<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Label this issue](https://contributors.gitlab.com/manage-issue?action=label&projectId=278964&issueIid=598702) - [Close this issue](https://contributors.gitlab.com/manage-issue?action=close&projectId=278964&issueIid=598702) </details> <!--IssueSummary end--> ## Summary This issue covers the IAM service-side implementation of token introspection and revocation. The IAM service is the authoritative owner of all tokens it issues, so all token state management lives here. Rails calls out to the IAM service to check revocation status. ## Scope ### Token Introspection Implement a token introspection endpoint on the IAM service that accepts an IAM-issued JWT and returns token metadata in a shape compatible with Doorkeeper's `/oauth/token/info` response: - `resource_owner_id` - `scope` - `expires_in` - `application.uid` - `created_at` This endpoint will be called by GitLab Rails when handling `GET /oauth/token/info` requests for IAM-issued JWTs. ### Refresh Token Cascade - Revoking an access token must also revoke its associated refresh token (matching Doorkeeper behaviour) - Revoking a refresh token must also revoke the associated access token ### JTI Replay Protection - Track consumed JTIs to prevent reuse of a previously consumed JWT - The `jti` claim is already required during JWT issuance; the store must be checked on every token validation ## References - Rails counterpart: https://gitlab.com/gitlab-org/gitlab/-/work_items/593992 - Doorkeeper behaviour being matched: `Doorkeeper::TokensController#revoke`, `Doorkeeper::TokenInfoController#show` - RFC 7009 (Token Revocation): https://datatracker.ietf.org/doc/html/rfc7009 - AUTH-008 design doc: https://gitlab.com/gitlab-org/architecture/auth-architecture/design-doc/-/blob/main/decisions/008_oauth_new_auth_stack.md