feat: revocations clear delegation and key caches (#70)

* feat: revocations clear delegation and key caches

* chore: update deps

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* chore: update smelt dependency

* fix: rename migration

* chore: update hilt

* chore: update deps

* chore: mod tidy

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: alanshaw

CLAUDE.md

@@ -30,7 +30,7 @@ GOWORK=off go test -tags itest ./itest -run 'TestForgeVersity/PutObject' -v  # o
 GOWORK=off go build -o /tmp/ingot ./cmd/ingot               # the daemon binary
 ```
 
-**go directive: 1.25.7** (the indexing-service dep requires ≥ 1.25.7).
+**go directive: 1.26.4** (matches the swarf dep; indexing-service needs ≥ 1.25.7).
 
 **The test pattern — unit first, integration when you're ready to wait.**
 `make test` runs library/unit tests in seconds with no Docker. `make itest`
@@ -52,6 +52,8 @@ ingot depends only on these — it must **never** import `fil-forge/sprue` or
   `commands/{blob,content,http,assert,ucan,index,provider,access}`, `blobindex`
   (sharded-dag-index), `ucan` (ProofStore), `ucan/retrieval`, `didmailto`, `receipt`.
 - **`indexing-service/pkg/{client,types}`** — indexer query client.
+- **`swarf/pkg/{client,api}`** — the UCAN revocation service client: the SSE
+  revocation firehose the `revocation/` consumer subscribes to.
 - **`fil-forge/versitygw`** — our fork of versity/versitygw, the S3 REST front
   end (we implement `backend.Backend`). The fork adds externally derived SigV4
   signing keys (`auth.Account.SigningKey`, `middlewares.RequestIAMService`) for
@@ -109,6 +111,10 @@ Internal:
   **Forge mode requires Hilt** (`auth_service_url`/`auth_service_did`): the
   postgres registry forwards bucket create/delete/list to it, recovering
   the signed S3 request from the method's ctx.
+- **`revocation/`** — the Swarf firehose consumer (optional,
+  `revocation_service_url`/`_did`): streams UCAN revocations and clears the
+  affected access key's iam caches via `iam.Revoker`; resumes from the
+  `registry.RevocationCursorStore` cursor (no cursor → subscribe from now).
 - **`tokenstore/`** — carried-from-guppy delegation store (`tokens.cbor`).
 - **`bucket/`** — per-object model: `manifest.go` (`ObjectManifest`, `Body`),
   `chunker.go` (`BodyCodec`/`FixedChunker`), `cbor_gen.go`.

config/config.go

@@ -75,6 +75,14 @@ type Config struct {
 	// Optional; when empty the client sends invocations with no proofs (Hilt
 	// may authorize registered provider DIDs directly).
 	AuthServiceProofs string `mapstructure:"auth_service_proofs" yaml:"auth_service_proofs"`
+	// RevocationServiceURL / RevocationServiceDID address the UCAN revocation
+	// service (Swarf): ingot subscribes to its revocation firehose so that
+	// Hilt's access-key deletions (published as UCAN revocations) clear the
+	// per-key authorization caches. Optional; when unset the firehose consumer
+	// is not started and cache entries age out on their own TTLs. Set both or
+	// neither.
+	RevocationServiceURL string `mapstructure:"revocation_service_url" yaml:"revocation_service_url"`
+	RevocationServiceDID string `mapstructure:"revocation_service_did" yaml:"revocation_service_did"`
 
 	// MultipartSessionTTL bounds abandoned multipart uploads (Go duration
 	// string, e.g. "168h"): open sessions older than this are aborted by a
@@ -296,6 +304,9 @@ func (c *Config) Validate() error {
 			errs = multierr.Append(errs, fmt.Errorf("auth_service_proofs: %w", err))
 		}
 	}
+	if (c.RevocationServiceURL == "") != (c.RevocationServiceDID == "") {
+		errs = multierr.Append(errs, errors.New("revocation_service_url and revocation_service_did must be set together"))
+	}
 
 	if errs != nil {
 		return fmt.Errorf("invalid config: %w", errs)

config/config_test.go

@@ -52,6 +52,8 @@ func TestValidate_RequiredFields(t *testing.T) {
 		{"identity key missing", func(c *Config) { c.Identity.KeyFile = "/nonexistent/agent.pem" }, "identity.key_file"},
 		{"upload service", func(c *Config) { c.UploadServiceURL = "" }, "upload_service_url and upload_service_did are required"},
 		{"auth service", func(c *Config) { c.AuthServiceDID = "" }, "auth_service_url and auth_service_did are required"},
+		{"revocation url without did", func(c *Config) { c.RevocationServiceURL = "http://127.0.0.1:6000" }, "revocation_service_url and revocation_service_did must be set together"},
+		{"revocation did without url", func(c *Config) { c.RevocationServiceDID = "did:web:swarf.example" }, "revocation_service_url and revocation_service_did must be set together"},
 		{"bad seal_age", func(c *Config) { c.SealAge = "not-a-duration" }, "parse seal_age"},
 		{"bad cors origin", func(c *Config) { c.CORSAllowedOrigins = []string{"app.example"} }, "cors_allowed_origins"},
 	}
@@ -67,6 +69,17 @@ func TestValidate_RequiredFields(t *testing.T) {
 	}
 }
 
+// TestValidate_RevocationServicePair: the revocation service is optional, but
+// URL and DID come as a pair.
+func TestValidate_RevocationServicePair(t *testing.T) {
+	cfg := validConfig(t)
+	cfg.RevocationServiceURL = "http://127.0.0.1:6000"
+	cfg.RevocationServiceDID = "did:web:swarf.example"
+	if err := cfg.Validate(); err != nil {
+		t.Fatalf("expected valid config with revocation pair set, got: %v", err)
+	}
+}
+
 // TestValidate_AuthServiceProofs: the optional proofs value is loaded eagerly
 // so a bad path or encoding fails at startup.
 func TestValidate_AuthServiceProofs(t *testing.T) {