#include <jwks.hpp>

Public Member Functions
	JwksVerifier (Transport transport, std::string base_url, std::chrono::seconds cache_ttl=std::chrono::seconds(300))

std::optional< VerifiedToken >	verify_signature_only_unchecked (const std::string &jwt)
	EXPERT PRIMITIVE — signature only.

void	refresh_keys ()
	Force-refresh the cached key set (also called lazily by verify()).

std::size_t	cached_key_count ()
	Test/introspection helper: number of currently-cached keys.

Constructor & Destructor Documentation

◆ JwksVerifier()

axiam::JwksVerifier::JwksVerifier	(	Transport	transport,
		std::string	base_url,
		std::chrono::seconds	cache_ttl = `std::chrono::seconds(300)`
	)

Parameters

transport	shared transport seam (same as the client's).
base_url	server base URL (no trailing slash required).
cache_ttl	key-set cache lifetime (default 300s).

Member Function Documentation

◆ verify_signature_only_unchecked()

std::optional< VerifiedToken > axiam::JwksVerifier::verify_signature_only_unchecked ( const std::string & jwt )

EXPERT PRIMITIVE — signature only.

Verifies a compact JWS against the cached Ed25519 key set (EdDSA only) and returns the decoded payload. Returns nullopt if the alg is not EdDSA, the kid is unknown, the token is malformed, or the signature does not verify.

It performs NO claim validation whatsoever: an expired token, a not-yet-valid token and a token belonging to another tenant all come back as a successful result. The name says unchecked because the claims are unchecked. Use axiam::TokenAuthenticator (<axiam/authenticator.hpp>) unless you are implementing those checks yourself.

◆ refresh_keys()

void axiam::JwksVerifier::refresh_keys ( )

Force-refresh the cached key set (also called lazily by verify()).

◆ cached_key_count()

std::size_t axiam::JwksVerifier::cached_key_count ( )

Test/introspection helper: number of currently-cached keys.

The documentation for this class was generated from the following file: