Cj$SSKJr SSKrSSKrSSKJr SSKJr SSK J r SSK J r J r SSKJr SS KJrJr SS KJr SS KJrJr SS KJr "S S5rg)) annotationsN) lru_cache) SSLContext)Any) HTTPErrorURLError)urlparse)PyJWKPyJWKSet)decode_complete)PyJWKClientConnectionErrorPyJWKClientError) JWKSetCachec\rSrSrS S SjjrS SjrSSSjjrSSSjjrSSjrSSjr \ SS j5r S r g) PyJWKClientNc tUc0n[U5RR5n U S;a[SU <S35eXlSUlX`lXplXlU(a&US::a[SUS35e[U5UlOSUlU(a [US9"UR5n Xl gg) uA client for retrieving signing keys from a JWKS endpoint. ``PyJWKClient`` uses a two-tier caching system to avoid unnecessary network requests: **Tier 1 — JWK Set cache** (enabled by default): Caches the entire JSON Web Key Set response from the endpoint. Controlled by: - ``cache_jwk_set``: Set to ``True`` (the default) to enable this cache. When enabled, the JWK Set is fetched from the network only when the cache is empty or expired. - ``lifespan``: Time in seconds before the cached JWK Set expires. Defaults to ``300`` (5 minutes). Must be greater than 0. **Tier 2 — Signing key cache** (disabled by default): Caches individual signing keys (looked up by ``kid``) using an LRU cache with **no time-based expiration**. Keys are evicted only when the cache reaches its maximum size. Controlled by: - ``cache_keys``: Set to ``True`` to enable this cache. Defaults to ``False``. - ``max_cached_keys``: Maximum number of signing keys to keep in the LRU cache. Defaults to ``16``. :param uri: The URL of the JWKS endpoint. :type uri: str :param cache_keys: Enable the per-key LRU cache (Tier 2). :type cache_keys: bool :param max_cached_keys: Max entries in the signing key LRU cache. :type max_cached_keys: int :param cache_jwk_set: Enable the JWK Set response cache (Tier 1). :type cache_jwk_set: bool :param lifespan: TTL in seconds for the JWK Set cache. :type lifespan: float :param headers: Optional HTTP headers to include in requests. :type headers: dict or None :param timeout: HTTP request timeout in seconds. :type timeout: float :param ssl_context: Optional SSL context for the request. :type ssl_context: ssl.SSLContext or None N)httphttpszInvalid JWKS URI scheme z(: only 'http' and 'https' are supported.rz/Lifespan must be greater than 0, the input is "")maxsize) r schemelowerruri jwk_set_cacheheaderstimeout ssl_contextrrget_signing_key) selfr cache_keysmax_cached_keys cache_jwk_setlifespanrrrrr s a/home/rurouni/.local/share/pipx/venvs/strix-agent/lib/python3.13/site-packages/jwt/jwks_client.py__init__PyJWKClient.__init__sj ?G #%%++- * *"*6*5!" 15  & 1}&EhZqQ"-X!6D !%D  '@AUAUVO#2 c[RRURURS9n[RR XR URS9n[R"U5nSSS5 UR bUR R#W5 W$!,(df  N8=f![[4a:n[U[5(aUR5 [SUS35UeSnAff=f)a5Fetch the JWK Set from the JWKS endpoint. Makes an HTTP request to the configured ``uri`` and returns the parsed JSON response. If the JWK Set cache is enabled, the response is stored in the cache. :returns: The parsed JWK Set as a dictionary. :raises PyJWKClientConnectionError: If the HTTP request fails. )urlr)rcontextNz'Fail to fetch data from the url, err: "r)urllibrequestRequestrrurlopenrrjsonloadr TimeoutError isinstancercloserrput)r!rresponsejwk_setes r& fetch_dataPyJWKClient.fetch_datajs &&488T\\&JA''<<1A1A())H-    )    " "7 +#,' !Y'' ,9!A>  s6A$C&B/=C/ B=9C=CD 5DD cSnURb!U(dURR5nUcUR5n[U[5(d [ S5e[ R"U5$)aReturn the JWK Set, using the cache when available. :param refresh: Force a fresh fetch from the endpoint, bypassing the cache. :type refresh: bool :returns: The JWK Set. :rtype: PyJWKSet :raises PyJWKClientError: If the endpoint does not return a JSON object. Nz.The JWKS endpoint did not return a JSON object)rgetr;r4dictrr from_dict)r!refreshdatas r& get_jwk_setPyJWKClient.get_jwk_setsf    )'%%))+D <??$D$%%"#ST T!!$''r)cURU5nURVs/sH*nURS;dMUR(dM(UPM, nnU(d [ S5eU$s snf)a_Return all signing keys from the JWK Set. Filters the JWK Set to keys whose ``use`` is ``"sig"`` (or unspecified) and that have a ``kid``. :param refresh: Force a fresh fetch from the endpoint, bypassing the cache. :type refresh: bool :returns: A list of signing keys. :rtype: list[PyJWK] :raises PyJWKClientError: If no signing keys are found. )sigNz2The JWKS endpoint did not contain any signing keys)rCkeyspublic_key_usekey_idr)r!rAr9 jwk_set_key signing_keyss r&get_signing_keysPyJWKClient.get_signing_keyssr""7+ '|| + ))]: ?J?Q?Q +  "#WX X sA'A' A'cUR5nURX!5nU(d6URSS9nURX!5nU(d[SUS35eU$)aYReturn the signing key matching the given ``kid``. If no match is found in the current JWK Set, the set is refreshed from the endpoint and the lookup is retried once. :param kid: The key ID to look up. :type kid: str :returns: The matching signing key. :rtype: PyJWK :raises PyJWKClientError: If no matching key is found after refreshing. T)rAz,Unable to find a signing key that matches: "r)rL match_kidr)r!kidrK signing_keys r&r PyJWKClient.get_signing_keysh,,. nn\7 000>L..;K&B3%qIr)cd[USS0S9nUSnURURS55$)aReturn the signing key for a JWT by reading its ``kid`` header. Extracts the ``kid`` from the token's unverified header and delegates to :meth:`get_signing_key`. :param token: The encoded JWT. :type token: str or bytes :returns: The matching signing key. :rtype: PyJWK verify_signatureF)optionsheaderrP) decode_tokenr r>)r!token unverifiedrVs r&get_signing_key_from_jwt$PyJWKClient.get_signing_key_from_jwts:"%2De1LM H%##FJJu$566r)cFSnUHnURU:XdMUn U$ U$)zFind a key in *signing_keys* that matches *kid*. :param signing_keys: The list of keys to search. :type signing_keys: list[PyJWK] :param kid: The key ID to match. :type kid: str :returns: The matching key, or ``None`` if not found. :rtype: PyJWK or None N)rI)rKrPrQkeys r&rOPyJWKClient.match_kids5 CzzS !   r))r rrrrr)FTi,NN)rstrr"boolr#intr$rbr%floatrzdict[str, Any] | NonerrdrzSSLContext | None)returnr)F)rArbrer )rArbre list[PyJWK])rPrarer )rXz str | bytesrer )rKrfrPrarez PyJWK | None) __name__ __module__ __qualname____firstlineno__r'r;rCrLr rZ staticmethodrO__static_attributes__r)r&rrs!!")-)-V3 V3V3 V3  V3  V3'V3V3'V3p>(.28 7r)r) __future__rr1urllib.requestr- functoolsrsslrtypingr urllib.errorrr urllib.parser api_jwkr r api_jwtr rW exceptionsrrrrrrmr)r&rxs5" ,!$4D&eer)