From 2f21358c4b43d91a866b88e88d3753b74284298c Mon Sep 17 00:00:00 2001
From: Lucas Lois <lucas.lois@privy.io>
Date: Thu, 14 May 2026 19:32:27 +0200
Subject: [PATCH] feat(client): add authorization_key_cache_max_capacity option

Committed-By-Agent: claude
---
 lib/privy/authorization/jwt_exchange.rb    |  6 +++++-
 lib/privy/public_api/privy_client.rb       |  8 ++++++--
 test/privy/public_api/privy_client_test.rb | 17 +++++++++++++++++
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/lib/privy/authorization/jwt_exchange.rb b/lib/privy/authorization/jwt_exchange.rb
index d500666..a760d10 100644
--- a/lib/privy/authorization/jwt_exchange.rb
+++ b/lib/privy/authorization/jwt_exchange.rb
@@ -4,7 +4,11 @@
 
 module Privy
   class JwtExchangeService
-    def initialize(wallets_resource:, cache_max_capacity: 1000)
+    DEFAULT_CACHE_MAX_CAPACITY = 1000
+
+    attr_reader :cache_max_capacity
+
+    def initialize(wallets_resource:, cache_max_capacity: DEFAULT_CACHE_MAX_CAPACITY)
       @wallets = wallets_resource
       @hpke_recipient = Privy::Cryptography::HpkeRecipient.new
       @cache = {}
diff --git a/lib/privy/public_api/privy_client.rb b/lib/privy/public_api/privy_client.rb
index ad95f13..76212b5 100644
--- a/lib/privy/public_api/privy_client.rb
+++ b/lib/privy/public_api/privy_client.rb
@@ -26,7 +26,8 @@ def initialize(
       timeout: Privy::Client::DEFAULT_TIMEOUT_IN_SECONDS,
       initial_retry_delay: Privy::Client::DEFAULT_INITIAL_RETRY_DELAY,
       max_retry_delay: Privy::Client::DEFAULT_MAX_RETRY_DELAY,
-      request_expiry: Privy::PrivyRequestExpiryOptions.build
+      request_expiry: Privy::PrivyRequestExpiryOptions.build,
+      authorization_key_cache_max_capacity: Privy::JwtExchangeService::DEFAULT_CACHE_MAX_CAPACITY
     )
       @app_id = app_id
       @app_secret = app_secret
@@ -47,7 +48,10 @@ def initialize(
       @users = Privy::Services::Users.new(client: @api, privy_client: self)
       @policies = Privy::Services::Policies.new(client: @api, privy_client: self)
       @key_quorums = Privy::Services::KeyQuorums.new(client: @api, privy_client: self)
-      @jwt_exchange = Privy::JwtExchangeService.new(wallets_resource: @api.wallets)
+      @jwt_exchange = Privy::JwtExchangeService.new(
+        wallets_resource: @api.wallets,
+        cache_max_capacity: authorization_key_cache_max_capacity
+      )
     end
 
     # Resolves the absolute Unix-ms timestamp to send as `privy-request-expiry`.
diff --git a/test/privy/public_api/privy_client_test.rb b/test/privy/public_api/privy_client_test.rb
index 8ea67c5..18351a1 100644
--- a/test/privy/public_api/privy_client_test.rb
+++ b/test/privy/public_api/privy_client_test.rb
@@ -66,4 +66,21 @@ def test_compute_request_expiry_callable_without_arguments
     client = build_client
     refute_nil(client.compute_request_expiry)
   end
+
+  def test_default_authorization_key_cache_max_capacity_uses_service_default
+    client = Privy::PrivyClient.new(app_id: "app-123", app_secret: "secret", environment: :staging)
+    configured = client.jwt_exchange.cache_max_capacity
+    assert_equal(Privy::JwtExchangeService::DEFAULT_CACHE_MAX_CAPACITY, configured)
+  end
+
+  def test_authorization_key_cache_max_capacity_is_forwarded_to_jwt_exchange
+    client = Privy::PrivyClient.new(
+      app_id: "app-123",
+      app_secret: "secret",
+      environment: :staging,
+      authorization_key_cache_max_capacity: 7
+    )
+    configured = client.jwt_exchange.cache_max_capacity
+    assert_equal(7, configured)
+  end
 end