Class DefaultPersistedGrantService

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class DefaultPersistedGrantService : IPersistedGrantService

Inheritance

object

DefaultPersistedGrantService

Implements

IPersistedGrantService

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

DefaultPersistedGrantService(IPersistedGrantStore, IEventService)

Creates the service, as the container resolves it.

public DefaultPersistedGrantService(IPersistedGrantStore grants, IEventService events)

Parameters

grants IPersistedGrantStore

The store the grants are read from and removed from.

events IEventService

Receives a GrantsRevokedEvent for each removal.

Methods

GetAllGrantsAsync(string, CancellationToken)

public Task<IReadOnlyCollection<Grant>> GetAllGrantsAsync(string subjectId, CancellationToken cancellationToken = default)

Parameters

subjectId string

cancellationToken CancellationToken

Returns

Task<IReadOnlyCollection<Grant>>

Remarks

Duende 8.0.1's, measured: every grant the user holds that has not been consumed — consents, authorization codes, refresh tokens and reference tokens — one row per client, the rows of one client merged into it: their scopes together, the earliest creation, the latest expiry (no expiry beating any), and the first description any of them carries. Until 0.114.0 this listed consents alone, so a client used without a consent screen, or with consent switched off, held tokens the user's list did not show, and a grant's description reached it only from a consent. A row this server cannot read is left out rather than failing the list.

RemoveAllGrantsAsync(string, string?, string?, CancellationToken)

Removes this subject's grants, optionally narrowed to one client or one session.

public Task RemoveAllGrantsAsync(string subjectId, string? clientId = null, string? sessionId = null, CancellationToken cancellationToken = default)

Parameters

subjectId string

clientId string

sessionId string

cancellationToken CancellationToken

Returns

Task

Remarks

Every grant type, not only the tokens: withdrawing consent while leaving a refresh token alive would let a client the user has just disconnected keep acting for them until the token expired, which is not what "revoke" means to the person who asked for it.

Narrowing to a session is what makes one method serve both callers. A consent row belongs to a subject and a client and to no session, so a session-scoped removal cannot match one — ending a browser's session takes that session's tokens and leaves the consent standing, which is the difference between signing out and disconnecting.

Exceptions

ArgumentException

subjectId is null or empty.