Refactor JWT::JWK::Set#initialize

The two construction paths that build keys from hashes had drifted: the
JWKS document form skips a key whose kty is unsupported, the array form
raises. That is easy to miss when the two are nested blocks in the middle
of a case expression, and it is how the gap in jwt#744 came about.

Give each branch a named method, so what differs between them is visible
in the branch itself. initialize now fits the metrics limits without the
Metrics/CyclomaticComplexity exemption it has carried until now.

No behaviour change.

Author: anakinj

CHANGELOG.md

@@ -12,6 +12,7 @@
 
 **Fixes and enhancements:**
 
+- Refactor `JWT::JWK::Set#initialize` so each construction path is a named method [#758](https://github.com/jwt/ruby-jwt/pull/758) ([@anakinj](https://github.com/anakinj))
 - Fix rejection of unknown algorithms from JWKs for RFC compliance and pquip [#728](https://github.com/jwt/ruby-jwt/pull/728)
 - Fix the `Style/DirectiveScope` RuboCop offense failing the build [#752](https://github.com/jwt/ruby-jwt/pull/752)
 - Fix `JWT::JWK::Set` sharing its key collection with the set it was copied from [#751](https://github.com/jwt/ruby-jwt/pull/751)

lib/jwt/jwk/set.rb

@@ -12,25 +12,14 @@ class Set
 
       attr_reader :keys
 
-      def initialize(jwks = nil, options = {}) # rubocop:disable Metrics/CyclomaticComplexity
-        jwks ||= {}
-
+      def initialize(jwks = nil, options = {})
         @keys = case jwks
-                when JWT::JWK::Set # Simple duplication
-                  jwks.keys.dup
-                when JWT::JWK::KeyBase # Singleton
-                  [jwks]
-                when Hash
-                  jwks = jwks.transform_keys(&:to_sym)
-                  [*jwks[:keys]].each_with_object([]) do |k, arr|
-                    arr << JWT::JWK.new(k, nil, options)
-                  rescue JWT::UnsupportedKeyType
-                    nil
-                  end
-                when Array
-                  jwks.map { |k| JWT::JWK.new(k, nil, options) }
-                else
-                  raise ArgumentError, 'Can only create new JWKS from Hash, Array and JWK'
+                when nil               then []
+                when JWT::JWK::Set     then jwks.keys.dup # Simple duplication
+                when JWT::JWK::KeyBase then [jwks]        # Singleton
+                when Hash              then build_supported_keys(jwks.transform_keys(&:to_sym)[:keys], options)
+                when Array             then build_keys(jwks, options)
+                else raise ArgumentError, 'Can only create new JWKS from Hash, Array and JWK'
                 end
       end
 
@@ -88,6 +77,23 @@ def ==(other)
       alias | union
       alias + union
       alias << add
+
+      private
+
+      def build_keys(keys, options)
+        [*keys].map { |key| JWT::JWK.new(key, nil, options) }
+      end
+
+      # A key whose kty this library does not implement is skipped rather than
+      # failing the whole set, as RFC 7517 section 5 requires. Only the JWKS
+      # document form does this today; see #744 for the array form.
+      def build_supported_keys(keys, options)
+        [*keys].each_with_object([]) do |key, arr|
+          arr << JWT::JWK.new(key, nil, options)
+        rescue JWT::UnsupportedKeyType
+          nil
+        end
+      end
     end
   end
 end