Update documentation to the higher standards.

jwk.go

@@ -45,6 +45,21 @@ type JWKCacheInterface interface {
 	Cleanup()
 }
 
+// GetJWKS retrieves the JSON Web Key Set (JWKS) from the cache or fetches it from the provider.
+// It first checks if a valid, non-expired JWKS is present in the cache. If so, it returns the cached version.
+// Otherwise, it attempts to fetch the JWKS from the specified jwksURL using the provided httpClient.
+// If the fetch is successful, the JWKS is stored in the cache with an expiration time based on CacheLifetime
+// (defaulting to 1 hour if not set) and returned.
+// This method uses double-checked locking to minimize contention when the cache needs refreshing.
+//
+// Parameters:
+//   - ctx: Context for the HTTP request if fetching is required.
+//   - jwksURL: The URL of the OIDC provider's JWKS endpoint.
+//   - httpClient: The HTTP client to use for fetching the JWKS.
+//
+// Returns:
+//   - A pointer to the JWKSet containing the keys.
+//   - An error if fetching fails or the response cannot be decoded.
 func (c *JWKCache) GetJWKS(ctx context.Context, jwksURL string, httpClient *http.Client) (*JWKSet, error) {
 	c.mutex.RLock()
 	if c.jwks != nil && time.Now().Before(c.expiresAt) {
@@ -74,6 +89,8 @@ func (c *JWKCache) GetJWKS(ctx context.Context, jwksURL string, httpClient *http
 	return jwks, nil
 }
 
+// Cleanup removes the cached JWKS if it has expired.
+// This is intended to be called periodically to ensure stale JWKS data is cleared.
 func (c *JWKCache) Cleanup() {
 	c.mutex.Lock()
 	defer c.mutex.Unlock()
@@ -84,6 +101,17 @@ func (c *JWKCache) Cleanup() {
 	}
 }
 
+// fetchJWKS retrieves the JSON Web Key Set (JWKS) from the specified URL.
+// It uses the provided context and HTTP client to make the request.
+//
+// Parameters:
+//   - ctx: Context for the HTTP request.
+//   - jwksURL: The URL of the OIDC provider's JWKS endpoint.
+//   - httpClient: The HTTP client to use for the request.
+//
+// Returns:
+//   - A pointer to the fetched JWKSet.
+//   - An error if the request fails, the status code is not OK, or the response body cannot be decoded.
 func fetchJWKS(ctx context.Context, jwksURL string, httpClient *http.Client) (*JWKSet, error) {
 	// Create a request with context to enforce timeout
 	req, err := http.NewRequestWithContext(ctx, "GET", jwksURL, nil)
@@ -109,6 +137,16 @@ func fetchJWKS(ctx context.Context, jwksURL string, httpClient *http.Client) (*J
 	return &jwks, nil
 }
 
+// jwkToPEM converts a JWK (JSON Web Key) object into PEM (Privacy-Enhanced Mail) format.
+// It selects the appropriate conversion function based on the JWK's key type ("kty").
+// Currently supports "RSA" and "EC" key types.
+//
+// Parameters:
+//   - jwk: A pointer to the JWK object to convert.
+//
+// Returns:
+//   - A byte slice containing the public key in PEM format.
+//   - An error if the key type is unsupported or conversion fails.
 func jwkToPEM(jwk *JWK) ([]byte, error) {
 	converter, ok := jwkConverters[jwk.Kty]
 	if !ok {
@@ -124,6 +162,17 @@ var jwkConverters = map[string]jwkToPEMConverter{
 	"EC":  ecJWKToPEM,
 }
 
+// rsaJWKToPEM converts an RSA JWK into PEM format.
+// It decodes the modulus (n) and exponent (e) from base64 URL encoding,
+// constructs an rsa.PublicKey, marshals it into PKIX format, and then
+// encodes it as a PEM block.
+//
+// Parameters:
+//   - jwk: A pointer to the RSA JWK object (must have "kty": "RSA").
+//
+// Returns:
+//   - A byte slice containing the RSA public key in PEM format.
+//   - An error if decoding parameters fails or key marshaling fails.
 func rsaJWKToPEM(jwk *JWK) ([]byte, error) {
 	nBytes, err := base64.RawURLEncoding.DecodeString(jwk.N)
 	if err != nil {
@@ -155,6 +204,18 @@ func rsaJWKToPEM(jwk *JWK) ([]byte, error) {
 	return pubKeyPEM, nil
 }
 
+// ecJWKToPEM converts an EC (Elliptic Curve) JWK into PEM format.
+// It decodes the X and Y coordinates from base64 URL encoding, determines the
+// elliptic curve based on the "crv" parameter (P-256, P-384, P-521),
+// constructs an ecdsa.PublicKey, marshals it into PKIX format, and then
+// encodes it as a PEM block.
+//
+// Parameters:
+//   - jwk: A pointer to the EC JWK object (must have "kty": "EC").
+//
+// Returns:
+//   - A byte slice containing the EC public key in PEM format.
+//   - An error if decoding parameters fails, the curve is unsupported, or key marshaling fails.
 func ecJWKToPEM(jwk *JWK) ([]byte, error) {
 	xBytes, err := base64.RawURLEncoding.DecodeString(jwk.X)
 	if err != nil {