const keysExpiryDelta … // NewRemoteKeySet returns a KeySet that can validate JSON web tokens by using HTTP // GETs to fetch JSON web token sets hosted at a remote URL. This is automatically // used by NewProvider using the URLs returned by OpenID Connect discovery, but is // exposed for providers that don't support discovery or to prevent round trips to the // discovery URL. // // The returned KeySet is a long lived verifier that caches keys based on cache-control // headers. Reuse a common remote key set instead of creating new ones as needed. // // The behavior of the returned KeySet is undefined once the context is canceled. func NewRemoteKeySet(ctx context.Context, jwksURL string) KeySet { … } func newRemoteKeySet(ctx context.Context, jwksURL string, now func() time.Time) *remoteKeySet { … } type remoteKeySet … type inflight … func newInflight() *inflight { … } // wait returns a channel that multiple goroutines can receive on. Once it returns // a value, the inflight request is done and result() can be inspected. func (i *inflight) wait() <-chan struct{ … } // done can only be called by a single goroutine. It records the result of the // inflight request and signals other goroutines that the result is safe to // inspect. func (i *inflight) done(keys []jose.JSONWebKey, err error) { … } // result cannot be called until the wait() channel has returned a value. func (i *inflight) result() ([]jose.JSONWebKey, error) { … } func (r *remoteKeySet) VerifySignature(ctx context.Context, jwt string) ([]byte, error) { … } func (r *remoteKeySet) verify(ctx context.Context, jws *jose.JSONWebSignature) ([]byte, error) { … } func (r *remoteKeySet) keysFromCache() (keys []jose.JSONWebKey, expiry time.Time) { … } // keysFromRemote syncs the key set from the remote set, records the values in the // cache, and returns the key set. func (r *remoteKeySet) keysFromRemote(ctx context.Context) ([]jose.JSONWebKey, error) { … } func (r *remoteKeySet) updateKeys() ([]jose.JSONWebKey, time.Time, error) { … }