Struct GuardedRevocationStore 

pub struct GuardedRevocationStore { /* private fields */ }

Fail-closed protection for distributed revocation storage. Only confirmed revocations and locally requested revocations are cached. A successful “not revoked” answer is never cached, so replicas see later revocations on the next request. Failed writes still return errors to their callers.

Reads are limited to 32 concurrent dependency calls. After three consecutive errors, reads fail immediately for one second; then one caller probes recovery. Writes always reach the backing store, even while the circuit is open. Positive JTI and instance entries share a strict 100,000-entry bound.

Implementations

impl GuardedRevocationStore

pub fn new( inner: Arc<dyn RevocationStore>, metrics: &Registry, namespace: &'static str, ) -> Self

Wrap a Redis-backed store. Namespace is nhi or exchanged; any other caller-supplied name shares the fixed other metric label.

Trait Implementations

impl RevocationStore for GuardedRevocationStore

fn health(&self) -> Option<RevocationHealth>

Read local health without contacting storage. None means the backend does not expose a fallible dependency or availability guard.

fn sweep_expired(&self, now_s: u64)

Reclaim entries past their retention period when the backend needs an explicit sweep. Distributed stores normally use their native TTL.

fn revoke(&self, jti: &str, expires_at: u64) -> Result<(), String>

Mark a JTI as revoked across issuers for an authorized operator. Holder requests must use try_revoke_token. expires_at is the epoch second at which the entry is last required (the token’s exp plus verifier leeway). An error means the caller cannot confirm that the write succeeded.

fn try_revoke( &self, jti: &str, expires_at: u64, ) -> Result<RevokeOutcome, String>

Atomically record a revocation and report whether it is new. Backends overriding this method can deduplicate audit records.

fn try_revoke_token( &self, issuer: &str, jti: &str, expiry: u64, ) -> Result<RevokeOutcome, String>

Revoke a holder-authenticated token only within its verified issuer. This must use a separate key domain from operator-wide JTI rules. Backends without scoped storage fail closed instead of widening the holder’s authority to every issuer.

fn check_token( &self, issuer: &str, jti: &str, uid: &str, iat: u64, ) -> Result<Option<RevokedBy>, String>

Check an issuer-scoped holder rule and the explicit operator-wide rules. The default preserves global checks for older implementations, which cannot accept scoped writes until they override both methods.

fn is_revoked(&self, jti: &str) -> Result<bool, String>

Ok(true) if an operator-wide JTI rule is present. Identity validation must use check_token to include issuer-scoped rules. An error means the store could not answer; the validator then refuses the token.

fn revoke_instance( &self, uid: &str, cutoff: u64, expires_at: u64, ) -> Result<(), String>

Revoke tokens of an instance issued at or before issued_at_or_before. Repeated writes must never lower either the cutoff or retention time.

fn check( &self, jti: &str, uid: &str, iat: u64, ) -> Result<Option<RevokedBy>, String>

Check both the operator-wide token identifier and instance cutoff.