- P2: verify_admin_token parses and enforces the JWT header (alg ==
RS256, kid present) BEFORE consulting the JWKS cache, so a
structurally invalid token costs no fetch, no lock, no provider load.
- P2: JwksCache gains a short negative-cache backoff window (5s,
time.monotonic-recorded) after a failed fetch: within it, get()
re-raises the recorded fault without touching the fetcher — and
without holding or queueing on the lock — so an outage costs one
fetch per window instead of one per request. A successful fetch
clears the backoff; nothing is cached indefinitely (TTL unchanged).
- P3: _matching_key widens the from_jwk handling to
(PyJWTError, binascii.Error, ValueError, TypeError, KeyError) so a
JWKS entry matching the kid but carrying corrupt n/e maps to the
SAME uniform 401 instead of surfacing a 500.
- P3: an unmatched kid now forces ONE TTL-bypassing refetch and
retries the match once, so rotated keys verify without waiting out
the TTL; the forced refetch is itself bounded (inside the backoff
window or the 5s kid-refetch interval the cached document is served
as-is), so unknown-kid floods cannot force a fetch per request.
- Tests: no-fetch proofs for garbage/non-RS256 tokens, corrupt-entry
401, outage fail-fast (sequential + concurrent burst), backoff
lapse/recovery, outage-as-server-fault, and the unknown-kid
refetch: one forced, throttled, resume-after-interval, rotation
picked up, failed forced refetch propagates then fails fast.
Existing tests unchanged (uniform 401 contract intact).
overseer
80ac786a54