Struct MemoryLoginRevocations 

pub struct MemoryLoginRevocations { /* private fields */ }

Bounded reference ledger for one host-installed trust domain. Callers are runtime principals, never request fields; this ledger cannot authenticate them. One admitted slot survives lease expiry until the login deadline plus skew. Unknown callers have a separate pool and cannot consume admitted capacity.

The host MUST serialize these operations with proof/session/replay state and authority changes. Commit callbacks receive the exact proposed login record and must atomically write it with that other state in durable backends, or return an error without effects. No await/reentrancy may split the operation. This ledger commits its staged record only after callback success, with no further fallible policy/storage checks. Callbacks must not return success before their commit, or commit and then return an error.

This is not portable admission or a logout endpoint. No proof verification, startup/enrollment readiness or durable storage is supplied here. Hosts MUST apply those gates and a qualified clock-skew bound separately. Fresh unknown revocations consume an explicit host-retained budget before the commit callback. Losing this ledger requires the protocol’s fresh login/reset floors; restoring sessions alone is unsafe. Never recreate it per request or share across domains.

Implementations

impl MemoryLoginRevocations

pub fn new( audience: AudienceId, max_admitted: usize, max_unknown: usize, skew_ns: u64, now_ns: u64, ) -> Result<Self, LoginRevocationError>

Fixed record counts bound memory; no caller-supplied blobs are retained. skew_ns is deployment-qualified protected configuration, not a default.

pub fn occupancy(&self) -> (usize, usize)

Physical pool occupancy, including expired entries until bounded pruning.

pub fn observed_at_ns(&self) -> u64

Clock high-water mark for an atomic host checkpoint, including refusals. Durable hosts retain this with pool counts and the complete record set.

pub fn check_reservation( &mut self, caller: Principal, claims: &PortableClaims, now_ns: u64, ) -> Result<(), LoginRevocationError>

Cheap refusal before proof verification. This does not authenticate claims, reserve capacity or permit a session commit; success is only permission to continue checking. Untrusted claims can cause refusal, never admission. Records and pool occupancy stay unchanged; trusted clock observations remain. The host must serialize this check, verification and with_reservation with authority/session/replay changes. The final reservation rechecks state.

pub fn with_reservation<T>( &mut self, caller: Principal, verified: &VerifiedPortableClaims, now_ns: u64, commit: impl FnOnce(&LoginRevocationChange) -> Result<T, LoginRevocationError>, ) -> Result<T, LoginRevocationError>

Reserve before committing a fully verified admission’s session/replay pair. The issuer/account and original login window stay unchanged on renewal. Verified claims must match this ledger domain, caller and current clock. The host still enforces current authority and replay under the same lock. A live tombstone rejects even an exact admission retry before its callback. No reservation is installed if session/replay storage in commit fails. The callback receives the proposed record for that same atomic commit.

pub fn with_revocation( &mut self, unknown_budget: &mut SessionAdmissionBudget, caller: Principal, now_ns: u64, commit: impl FnOnce(&LoginRevocationChange) -> Result<(), LoginRevocationError>, ) -> Result<u64, LoginRevocationError>

Stage local denial, then atomically remove this caller’s host sessions in commit. Return the denial deadline only after that callback commits. An existing live tombstone keeps its deadline; the callback still runs so retry never falsely acknowledges a failed host operation. No proof needed. An admitted reservation converts in its own pool even if unknowns fill theirs. A caller without a live record consumes one unknown-logout budget credit before the callback; exhaustion returns Capacity, never false success. Keep that receiver-wide budget separate from fresh proof verification so unknown logout traffic cannot spend admission credit. Failure retains the charge; hosts must return normal errors rather than trap/roll back credit. Live reservations and tombstone retries do not compete for this budget. The callback receives the proposed tombstone, including retained binding.

pub fn is_revoked( &mut self, caller: Principal, now_ns: u64, ) -> Result<bool, LoginRevocationError>

Consult local denial before any session use, including exact retries. Absence is not authentication or authorization; other gates still apply.

pub fn prune( &mut self, now_ns: u64, budget: usize, ) -> Result<usize, LoginRevocationError>

Explicit maintenance, at most 128 expired entries; never evict live state. The host clock must be monotonic, including across failed operations.

pub fn prune_with_commit( &mut self, now_ns: u64, budget: usize, commit: impl FnOnce(&[Principal], (usize, usize)) -> Result<(), LoginRevocationError>, ) -> Result<usize, LoginRevocationError>

Commit bounded expired-login deletion and resulting admitted/unknown counts before heap changes. Empty work skips the callback. Failure preserves all records but retains the trusted clock observation, as other refusals do. Hosts persist clock/authority metadata separately even when no rows expire.