f1ca82ab

By: Tom Sydney Kerckhove <syd@cs-syd.eu>

Take the fetch once, and keep the internals out of the way

Integrating this into NixCI showed three things.

A caller handed a fetch on every request and was given only an issuer to
decide what to fetch, so it looked the issuer up a second time and then
had a Nothing to answer that could not happen. Each issuer carries its
own fetch now, handed in when the federation is built.

Audience collided with jose's in every module that both signs a token
and configures this, which was three of them. TokenAudience collides
with nothing.

KeySet exported five things only its own tests reached for, which is a
public surface shaped by a test suite. They are in KeySet.Internal.

The end-to-end suite allowed no clock skew, which only showed once a
second issuer ran on a second host and stamped a token a fraction of a
second ahead.

Total

21s

Created 3 weeks ago Started 3 weeks ago Finished 3 weeks ago

Timeline