Struct KeyRegistry

pub struct KeyRegistry { /* private fields */ }

Thread-safe registry of trusted verification keys, keyed by kid.

The registry supports key rotation via Self::rotate: when a new key is added under the same kid, the old key is preserved for the grace period so tokens signed by the old key continue to verify during the cutover.

Bounded by DEFAULT_KEY_KID_CAP distinct kids. When the cap is reached, Self::add and Self::rotate evict the oldest kid before inserting a new one. This prevents a misbehaving IdP with thousands of distinct kids from growing the registry without bound.

Implementations

impl KeyRegistry

pub fn new() -> Self

Construct an empty registry.

pub fn with_cap(cap: usize) -> Self

Construct a registry with a custom kid cap (used in tests).

pub fn cap(&self) -> usize

pub fn add(&self, kid: impl Into<String>, alg: Algorithm, key: KeyMaterial)

Register a key. Replaces any existing active key with the same kid and alg (grace-window keys from a rotation are preserved). If the registry is at its cap, the oldest kid is evicted first.

pub fn rotate( &self, kid: impl Into<String>, alg: Algorithm, key: KeyMaterial, grace: Duration, )

Register a new key under the same kid, marking the previous key as in grace for the given duration.

pub fn get(&self, kid: &str, alg: Algorithm) -> Vec<KeyMaterial>

Look up a key by kid and alg. Returns all matching keys that have not yet exhausted their grace period. Returns an empty Vec if no matching key is found (caller decides the error mapping).

pub fn contains(&self, kid: &str) -> bool

Returns true if a key with this kid is registered (any algorithm).

pub fn kid_count(&self) -> usize

Number of distinct kids registered.

Trait Implementations

impl Debug for KeyRegistry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for KeyRegistry

fn default() -> Self

Returns the “default value” for a type.