INNER CODE UNIT · TypeScript

getJwks

bex-co/beancount-io · backend-cluster/backend-v2/src/config/jwks/index.ts:155

export function getJwks(
  env: Environment,
  serializedProductionJwks: string | undefined = process.env.OAUTH_JWKS,
  derivation: JwksDerivation = derivationFromEnvironment(),
): SigningJwks {
  if (env !== "production") {
    return developmentJwks;
  }

  if (!serializedProductionJwks?.trim()) {
    // A key the operator supplied always wins; derivation is an explicit
    // opt-in, so a managed deployment that loses its key still fails closed.
    if (derivation.fromAuthSecret) {
      return deriveSigningJwks(derivation.authSecret);
    }
    throw new Error("OAUTH_JWKS is required in production");
  }

View source record →