Function digest_to_cache_key 

fn digest_to_cache_key(digest: &Digest, token_hmac_key: &SecretString) -> String

Cache key for a token, derived from its oauth_access_tokens.digest rather than the token plaintext: bulk revocation only ever holds digests, so a plaintext-derived key could not be evicted. Keyed (not a bare hash) so a leaked Redis dump is inert and a guessed digest cannot be confirmed offline.