Skip to main content

MAX_CACHE_TTL

headless_lms_server::domain::exercise_services::token

Constant MAX_CACHE_TTL 

Source 
const MAX_CACHE_TTL: Duration;
Expand description

Upper bound on cache TTL, independent of the token’s own expiry.

A cache hit skips every authorization check in resolve_oauth_user, so this bounds how long a change goes unnoticed when nothing evicts for it. Revocation, refresh-family reuse, consent withdrawal and user deletion all evict; these do not:

  • a grant narrowed by a new consent, which keeps its tokens and only caps their scopes;
  • a hard DELETE FROM users/oauth_clients, whose ON DELETE CASCADE into oauth_access_tokens runs no Rust;
  • oauth_clients changes (bearer_allowed = false, soft delete, narrowed scopes), which have no Rust mutator to evict from.

For those this bound is the only guard, which is why it is minutes and not an hour.