Authly::TokenStore
The contract of a token store: fetch raises Authly::Error (Error.invalid_token) for a token
it does not know, and StoreUnavailable when the store is down. Any other exception from a store
is treated as "not a valid token" (401), never as an outage, so a store that raises KeyError for
an unknown token does not let clients make the server answer 503.
Instance methods
consume for a credential that only lives ttl: the record can be forgotten afterwards. The default ignores
the TTL; a store that expires keys (Redis SET key 1 NX EX ttl) should override it.
Revoke token_id and report whether this call was the one that revoked it, so a
one-time credential can be redeemed by exactly one of several concurrent requests.
The default is check-then-revoke; a shared store should override it with an atomic
operation (for Redis, SET NX).
Revoke token_id for ttl only: the revocation can be forgotten afterwards, because everything it covers has
expired by then (the family of a refresh token is revoked for refresh_ttl). A store that can expire keys
(Redis SET key 1 EX ttl) should override this so the revocation set does not grow forever; the default
keeps the revocation until the store drops it.