arsenal-broker · revocation
Declared module signatures, types, configuration, and source documentation.
Source: arsenal/crates/arsenal-broker/src/revocation.rs. SHA-256: 7098533bea972f1c4c2ff16eaf8d0126e95d9fe753270b092b31b52799d2a33f.
This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.
revocation::RevocationReason
Reason for token revocation
#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum RevocationReason {
/// User/admin requested revocation
UserRequested,
/// Security incident
SecurityIncident,
/// Agent deactivated
AgentDeactivated,
/// Session ended
SessionEnded,
/// Policy violation
PolicyViolation,
/// Suspicious activity detected
SuspiciousActivity,
/// Key rotation
KeyRotation,
/// Other reason with description
Other(String),
}Source line: 20.
revocation::RevokedToken
A revoked token entry
#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
pub struct RevokedToken {
/// The token ID
pub token_id: TokenId,
/// When the token was revoked
pub revoked_at: chrono::DateTime<chrono::Utc>,
/// Why the token was revoked
pub reason: RevocationReason,
/// Who revoked it (agent ID, admin ID, or "system")
pub revoked_by: String,
/// Original
pub original_expiry: Option<chrono::DateTime<chrono::Utc>>
}Source line: 41.
revocation::RevocationList
In-memory revocation list
pub struct RevocationList {
}Source line: 55.
revocation::RevocationList::new
Create a new revocation list
#[must_use]
pub fn new() -> Self;Source line: 65.
revocation::RevocationList::with_capacity
Create with custom capacity
#[must_use]
pub fn with_capacity(max_entries: usize) -> Self;Source line: 74.
revocation::RevocationList::revoke
Revoke a token
pub async fn revoke(&self, token_id: TokenId, reason: RevocationReason);Source line: 82.
revocation::RevocationList::revoke_with_details
Revoke a token with full details
pub async fn revoke_with_details(
&self,
token_id: TokenId,
reason: RevocationReason,
revoked_by: String,
original_expiry: Option<chrono::DateTime<chrono::Utc>>,
);Source line: 88.
revocation::RevocationList::is_revoked
Check if a token is revoked
pub async fn is_revoked(&self, token_id: &TokenId) -> bool;Source line: 114.
revocation::RevocationList::get_revocation
Get revocation details
pub async fn get_revocation(&self, token_id: &TokenId) -> Option<RevokedToken>;Source line: 120.
revocation::RevocationList::unrevoke
Remove a revocation (unrevoke)
pub async fn unrevoke(&self, token_id: &TokenId) -> Option<RevokedToken>;Source line: 126.
revocation::RevocationList::count
Get count of revoked tokens
pub async fn count(&self) -> usize;Source line: 132.
revocation::RevocationList::cleanup_expired
Clean up entries for tokens that have naturally expired
pub async fn cleanup_expired(&self);Source line: 138.
revocation::RevocationList::all
Get all revoked tokens (for sync/backup)
pub async fn all(&self) -> Vec<RevokedToken>;Source line: 162.
revocation::RevocationList::revoke_bulk
Bulk revoke tokens
pub async fn revoke_bulk(&self, token_ids: Vec<TokenId>, reason: RevocationReason);Source line: 168.
revocation::RevocationList::load
Load revocations from a list (for initialization)
pub async fn load(&self, entries: Vec<RevokedToken>);Source line: 185.
revocation::RevocationDecisionDetailed
Detailed revocation decision.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct RevocationDecisionDetailed {
/// Whether the token is revoked.
pub revoked: bool,
/// Where the decision came from.
pub source: crate::metrics::RevocationDecisionSource
}Source line: 201.
revocation::RevocationStore
Trait for persistent revocation storage (object-safe).
pub trait RevocationStore: Send + Sync {
/// Add a revocation
fn add(&self, entry: RevokedToken) -> BoxFuture<'_, Result<(), RevocationStoreError>>;
/// Remove a revocation
fn remove<'a>(
&'a self,
token_id: &'a TokenId,
) -> BoxFuture<'a, Result<Option<RevokedToken>, RevocationStoreError>>;
/// Check if a token is revoked
fn is_revoked<'a>(
&'a self,
token_id: &'a TokenId,
) -> BoxFuture<'a, Result<bool, RevocationStoreError>>;
/// Check if a token is revoked, with decision source detail.
