| 1 | package main |
| 2 | |
| 3 | // revokeRoutes serializes revocation with credential resolution and route |
| 4 | // publication. A route update that already started must finish before its |
| 5 | // matching token is removed, so it cannot republish stale credentials after |
| 6 | // the user-facing clear or provider-removal operation returns. |
| 7 | func (p *credentialProxy) revokeRoutes(match func(*credProxyRoute) bool) { |
| 8 | p.updateMu.Lock() |
| 9 | defer p.updateMu.Unlock() |
| 10 | p.mu.Lock() |
| 11 | defer p.mu.Unlock() |
| 12 | for token, route := range p.routes { |
| 13 | if route != nil && match(route) { |
| 14 | delete(p.routes, token) |
| 15 | } |
| 16 | } |
| 17 | } |
| 18 |