Struct StateRevocationStore 

pub struct StateRevocationStore { /* private fields */ }

Revocation list backed by a StateStore. Each revoked JTI is one counter; the Redis backend expires it 24 h after the write, far past the 15-minute NHI lifetime, so the list cleans itself up.

Implementations

impl StateRevocationStore

pub fn new(store: Arc<dyn StateStore>) -> Self

Wrap the harness state store.

pub fn with_namespace(store: Arc<dyn StateStore>, namespace: &str) -> Self

Isolate a harness-issued token namespace from upstream token IDs. Namespace names are supplied by the application, never by token claims.

Trait Implementations

impl RevocationStore for StateRevocationStore

fn revoke(&self, jti: &str, expires_at: u64) -> Result<(), String>

Mark a JTI as revoked across issuers for an authorized operator. Holder requests must use try_revoke_token. expires_at is the epoch second at which the entry is last required (the token’s exp plus verifier leeway). An error means the caller cannot confirm that the write succeeded.

fn try_revoke( &self, jti: &str, _expires_at: u64, ) -> Result<RevokeOutcome, String>

Atomically record a revocation and report whether it is new. Backends overriding this method can deduplicate audit records.

fn try_revoke_token( &self, issuer: &str, jti: &str, _expires_at: u64, ) -> Result<RevokeOutcome, String>

Revoke a holder-authenticated token only within its verified issuer. This must use a separate key domain from operator-wide JTI rules. Backends without scoped storage fail closed instead of widening the holder’s authority to every issuer.

fn check_token( &self, issuer: &str, jti: &str, uid: &str, iat: u64, ) -> Result<Option<RevokedBy>, String>

Check an issuer-scoped holder rule and the explicit operator-wide rules. The default preserves global checks for older implementations, which cannot accept scoped writes until they override both methods.

fn is_revoked(&self, jti: &str) -> Result<bool, String>

Ok(true) if an operator-wide JTI rule is present. Identity validation must use check_token to include issuer-scoped rules. An error means the store could not answer; the validator then refuses the token.

fn revoke_instance( &self, instance_uid: &str, cutoff: u64, _expires_at: u64, ) -> Result<(), String>

Revoke tokens of an instance issued at or before issued_at_or_before. Repeated writes must never lower either the cutoff or retention time.

fn check( &self, jti: &str, instance_uid: &str, iat: u64, ) -> Result<Option<RevokedBy>, String>

Check both the operator-wide token identifier and instance cutoff.

fn health(&self) -> Option<RevocationHealth>

Read local health without contacting storage. None means the backend does not expose a fallible dependency or availability guard.

fn sweep_expired(&self, _now_s: u64)

Reclaim entries past their retention period when the backend needs an explicit sweep. Distributed stores normally use their native TTL.