Trait RevocationStore 

pub trait RevocationStore: Send + Sync {
    // Required methods
    fn revoke(&self, jti: &str, expires_at: u64) -> Result<(), String>;
    fn is_revoked(&self, jti: &str) -> Result<bool, String>;

    // Provided methods
    fn health(&self) -> Option<RevocationHealth> { ... }
    fn sweep_expired(&self, _now_s: u64) { ... }
    fn try_revoke(
        &self,
        jti: &str,
        expires_at: u64,
    ) -> Result<RevokeOutcome, String> { ... }
    fn revoke_instance(
        &self,
        _instance_uid: &str,
        _issued_at_or_before: u64,
        _expires_at: u64,
    ) -> Result<(), String> { ... }
    fn try_revoke_token(
        &self,
        _issuer: &str,
        _jti: &str,
        _expires_at: u64,
    ) -> Result<RevokeOutcome, String> { ... }
    fn check_token(
        &self,
        _issuer: &str,
        jti: &str,
        instance_uid: &str,
        iat: u64,
    ) -> Result<Option<RevokedBy>, String> { ... }
    fn check(
        &self,
        jti: &str,
        _instance_uid: &str,
        _iat: u64,
    ) -> Result<Option<RevokedBy>, String> { ... }
}

Trait for pluggable revocation backends. The harness wires this to the StateStore (Redis for distributed deployments, in-memory otherwise).

Required Methods

fn revoke(&self, jti: &str, expires_at: u64) -> Result<(), String>

Mark a JTI as revoked across issuers for an authorized operator. Holder requests must use try_revoke_token. expires_at is the epoch second at which the entry is last required (the token’s exp plus verifier leeway). An error means the caller cannot confirm that the write succeeded.

fn is_revoked(&self, jti: &str) -> Result<bool, String>

Ok(true) if an operator-wide JTI rule is present. Identity validation must use check_token to include issuer-scoped rules. An error means the store could not answer; the validator then refuses the token.

Provided Methods

fn health(&self) -> Option<RevocationHealth>

Read local health without contacting storage. None means the backend does not expose a fallible dependency or availability guard.

fn sweep_expired(&self, _now_s: u64)

Reclaim entries past their retention period when the backend needs an explicit sweep. Distributed stores normally use their native TTL.

fn try_revoke( &self, jti: &str, expires_at: u64, ) -> Result<RevokeOutcome, String>

Atomically record a revocation and report whether it is new. Backends overriding this method can deduplicate audit records.

fn revoke_instance( &self, _instance_uid: &str, _issued_at_or_before: u64, _expires_at: u64, ) -> Result<(), String>

Revoke tokens of an instance issued at or before issued_at_or_before. Repeated writes must never lower either the cutoff or retention time.

fn try_revoke_token( &self, _issuer: &str, _jti: &str, _expires_at: u64, ) -> Result<RevokeOutcome, String>

Revoke a holder-authenticated token only within its verified issuer. This must use a separate key domain from operator-wide JTI rules. Backends without scoped storage fail closed instead of widening the holder’s authority to every issuer.

fn check_token( &self, _issuer: &str, jti: &str, instance_uid: &str, iat: u64, ) -> Result<Option<RevokedBy>, String>

Check an issuer-scoped holder rule and the explicit operator-wide rules. The default preserves global checks for older implementations, which cannot accept scoped writes until they override both methods.

fn check( &self, jti: &str, _instance_uid: &str, _iat: u64, ) -> Result<Option<RevokedBy>, String>

Check both the operator-wide token identifier and instance cutoff.

Implementors

impl RevocationStore for InMemoryRevocationStore