Struct TokenRevocationManager 

pub struct TokenRevocationManager { /* private fields */ }

High-level token revocation manager wrapping a backend store.

Implementations

impl TokenRevocationManager

pub fn new( store: Arc<dyn RevocationStore>, require_jti: bool, fail_open: bool, revoke_all_ttl_secs: u64, ) -> Self

Create a new revocation manager.

revoke_all_ttl_secs is how long a revoke-all epoch is retained (see TokenRevocationConfig::revoke_all_ttl_secs).

pub async fn check_token( &self, jti: Option<&str>, sub: &str, iat: Option<i64>, ) -> Result<(), TokenRejection>

Check if a token should be rejected, by single-JTI revocation and by the caller’s revoke-all epoch.

jti/iat are the token’s claims; sub is the subject. The single-JTI check uses jti; the epoch check rejects when the user has an active revoke-all epoch and the token’s iat is at or before it. A token with no iat cannot be epoch-checked, so the epoch is skipped for it (it can still be revoked by jti).

Returns Ok(()) if the token is allowed, or an error reason if rejected.

Errors

Returns TokenRejection::MissingJti if JTI is required but absent. Returns TokenRejection::Revoked if the token’s jti is revoked or its iat predates the user’s revoke-all epoch. Returns TokenRejection::StoreUnavailable if the revocation store is unreachable and fail_open is false.

pub async fn revoke( &self, jti: &str, ttl_secs: u64, ) -> Result<(), RevocationError>

Revoke a single token by JTI.

Errors

Returns RevocationError if the underlying revocation store operation fails.

pub async fn revoke_all_for_user( &self, sub: &str, ) -> Result<(), RevocationError>

Revoke all of a user’s tokens by recording a revoke-all epoch retained for the manager’s configured revoke_all_ttl_secs (see RevocationStore::revoke_all_for_user).

Errors

Returns RevocationError if the underlying revocation store operation fails.

pub async fn user_revoked_after( &self, sub: &str, ) -> Result<Option<i64>, RevocationError>

Return the revoke-all epoch currently in effect for sub, if any.

Errors

Returns RevocationError if the underlying revocation store operation fails.

pub const fn require_jti(&self) -> bool

Whether JTI is required.

Trait Implementations

impl Debug for TokenRevocationManager

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.