Function ensureFresh

apps/cloud/src/auth/jwks-cache.ts:343–369

(forceRefresh: boolean)

  };

  const ensureFresh = async (forceRefresh: boolean): Promise<CacheEntry> => {
    if (forceRefresh) return refreshBlocking();
    if (entry && isFresh(entry)) return entry;

    // Memory is stale but still usable: serve it now, revalidate behind it.
    if (entry && isUsable(entry)) {
      refreshInBackground();
      return entry;
    }

    // Cold isolate — the L2 store saves us the upstream round trip.
    const stored = await loadFromStore();
    if (stored) {
      if (!isFresh(stored)) refreshInBackground();
      return stored;
    }

    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: a failed refresh must fall back to stale keys rather than fail the verify
    try {
      return await refreshBlocking();
    } catch (error) {
      // Upstream is slow or down. Last good keys beat failing every request.
      if (entry && isUsable(entry)) return entry;
      // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: nothing usable is cached, so the upstream failure is the real answer
      throw error;
    }
  };

  const get: JWTVerifyGetKey = async (protectedHeader, token) => {
    const current = await ensureFresh(false);