fn is_revoked_detailed<'a>(
&'a self,
token_id: &'a TokenId,
) -> BoxFuture<'a, Result<RevocationDecisionDetailed, RevocationStoreError>> ;
/// Get revocation details
fn get<'a>(
&'a self,
token_id: &'a TokenId,
) -> BoxFuture<'a, Result<Option<RevokedToken>, RevocationStoreError>>;
/// List all revocations (paginated)
fn list(
&self,
limit: usize,
offset: usize,
) -> BoxFuture<'_, Result<Vec<RevokedToken>, RevocationStoreError>>;
/// Clean up expired entries
fn cleanup(&self) -> BoxFuture<'_, Result<usize, RevocationStoreError>>;
/// Compact any persistent storage (no-op for in-memory stores)
fn compact(&self) -> BoxFuture<'_, Result<(), RevocationStoreError>>;
/// Count current revocations
fn count(&self) -> BoxFuture<'_, Result<usize, RevocationStoreError>>;
}Source line: 212.
revocation::RevocationStoreError
Errors from revocation store
#[derive(Debug, thiserror::Error)]
pub enum RevocationStoreError {
/// Storage backend error
#[error("Storage error: {0}")]
StorageError(String),
/// Entry not found
#[error("Revocation not found")]
NotFound,
}Source line: 267.
revocation::InMemoryRevocationStore
In-memory implementation of RevocationStore
pub struct InMemoryRevocationStore {
}Source line: 278.
revocation::InMemoryRevocationStore::new
Create a new in-memory store
#[must_use]
pub fn new() -> Self;Source line: 285.
revocation::FileRevocationStore
File-backed revocation store (restart-safe on a single node).
This maintains an in-memory index for fast checks, and persists mutations to a JSONL file. A periodic compaction rewrites the file as a snapshot to avoid unbounded growth.
pub struct FileRevocationStore {
}Source line: 379.
revocation::SqlRevocationStore
SQL-backed revocation store (Postgres/SQLite) using sqlx.
pub struct SqlRevocationStore {
}Source line: 388.
revocation::SqlRevocationStore::connect
Create a new SQL-backed revocation store and ensure schema exists.
Errors
Returns an error if the database cannot be reached or schema init fails.
pub async fn connect(
database_url: &str,
table: String,
max_connections: u32,
connect_timeout: std::time::Duration,
) -> Result<Self, RevocationStoreError>;Source line: 427.
revocation::HttpRevocationStore
HTTP-backed revocation store (external service).
The store supports:
- read-through caching (positive + negative TTL)
- bounded timeouts
- basic retry on transient failures
pub struct HttpRevocationStore {
}Source line: 859.
revocation::HttpRevocationStore::new
Create a new HTTP-backed store.
Errors
Returns an error if the base URL is invalid or the HTTP client cannot be created.
pub fn new(
base_url: &str,
auth_header: Option<String>,
timeout: std::time::Duration,
cache_ttl: std::time::Duration,
negative_cache_ttl: std::time::Duration,
positive_cache_max_ttl: std::time::Duration,
) -> Result<Self, RevocationStoreError>;Source line: 884.
revocation::FileRevocationStore::new
Create or load a file-backed revocation store.
Errors
Returns an error if the log cannot be read or opened.
pub fn new(
path: impl Into<std::path::PathBuf>,
max_entries: usize,
fsync_on_write: bool,
) -> Result<Self, RevocationStoreError>;Source line: 1333.
revocation::FileRevocationStore::compact_snapshot
Compact the on-disk log into a snapshot of current revocations.
Errors
Returns an error if rewriting fails.
pub async fn compact_snapshot(&self) -> Result<(), RevocationStoreError>;Source line: 1430.