 153 | const current = await ensureFresh(false); |
| 154 | // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: jose JWTVerifyGetKey retry path is defined by thrown resolver failures |
| 155 | try { |
| 156 | return await current.resolver(protectedHeader, token); |
| 157 | } catch (error) { |
| 158 | // Likely cause: keys rotated upstream after our TTL window started. |
| 159 | // Refetch once and try again. Anything still failing bubbles up so |
| 160 | // jose can classify it (we do not silently swallow real failures). |
| 161 | if (!isJwksNoMatchingKey(error)) { |
| 162 | // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: jose JWTVerifyGetKey requires preserving upstream resolver rejection |
| 163 | throw error; |
| 164 | } |
| 165 | const refreshed = await ensureFresh(true); |
| 166 | return refreshed.resolver(protectedHeader, token); |
| 167 | } |
| 168 | }; |
| 169 | |
| 170 | const result = get as CachedRemoteJWKSet; |
| 171 | Object.defineProperty(result, "forceRefresh", { |
nothing calls this directly
no test coverage detected