cachepolicy

var (
	// IssuerKeys is a trusted issuer's JWKS. A key it stops publishing stops
	// verifying within RefreshAfter; an unreachable issuer's keys fail closed
	// past MaxStale, so blocking the fetch cannot keep a revoked key valid.
	IssuerKeys = cache.Options{Name: "authkit_issuer_keys", RefreshAfter: 10 * time.Minute, MaxStale: 4 * time.Hour,
		LoadTimeout: 3 * time.Second, FailureBackoff: 5 * time.Second}

	// OIDCDiscovery is a login provider's metadata and the key set built
	// with it: a key the IdP revokes stops verifying within RefreshAfter.
	OIDCDiscovery = cache.Options{Name: "authkit_oidc_discovery", RefreshAfter: time.Hour, MaxStale: 4 * time.Hour,
		LoadTimeout: 5 * time.Second, FailureBackoff: 5 * time.Second}
)