Performance of PAT validation depends on amount of stored records

The validation of PAT is based on multiple queries (timestamp of all revoke tokens by user, scope the token itself, etc.). In general there should be multiple indenpendent queries to check all conditions. So the code has an implementation to optimize these calls. It is done by loading the whole bucket of data from the caching services. It loads all information about the revoked tokens. In case the storage is almost empty, it could be faster, but the problem is the request will be more and more heavy during the time as more tokens will be revoked. It is also good to mention that there is no mechanism to clean old expired token from the storage (the storage does not contains any metadata to identify the record is not necessary).

The correct approach should be in micro-service architecture to issue a batch of queries (ie to load list of keys, if they are available) and load only related data, not the whole database.

For Modulith is looks like the most efficient way to ask multiple queries but the implementation uses the same approach - loading all records.

Keep in mind that loading of the whole map of data requires a lot of synchronization in the background since we use a distributed cache.

To allow cleanup the storage would be benefitial to store also:

• the expiration timestamp and userId with each token
• during the revoking the whole subset of tokens (ie. revoke all existing tokens for a specific user at the moment) all their revoked token should be deleted (the timestamp by userId has a higher priority)

Start by tracing PAT validation and the caching-service code that loads revoked-token records. Compare the current whole-map loading with the issue's proposed related-data queries, and determine how expiration timestamps and user IDs would support cleanup. Done should mean validation no longer scales with all stored records and obsolete revoked-token data can be removed.