Trait RevocationReader 

pub trait RevocationReader: Send + Sync {
    // Required methods
    fn is_revoked<'life0, 'life1, 'async_trait>(
        &'life0 self,
        jti: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<bool, StoreError>> + Send + 'async_trait>>
       where 'life0: 'async_trait,
             'life1: 'async_trait,
             Self: 'async_trait;
    fn is_device_revoked<'life0, 'life1, 'async_trait>(
        &'life0 self,
        device: &'life1 DeviceId,
        seq: u64,
    ) -> Pin<Box<dyn Future<Output = Result<bool, StoreError>> + Send + 'async_trait>>
       where 'life0: 'async_trait,
             'life1: 'async_trait,
             Self: 'async_trait;
    fn is_membership_revoked<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>(
        &'life0 self,
        key: &'life1 RevocationKey,
        kind: &'life2 str,
        id: &'life3 str,
        principal: &'life4 PrincipalId,
        snapshot_epoch: u64,
    ) -> Pin<Box<dyn Future<Output = Result<bool, StoreError>> + Send + 'async_trait>>
       where 'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait,
             'life3: 'async_trait,
             'life4: 'async_trait,
             Self: 'async_trait;
}

Edge-side revocation check. The verify-only consumer depends on this — it can ask whether something is revoked but holds no power to revoke.

A false answer is never a proof of liveness — only that the revocation, if any, has not yet reached this replica (see the module contract).

async + dyn-compatible (via [async_trait]) to match the rest of the store surface, so an edge can hold a dyn RevocationReader backed by CF KV.

Required Methods

fn is_revoked<'life0, 'life1, 'async_trait>( &'life0 self, jti: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<bool, StoreError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, Self: 'async_trait,

true if the credential with this jti has been revoked (Revoked::Jti). Cryptographic expiry is enforced separately by the TokenVerifier.

A jti entry whose exp has passed may read as unrevoked: the credential is dead on its own signature by then.

fn is_device_revoked<'life0, 'life1, 'async_trait>( &'life0 self, device: &'life1 DeviceId, seq: u64, ) -> Pin<Box<dyn Future<Output = Result<bool, StoreError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, Self: 'async_trait,

true if a standing binding of device at sequence seq is revoked: a Revoked::Device entry exists with seq < at_seq — the check a standing node binding (R732-F5) makes. A binding minted after the revoke (re-enrollment) carries a higher seq and reads false.

fn is_membership_revoked<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>( &'life0 self, key: &'life1 RevocationKey, kind: &'life2 str, id: &'life3 str, principal: &'life4 PrincipalId, snapshot_epoch: u64, ) -> Pin<Box<dyn Future<Output = Result<bool, StoreError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, 'life4: 'async_trait, Self: 'async_trait,

true if principal’s membership of resource (kind, id) in a snapshot at snapshot_epoch is revoked: a membership entry exists with snapshot_epoch < at_epoch — the check a membership snapshot (R732-F4) makes per member. Any principal kind, a Key included.

key is (kind, id)’s RevocationKey, taken from the snapshot being checked. A replica of the published set holds only tags and looks up membership_tag(key, kind, id, principal); an origin store holding plaintext rows may ignore it.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementations on Foreign Types

impl<T> RevocationReader for Arc<T>

where T: RevocationReader + ?Sized,

One replica shared by a gossip task and a verifier.

fn is_revoked<'life0, 'life1, 'async_trait>( &'life0 self, jti: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<bool, StoreError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, Arc<T>: 'async_trait,

fn is_device_revoked<'life0, 'life1, 'async_trait>( &'life0 self, device: &'life1 DeviceId, seq: u64, ) -> Pin<Box<dyn Future<Output = Result<bool, StoreError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, Arc<T>: 'async_trait,

fn is_membership_revoked<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>( &'life0 self, key: &'life1 RevocationKey, kind: &'life2 str, id: &'life3 str, principal: &'life4 PrincipalId, snapshot_epoch: u64, ) -> Pin<Box<dyn Future<Output = Result<bool, StoreError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, 'life4: 'async_trait, Arc<T>: 'async_trait,

Implementors

impl RevocationReader for MemoryRevocationStore

impl RevocationReader for ReplicatedRevocations