Module token

Structs§

UserFromOAuthToken: Authenticated user extracted from a courses.mooc.fi OAuth 2.0 access token.

CACHE_KEY_CONTEXT 🔒: Domain separator for the cache-key KDF. Changing it invalidates every cache entry.
MAX_CACHE_TTL 🔒: Upper bound on cache TTL, independent of the token’s own expiry.

cache_ttl_for_token 🔒: min(MAX_CACHE_TTL, expires_at - now), floored at zero — a flat TTL could otherwise outlive a short-lived token.
cache_user
delete_user_and_invalidate_cached_tokens: Soft-deletes a user and evicts every cached mapping their access tokens had.
digest_to_cache_key 🔒: Cache key for a token, derived from its oauth_access_tokens.digest rather than the token plaintext: bulk revocation only ever holds digests, so a plaintext-derived key could not be evicted. Keyed (not a bare hash) so a leaked Redis dump is inert and a guessed digest cannot be confirmed offline.
forbidden 🔒: Builds the 403 forbidden error the langs client expects for a token missing the scope.
invalidate_cached_user 🔒: Evicts a cached user mapping. Call this right after revoking a token so it can’t keep authenticating from a stale cache hit for the rest of its TTL.
invalidate_cached_users 🔒: Evicts every mapping a batch revocation invalidated — a refresh family, a withdrawn consent, a deleted user. Same contract as invalidate_cached_user, for the callers that revoke more than one token at a time.
load_user
lookup_error 🔒: Classify a model lookup error raised while resolving a Bearer token.
resolve_oauth_user 🔒: Resolve an opaque Bearer access token to the local user that owns it.
unauthorized 🔒: Builds the 401 unauthorized error the langs client expects for any rejected token.