Skip to main content

revoke_refresh_grant_of_client

headless_lms_server::controllers::main_frontend::oauth::revoke

Function revoke_refresh_grant_of_client 

Source 
async fn revoke_refresh_grant_of_client(
    conn: &mut PgConnection,
    form: &RevokeParams,
    client: &OAuthClient,
    token_hmac_key: &SecretString,
    cache: &Cache,
) -> Result<bool, ControllerError>
Expand description

Revokes the presented refresh token if it belongs to the authenticated client, together with everything else issued from the same (user, client) grant.

RFC 7009 §2.1: the authorization server SHOULD revoke all tokens issued from the same grant. Revoking only the refresh-token row would leave the paired access token authenticating the exercise-services client API — from the Redis cache even after the row is gone — for its full remaining lifetime, so “log out” would not log the user out.

Ok(false) means no live refresh token has that digest.