Read oauth.revocation.accessToken off any config-shaped value, returning
undefined when the operator has not declared one.
Deliberately undefaulted. The two layers that consume this key resolve
omission differently, and both are right:
The boot-time reading is that omission means "denylist": every
config written before #277 omits the key, and those are exactly the
deployments whose revocation endpoint was answering 200 with nothing
behind it. Since #375 that reading is enforced by
ACCESS_TOKEN_DENYLIST_ABSENCE_POLICY through the declared-absence
guard — only an explicit "unsupported" at this key excuses an unfilled
denylist slot — rather than by a bespoke validator stage calling this
function.
The revocation router decides what to answer given what it was handed.
Handed no denylist and no declaration, it cannot revoke access tokens, and
unsupported_token_type is the honest answer. It never returns to a 200
that means nothing.
A collapsed default would have to pick one of those and be wrong at the
other layer, so the resolution stays where the reasoning lives.
Accepts unknown because its callers in packages/oauth — the revocation
router and the module's discovery-metadata wiring — read through their own
config/options shapes, which may predate the key.
Read
oauth.revocation.accessTokenoff any config-shaped value, returningundefinedwhen the operator has not declared one.Deliberately undefaulted. The two layers that consume this key resolve omission differently, and both are right:
"denylist": every config written before #277 omits the key, and those are exactly the deployments whose revocation endpoint was answering 200 with nothing behind it. Since #375 that reading is enforced byACCESS_TOKEN_DENYLIST_ABSENCE_POLICYthrough the declared-absence guard — only an explicit"unsupported"at this key excuses an unfilled denylist slot — rather than by a bespoke validator stage calling this function.unsupported_token_typeis the honest answer. It never returns to a 200 that means nothing.A collapsed default would have to pick one of those and be wrong at the other layer, so the resolution stays where the reasoning lives.
Accepts
unknownbecause its callers inpackages/oauth— the revocation router and the module's discovery-metadata wiring — read through their own config/options shapes, which may predate the key.