Deprovisioning that ends access everywhere

// Deactivating a person has to end every way their account can still act. Nine credentials, issued before the person was
// deactivated, are tried afterwards under three designs: a flag on the user, a list of revocations that a team wrote, and an
// epoch that every check reads before it believes a credential. A tenth row tries a new password sign-in, the one test that
// teams usually run. The second block makes the clean-up fail halfway.

const NOW = 5000; // minutes on a made-up clock

const KINDS = [ // [what it is, minutes it lasts, how long ago it was issued]
  ['browser session', 480, 120],
  ['access token, self-contained', 15, 5],
  ['refresh token', 43200, 600],
  ['personal API key', Infinity, 20000],
  ['OAuth grant held by another app', Infinity, 9000],
  ['nightly export run as the person', Infinity, 15000],
  ['realtime connection opened earlier', Infinity, 90],
  ['sign-in link e-mailed earlier', 15, 3],
  ['invitation sent by the person', 10080, 2000],
];

function world() {
  const user = { id: 'u-asha', active: true, epoch: 7 };
  const creds = KINDS.map(([kind, lasts, ago]) => ({ kind, epoch: user.epoch, expires: NOW - ago + lasts, revoked: false }));
  return { user, creds };
}

// Each design answers one question: may this credential act now? And it has a deactivate() that may stop halfway.
const REVOKED_BY_THE_LIST = ['browser session', 'refresh token', 'personal API key', 'OAuth grant held by another app', 'nightly export run as the person'];

function cleanup(db, steps, failAt) {
  steps.forEach((step, i) => {
    if (i === failAt) throw new Error(`step ${i + 1} failed: ${step.kind}`);
    step.revoked = true;
  });
}

const DESIGNS = {
  'flag only': {
    deactivate(db) { db.user.active = false; },
    mayAct: (db, c) => !c.revoked && NOW < c.expires, // the credential's own life, and nothing about the user
  },
  'revocation list': {
    deactivate(db, failAt) {
      db.user.active = false;
      cleanup(db, db.creds.filter((c) => REVOKED_BY_THE_LIST.includes(c.kind)), failAt);
    },
    mayAct: (db, c) => !c.revoked && NOW < c.expires,
  },
  'epoch and clean-up': {
    deactivate(db, failAt) {
      if (db.user.active) { // a retry runs only the clean-up again
        db.user.active = false;
        db.user.epoch += 1; // the switch: one write, before anything that can fail
      }
      cleanup(db, db.creds, failAt);
    },
    mayAct: (db, c) => db.user.active && c.epoch === db.user.epoch && !c.revoked && NOW < c.expires, // read on every use
  },
};
const passwordSignIn = (db) => db.user.active;

const state = {};
for (const [name, design] of Object.entries(DESIGNS)) {
  const db = world();
  design.deactivate(db);
  state[name] = db;
}

const names = Object.keys(DESIGNS);
console.log(`${'after the person is deactivated'.padEnd(38)}${names.map((n) => n.padEnd(20)).join('')}`.trimEnd());
console.log(`${'a new password sign-in'.padEnd(38)}${names.map((n) => (passwordSignIn(state[n]) ? 'works' : 'refused').padEnd(20)).join('')}`.trimEnd());
const working = Object.fromEntries(names.map((n) => [n, 0]));
KINDS.forEach(([kind], i) => {
  const cells = names.map((n) => {
    const ok = DESIGNS[n].mayAct(state[n], state[n].creds[i]);
    if (ok) working[n] += 1;
    return (ok ? 'still works' : 'refused').padEnd(20);
  });
  console.log(`${kind.padEnd(38)}${cells.join('')}`.trimEnd());
});
console.log(`${'credentials still working'.padEnd(38)}${names.map((n) => `${working[n]} of ${KINDS.length}`.padEnd(20)).join('')}`.trimEnd());

console.log('\nthe grant service is down, so the clean-up fails at its fourth step, and then a retry runs it again:');
console.log(`${'design'.padEnd(22)}${'clean-up stopped'.padEnd(18)}${'still working'.padEnd(16)}after the retry`);
for (const n of ['revocation list', 'epoch and clean-up']) {
  const db = world();
  let stopped = 'no';
  try { DESIGNS[n].deactivate(db, 3); } catch { stopped = 'yes'; }
  const count = () => db.creds.filter((c) => DESIGNS[n].mayAct(db, c)).length;
  const now = count();
  DESIGNS[n].deactivate(db, -1); // the retry: the same steps, with no failure this time
  console.log(`${n.padEnd(22)}${stopped.padEnd(18)}${`${now} of ${KINDS.length}`.padEnd(16)}${count()} of ${KINDS.length}`);
}

after the person is deactivated       flag only           revocation list     epoch and clean-up
a new password sign-in                refused             refused             refused
browser session                       still works         refused             refused
access token, self-contained          still works         still works         refused
refresh token                         still works         refused             refused
personal API key                      still works         refused             refused
OAuth grant held by another app       still works         refused             refused
nightly export run as the person      still works         refused             refused
realtime connection opened earlier    still works         still works         refused
sign-in link e-mailed earlier         still works         still works         refused
invitation sent by the person         still works         still works         refused
credentials still working             9 of 9              4 of 9              0 of 9

the grant service is down, so the clean-up fails at its fourth step, and then a retry runs it again:
design                clean-up stopped  still working   after the retry
revocation list       yes               6 of 9          4 of 9
epoch and clean-up    yes               0 of 9          0 of 9