Module token_revocation 

Token revocation — reject JWTs whose jti claim has been revoked.

After JWT signature verification succeeds, the server checks the token’s jti (JWT ID) claim against a revocation store. If the jti is present, the token is rejected with 401.

Two production backends: Redis (recommended) and PostgreSQL (fallback). An in-memory backend is provided for testing and single-instance dev.

Revoked JTIs expire automatically when the JWT’s exp claim passes, keeping the store bounded.

Structs

InMemoryRevocationStore

In-memory revocation store for testing and single-instance dev.

PostgresRevocationStore

PostgreSQL-backed JWT revocation store.

TokenRevocationConfig

Token revocation configuration embedded in the compiled schema.

TokenRevocationManager

High-level token revocation manager wrapping a backend store.

Enums

RevocationError

Revocation store error.

TokenRejection

Why a token was rejected.

Traits

RevocationStore

Revocation store abstraction.

Functions

build_postgres_revocation_manager

Build a PostgreSQL-backed TokenRevocationManager from the compiled schema’s security.token_revocation config, connecting a dedicated metadata pool from database_url.

revocation_backend_is_postgres

Returns true when token revocation is enabled with the postgres backend.

revocation_manager_from_schema

Build a TokenRevocationManager for the DB-agnostic backends (memory, redis) from the compiled schema’s security.token_revocation JSON.