RevocableSessionBackend

Optional capability for a Hazaar\Auth\Interface\SessionBackend whose refresh tokens are store-backed and can

interface RevocableSessionBackend

therefore be revoked out-of-band, rather than only expiring naturally.

This is deliberately not part of the base Hazaar\Auth\Interface\SessionBackend contract: a backend like PHPSession or Cache has no identity-indexed storage to look up "every outstanding refresh token for this identity" (Hazaar\Auth\Interface\RevocableSessionBackend::revokeAll), so requiring every backend to implement it would mean most implementations throw. Hazaar\Auth\Adapter::revokeRefreshToken and Hazaar\Auth\Adapter::revokeAllSessions check for this interface and no-op when the configured backend doesn't support it.

Methods

revoke

Revokes a single refresh token outright (e.g. on logout), without rotating it.

public revoke(string $refreshToken): void

Returns: void

A no-op if the token is unknown or already revoked/consumed.

Parameters

Parameter	Type	Description
$refreshToken	string

revokeAll

Revokes every outstanding refresh token for an identity (e.g. on password change).

public revokeAll(string $identity): void

Returns: void

Parameters

Parameter	Type	Description
$identity	string

---

Generated by Hazaar API Doc Generator on Sun, 23 Aug 2026 10:49:44 +0000