53 lines
1.2 KiB
Python
53 lines
1.2 KiB
Python
|
"""
|
||
|
|
Token revocation list for local-identity OIDC serve.
|
||
|
|
|
||
|
|
Revoked JTIs (JWT IDs) are stored in ~/.local-identity/revoked.json (mode 600).
|
||
|
|
The list is append-only: JTIs are added but never removed.
|
||
|
|
|
||
|
|
Usage:
|
||
|
|
revoke(jti) Add a JTI to the revocation list.
|
||
|
|
is_revoked(jti) Return True if the JTI has been revoked.
|
||
|
|
"""
|
||
|
|
|
||
|
|
import json
|
||
|
|
import os
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
from .store import _store_dir
|
||
|
|
|
||
|
|
|
||
|
|
def _revoked_path() -> Path:
|
||
|
|
return _store_dir() / "revoked.json"
|
||
|
|
|
||
|
|
|
||
|
|
def _load() -> set[str]:
|
||
|
|
path = _revoked_path()
|
||
|
|
if not path.exists():
|
||
|
|
return set()
|
||
|
|
try:
|
||
|
|
data = json.loads(path.read_text(encoding="utf-8"))
|
||
|
|
return set(data.get("revoked", []))
|
||
|
|
except (json.JSONDecodeError, OSError):
|
||
|
|
return set()
|
||
|
|
|
||
|
|
|
||
|
|
def _save(revoked: set[str]) -> None:
|
||
|
|
path = _revoked_path()
|
||
|
|
path.write_text(
|
||
|
|
json.dumps({"revoked": sorted(revoked)}, indent=2),
|
||
|
|
encoding="utf-8",
|
||
|
|
)
|
||
|
|
os.chmod(path, 0o600)
|
||
|
|
|
||
|
|
|
||
|
|
def is_revoked(jti: str) -> bool:
|
||
|
|
"""Return True if this JTI has been revoked. Defaults to False on read error."""
|
||
|
|
return jti in _load()
|
||
|
|
|
||
|
|
|
||
|
|
def revoke(jti: str) -> None:
|
||
|
|
"""Add a JTI to the revocation list."""
|
||
|
|
revoked = _load()
|
||
|
|
revoked.add(jti)
|
||
|
|
_save(revoked)
|