@spec expunge_expired(
  Ash.Resource.t(),
  keyword()
) :: :ok | {:error, any()}

Remove all expired records.

@spec get_token(Ash.Resource.t(), map(), keyword()) ::
  {:ok, [Ash.Resource.record()]} | {:error, any()}

Retrieve a token by token or JTI optionally filtering by purpose.

@spec jti_revoked?(Ash.Resource.t(), String.t(), keyword()) :: boolean()

Has the token been revoked?

Similar to token-revoked?/2..3 except that rather than extracting the JTI from the token, assumes that it's being passed in directly.

@spec revoke(Ash.Resource.t(), String.t(), keyword()) :: :ok | {:error, any()}

Revoke a token.

Extracts the JTI from the provided token and uses it to generate a revocation record.

Options

• :store_all_tokens? — describes whether the token was generated by an authentication resource with store_all_tokens? enabled. When provided, the revocation is performed atomically so that concurrent revocations of the same token cannot both succeed:

  • true — the token row is expected to exist; it is locked with SELECT … FOR UPDATE and its purpose flipped to "revocation". Returns {:error, _} if the row is already a revocation record.
  • false — the token row is expected not to exist; a plain insert is performed. A concurrent duplicate results in a primary key conflict which is surfaced as {:error, _}.

  If omitted, the legacy upsert behaviour is used. This path is NOT safe against concurrent duplicate revocations and is retained only for backwards compatibility.

@spec revoke_jti(Ash.Resource.t(), String.t(), String.t(), keyword()) ::
  :ok | {:error, any()}

Revoke a token by JTI.

If you have the token, you should use revoke/2 instead.

Accepts the same :store_all_tokens? option as revoke/3.

@spec store_token(Ash.Resource.t(), map(), keyword()) :: :ok | {:error, any()}

Store a token.

Stores a token for any purpose.

@spec token_revoked?(Ash.Resource.t(), String.t(), keyword()) :: boolean()

Has the token been revoked?

Similar to jti_revoked?/2..3 except that it extracts the JTI from the token, rather than relying on it to be passed in.