Struct Revocations 

pub struct Revocations<'a> {
    pub(super) conn: &'a Mutex<Connection>,
}

Fields

conn: &'a Mutex<Connection>

Implementations

impl Revocations<'_>

pub fn revoke_cert( &self, hostname: &str, not_before: DateTime<Utc>, reason: Option<&str>, revoked_by: Option<&str>, ) -> Result<()>

Upsert: any cert with notBefore < not_before is rejected; re-revoking moves it forward.

pub fn cert_revoked_before( &self, hostname: &str, ) -> Result<Option<DateTime<Utc>>>

Caller compares against the presented cert’s notBefore.

pub fn retain_only(&self, keep: &[&str]) -> Result<usize>

Reconcile the table with the signed sidecar: delete every row whose hostname is not in keep. Returns the number of rows deleted. Closes the de-revoke gap - revoke_cert is upsert-only, so an entry leaving the signed list otherwise sticks around in the DB forever and silently keeps rejecting the host on every mTLS request.