Milestone 2.2.2 — Token Revocation Propagation via Redis Pub/Sub

Status: Completed
Goal: 2.2 — Auth performance cache
Phase: 2 — Single Provider End-to-End
Estimated effort: 2 days
ADR: ADR-0029

Why This Milestone Exists

Milestone 2.2.1 introduces an LRU cache with a 30-second maximum TTL. A revoked token can remain usable until natural expiry. Phase 2 requires "revoked tokens rejected within 5 seconds." Auth publishes a revocation event; every proxy invalidates its LRU.

Redis pub/sub is already required for rate limiting and fans out to all proxy instances without new infrastructure.

Key design correction: RevokeToken has no raw bearer. Events carry token_id, and CachingValidator maintains a secondary tokenID → digest map for InvalidateByTokenID (see ADR-0029).

Branch

feature/m2-2-2-revocation-propagation

PR Title

feat(proxy,auth): token revocation propagation via Redis pub/sub (m2.2.2)

Deliverables

1. Revocation event schema (packages/revocation)

type RevocationEvent struct {
    Version   int       `json:"v"`
    TokenID   string    `json:"token_id"`
    OrgID     string    `json:"org_id"` // audit only
    RevokedAt time.Time `json:"revoked_at"`
}
// Channel: ibex:token:revocations

2. Auth service — publisher

After successful Postgres revoke, async PUBLISH via REDIS_URL. Redis errors are WARN-only and never fail RevokeToken.

3. Proxy service — subscriber

When auth cache is enabled and Redis is configured, subscribe and call InvalidateByTokenID. Stop via packages/shutdown.

Reconnect window (SLA vs LRU TTL)

Steady-state: revoke → pub/sub → invalidate ≈ 1s under healthy Redis.

Gap: Missed messages (disconnect / restart) fall back to 30s LRU TTL. Accepted for Phase 2; reconnect bulk-replay is optional follow-up (ADR-0029).

Acceptance Criteria

• Token revoked via RevokeToken → pub/sub event published (async, non-blocking)
• Subscribed proxies receive the event and invalidate LRU by token_id
• LRU entry invalidated promptly under healthy pub/sub (unit/miniredis coverage)
• Redis pub/sub failure does not fail RevokeToken
• Subscriber terminates cleanly on shutdown
• Reconnect window / 30s TTL gap documented (ADR-0029); tests note missed events fall back to TTL