Supabase.
View Source
Fetches and caches the JSON Web Key Set (JWKS) from the Auth server's
/.well-known/jwks.json endpoint, for local verification of
asymmetrically-signed JWTs by Supabase.Auth.get_claims/3.
Keys are cached per project (the client's auth URL) in :persistent_term
under a single fixed key, with a TTL of 600 seconds, mirroring
auth-js's in-memory JWKS cache (JWKS_TTL = 10 minutes).
Concurrency: two processes refreshing concurrently may lose one cache
write (the whole cache map is rewritten last-write-wins). The loser's next
fetch/2 simply refetches. Never holds up verification correctness.
Summary
Functions
Returns the JWKS for client's project, from cache when fresh.
Seeds the cache for client's project. Primary use is testing
(e.g. backdating entries via cached_at:) and warming the cache at boot.
Clears every cached JWKS. Test seam; also safe to call at runtime.
Types
Functions
@spec fetch(Supabase.Client.t(), opts) :: {:ok, [jwk()]} | {:error, term()} when opts: [{:force, boolean()}]
Returns the JWKS for client's project, from cache when fresh.
Cache rules: an entry is fresh while cached_at + 600 > now
(wall clock, System.os_time(:second), mirroring auth-js Date.now()).
A missing, stale, or empty-keyed entry triggers one HTTP fetch. Only a
successful non-empty fetch is cached. Empty key lists and malformed
bodies return exactly what the previous inline implementation returned
({:ok, []} / {:error, :invalid_jwks_response}) without caching.
Pass force: true to bypass the cache and refetch from the server.
@spec put(Supabase.Client.t(), [jwk()], opts) :: :ok when opts: [{:cached_at, integer()}]
Seeds the cache for client's project. Primary use is testing
(e.g. backdating entries via cached_at:) and warming the cache at boot.
@spec reset() :: :ok
Clears every cached JWKS. Test seam; also safe to call at runtime.