@veridot/redis

Redis-backed durable stores for Veridot.

This package provides production-grade implementations of Veridot's RefreshTokenStore and RevocationStore, suitable for multi-replica deployments where every instance must share the same state.

Installation

pnpm add @veridot/core @veridot/redis ioredis

ioredis is a peer dependency. You can use any client that implements the small RedisLike interface — node-redis works as well with a thin adapter.

Usage

With the Veridot facade (recommended)

import { Veridot } from '@veridot/core';
import { RedisRefreshTokenStore, RedisRevocationStore } from '@veridot/redis';
import { Redis } from 'ioredis';

const redis = new Redis(process.env.REDIS_URL!);

const veridot = await Veridot.create({
  metadataBroker: broker,                       // your KafkaMetadataBroker / DatabaseMetadataBroker
  salt:           process.env.VDOT_SALT!,
  hashPepper:     process.env.VDOT_PEPPER!,
  expectedIssuer: 'https://auth.example.com',
  expectedAudience: 'my-api',
  refreshTokenStore: new RedisRefreshTokenStore(redis, { keyPrefix: 'vdot:rt:'  }),
  revocationStore:   new RedisRevocationStore  (redis, { keyPrefix: 'vdot:rev:' }),
});

Standalone usage

import { RedisRevocationStore } from '@veridot/redis';
import { Redis } from 'ioredis';

const store = new RedisRevocationStore(new Redis());
await store.revoke({
  target:    'jti:abc',
  expiresAt: Math.floor(Date.now() / 1000) + 3600,
  reason:    'logout',
});

const revoked = await store.isRevoked('jti:abc'); // true

Options

RedisRefreshTokenStore(redis, options?)

| Option | Type | Default | Description | | ------------ | --------- | ------------ | ------------------------------------------- | | keyPrefix | string | 'vdot:rt:' | Prefix used for all refresh-token keys. |

Records are written with a TTL matching the refresh-token expiration, so Redis reclaims memory automatically.

RedisRevocationStore(redis, options?)

| Option | Type | Default | Description | | ----------- | --------- | ------------- | ------------------------------------------ | | keyPrefix | string | 'vdot:rev:' | Prefix used for all revocation entries. |

isRevoked() is an O(1) EXISTS lookup. Entries carry a TTL so expired revocations don't accumulate.

Key design

• Every key is namespaced with the configurable prefix — easy to share a single Redis cluster across multiple Veridot deployments.
• TTLs are respected: stores call EXPIREAT for natural expiration in Redis.
• Implementations are minimal and depend only on a small RedisLike interface (get, set, del, exists, expireat), making it easy to swap clients or mock the layer in tests.

Production tips

• Use Redis 6+ (lower versions lack EXPIREAT semantics for some commands).
• Enable AOF or RDB persistence so revocations survive restarts.
• Run a Sentinel / Cluster setup with at least one replica.
• Consider per-namespace ACLs if multiple services share the cluster.

Related packages

• @veridot/core — Core facade & interfaces
• @veridot/kafka — Kafka metadata broker
• @veridot/databases — SQL alternative
• @veridot/nestjs — NestJS module

License

MIT — see LICENSE.