hyperscale-stack / security / 38014578498

94%

master: 95%

Build Type

Pull #91

github

Committed by euskadi31

Commit Message

docs(oauth2): require token-family state to outlive its retention

The token-family documentation claimed more than the stores guarantee.
A lookup does treat a token whose family state is lost as revoked, but
the next issuance into that family records it active again: losing a
revoked family's state before its retention ends — an evicted Redis key,
a family row deleted early — can revive its tokens. The Redis package
documentation called eviction harmless and noeviction a recommendation,
and the SQL one called an early family delete safe.

Keeping that state for its whole retention is now a stated requirement:
the Storage godoc (I8), the SQL cleanup rules (never delete a family
row before its expires_at), the Redis requirements (maxmemory-policy
noeviction, since family keys carry TTLs and volatile-* policies evict
them too), the security considerations, the migration guide and the
changelog, which also names the Redis 6.0 requirement KEEPTTL brings.
I6 now mentions the invalid_request for a malformed family ID, the
READ COMMITTED pin is scoped to the token-family transactions it
applies to, and only the token-family Redis scripts are claimed safe to
resend. Refs #82.

Pull Request Pull Request #91: fix(oauth2): make refresh-family revocation reliable across stores

Coverage Stats

1002 of 1029 new or added lines in 16 files covered. (97.38%)

2 existing lines in 2 files now uncovered.

4634 of 4909 relevant lines covered (94.4%)

21.32 hits per line