| 280 | } |
| 281 | |
| 282 | Status TokenSigner::TryRotateKey(bool* has_rotated) { |
| 283 | lock_guard<RWMutex> l(lock_); |
| 284 | if (has_rotated) { |
| 285 | *has_rotated = false; |
| 286 | } |
| 287 | if (tsk_deque_.size() < 2) { |
| 288 | // There isn't next key to rotate to. |
| 289 | return Status::OK(); |
| 290 | } |
| 291 | |
| 292 | const auto* key = tsk_deque_.front().get(); |
| 293 | // Check if it's time to switch to next key. The key propagation interval |
| 294 | // is equal to the key rotation interval. |
| 295 | // |
| 296 | // current active key <-----AAAAA===========> |
| 297 | // next key <-----AAAAA===========> |
| 298 | // ^ |
| 299 | // now |
| 300 | // |
| 301 | const auto key_creation_time = key->expire_time() - key_validity_seconds_; |
| 302 | if (key_creation_time + 2 * key_rotation_seconds_ <= WallTime_Now()) { |
| 303 | tsk_deque_.pop_front(); |
| 304 | if (has_rotated) { |
| 305 | *has_rotated = true; |
| 306 | } |
| 307 | } |
| 308 | return Status::OK(); |
| 309 | } |
| 310 | |
| 311 | Status TokenSigner::GenerateSigningKey(int64_t key_seq_num, |
| 312 | int64_t key_expiration, |