26 lines
870 B
Python
26 lines
870 B
Python
"""Where a module fetches the key that verifies its tokens.
|
|
|
|
Deliberately public and unauthenticated. A JWKS document contains only public
|
|
keys; requiring a credential to fetch one is a chicken-and-egg problem — the
|
|
module needs it in order to trust anything the platform says, including whatever
|
|
credential it would have to present.
|
|
"""
|
|
|
|
from fastapi import APIRouter, Response
|
|
|
|
from app.services.auth import module_identity
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
@router.get("/jwks.json", tags=["Module Identity"])
|
|
def jwks(response: Response):
|
|
"""The public half of the module-token signing key.
|
|
|
|
Cached for an hour: keys change on a deployment, and a module re-fetching
|
|
this on every request would make the platform part of its hot path.
|
|
"""
|
|
document = module_identity.jwks()
|
|
response.headers["Cache-Control"] = "public, max-age=3600"
|
|
return document
|