.. index:: single: open_id_jwks_cache
.. _open_id_jwks_cache/0:

.. rst-class:: right

**object**

``open_id_jwks_cache``
======================

JWKS caching and key-rotation helpers.

| **Availability:** 
|    ``logtalk_load(open_id(loader))``

| **Author:** Paulo Moura
| **Version:** 1:0:0
| **Date:** 2026-07-12

| **Compilation flags:**
|    ``static, context_switching_calls``


| **Imports:**
|    ``public`` :ref:`open_id_helpers <open_id_helpers/0>`
| **Uses:**
|    :ref:`open_id_client <open_id_client/0>`
|    :ref:`open_id_jwt <open_id_jwt/0>`
|    :ref:`os <os/0>`

| **Remarks:**
|    (none)

| **Inherited public predicates:**
|     :ref:`options_protocol/0::check_option/1`  :ref:`options_protocol/0::check_options/1`  :ref:`options_protocol/0::default_option/1`  :ref:`options_protocol/0::default_options/1`  :ref:`options_protocol/0::option/2`  :ref:`options_protocol/0::option/3`  :ref:`options_protocol/0::valid_option/1`  :ref:`options_protocol/0::valid_options/1`  

.. contents::
   :local:
   :backlinks: top

Public predicates
-----------------

.. index:: cached_jwks/3
.. _open_id_jwks_cache/0::cached_jwks/3:

``cached_jwks/3``
^^^^^^^^^^^^^^^^^

Returns a cached JWKS for a provider, refreshing it when the cache is stale or missing.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``cached_jwks(Provider,JWKSet,Options)``
| **Mode and number of proofs:**
|    ``cached_jwks(+compound,-term,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    The provider metadata is missing a JWKS endpoint:
|        ``domain_error(open_id_provider,missing(jwks_uri))``
|    The JWKS endpoint returned a non-success status:
|        ``domain_error(open_id_http_status,Code)``
|    The JWKS endpoint response body is not JSON:
|        ``domain_error(open_id_json_response,Body)``


------------

.. index:: verify_id_token/4
.. _open_id_jwks_cache/0::verify_id_token/4:

``verify_id_token/4``
^^^^^^^^^^^^^^^^^^^^^

Verifies an ID-token using cached JWKS data, refreshing the cache once when the token key identifier is unknown.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``verify_id_token(Token,Provider,Claims,Options)``
| **Mode and number of proofs:**
|    ``verify_id_token(+atom,+compound,-term,+list(compound))`` - ``zero_or_one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    The provider metadata is missing a JWKS endpoint:
|        ``domain_error(open_id_provider,missing(jwks_uri))``
|    The JWKS endpoint returned a non-success status:
|        ``domain_error(open_id_http_status,Code)``
|    The JWKS endpoint response body is not JSON:
|        ``domain_error(open_id_json_response,Body)``
|    ``Token`` is a variable:
|        ``instantiation_error``
|    ``Token`` is neither a variable nor an atom:
|        ``type_error(atom,Token)``
|    ``Token`` is an atom but not a valid compact JWT:
|        ``domain_error(jwt_compact_serialization,Token)``
|    ``Token`` contains Base64URL data with characters outside the Base64URL alphabet:
|        ``representation_error(base64)``
|    The JWT header does not contain a valid ``alg`` member:
|        ``domain_error(jwt_header,Header)``
|    The JWT algorithm is unsupported or disallowed:
|        ``domain_error(open_id_jwt_algorithm,Algorithm)``
|    ``JWKSet`` is not a JSON Web Key Set with a ``keys`` list:
|        ``domain_error(jwt_jwks,JWKSet)``
|    No compatible key exists for the JWT header:
|        ``existence_error(jwt_jwk,Header)``
|    The selected JWK is not a supported public key:
|        ``domain_error(jwt_jwk_public_key,Key)``
|    The ES256 signature is not 64 bytes long:
|        ``domain_error(jwt_es256_signature,Signature)``
|    The OpenSSL executable does not exist:
|        ``existence_error(os_command,Executable)``
|    The ``iss`` claim does not match the provider issuer:
|        ``domain_error(open_id_claim(iss),Value)``
|    A required OpenID ID-token claim is missing:
|        ``domain_error(open_id_claims,missing(Name))``
|    The expected audience option is missing:
|        ``domain_error(open_id_claims,missing(expected_audience))``
|    An OpenID ID-token claim has an invalid value:
|        ``domain_error(open_id_claim(Name),Value)``
|    An OpenID ID-token time claim value is not a number:
|        ``type_error(time_number,Name-Time)``


------------

.. index:: clear/0
.. _open_id_jwks_cache/0::clear/0:

``clear/0``
^^^^^^^^^^^

Clears all cached JWKS entries.

| **Compilation flags:**
|    ``static``

| **Mode and number of proofs:**
|    ``clear`` - ``one``


------------

.. index:: clear/1
.. _open_id_jwks_cache/0::clear/1:

``clear/1``
^^^^^^^^^^^

Clears the cached JWKS entry for a provider.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``clear(Provider)``
| **Mode and number of proofs:**
|    ``clear(+compound)`` - ``one_or_error``

| **Exceptions:**
|    The provider metadata is missing a JWKS endpoint:
|        ``domain_error(open_id_provider,missing(jwks_uri))``


------------

Protected predicates
--------------------

(no local declarations; see entity ancestors if any)

Private predicates
------------------

.. index:: cached_jwks_/3
.. _open_id_jwks_cache/0::cached_jwks_/3:

``cached_jwks_/3``
^^^^^^^^^^^^^^^^^^

Cached JWKS entries indexed by URI and fetch time.

| **Compilation flags:**
|    ``dynamic``

| **Template:**
|    ``cached_jwks_(URI,FetchedAt,JWKSet)``
| **Mode and number of proofs:**
|    ``cached_jwks_(?atom,?number,?term)`` - ``zero_or_more``


------------

Operators
---------

(none)

