Short answer: revoke a short-lived room token on the server, publish a versioned membership event, and make every reconnect prove that its token is still current. In an online classroom, a green dot is useful only when it agrees with authorization. For a logistics training workspace, that means a dispatcher who loses access should disappear from the roster and lose media access, even if an old browser tab is still open.
I build Python services around explicit contracts because an eval harness catches a wrong answer faster than a demo does. Presence accuracy is the test here: after a teacher removes a learner, no later client action should resurrect that learner from a stale event. The transport can be WebSocket or WebRTC; the contract is what keeps the decision stable.
How should realtime access revocation contracts protect an online classroom?
Start with one authority. The application database owns membership and a monotonically increasing membership_version. The realtime layer carries notifications, while the room service checks the token at join and at renewal. A client may render an optimistic roster, but it cannot grant itself access.
The event shape should be boring and durable. A member.revoked event needs a room identifier, member identifier, membership version, event identifier, and an issued-at timestamp. The token needs the same room and member identifiers plus the version it was minted against. Clients store the greatest version they have seen; an older event is ignored rather than allowed to roll state backward.
No magic.
That last rule matters during reconnect. A classroom laptop can reconnect after a Wi-Fi change while a revocation is crossing the network. If the reconnect presents version 12 and the server now requires version 13, the server rejects the join and sends a fresh snapshot. The roster then converges on the authoritative state instead of guessing from the last packet.
A small Python contract before the transport
Here is the adapter I use in tests. It keeps the HTTP surface behind two functions, so the rest of the application can be evaluated with a fake server. The routes are intentionally explicit: token issue, token revoke, room creation, and room lookup are separate operations.
from dataclasses import dataclass
from typing import Any, Protocol
import requests
BASE_URL = "https://api.example.test"
class HttpClient(Protocol):
def post(self, path: str, json: dict[str, Any], timeout: float) -> Any: ...
@dataclass(frozen=True)
class Membership:
room: str
member: str
version: int
def issue_token(http: HttpClient, membership: Membership) -> str:
response = http.post(
"/v1/realtime/token/issue",
json={
"room": membership.room,
"member": membership.member,
"membership_version": membership.version,
},
timeout=3.0,
)
response.raise_for_status()
return response.json()["token"]
def revoke_token(http: HttpClient, membership: Membership) -> dict[str, Any]:
response = http.post(
"/v1/realtime/token/revoke",
json={
"room": membership.room,
"member": membership.member,
"membership_version": membership.version,
},
timeout=3.0,
)
response.raise_for_status()
return response.json()
The data contract is the important part, not the requests import. In production I pass an authenticated client and record the response's event identifier. In tests I assert that a revoke increments the required version and that a reconnect with an older version is denied. I don't let a UI callback call the room API directly; one service owns the sequence and emits the event after the membership write commits.
The race that makes presence lie
Consider a concrete sequence in a logistics classroom. At 09:14:02, the instructor revokes learner-17; the database records version 44. At 09:14:03, the learner's tab sends a heartbeat created under version 43. At 09:14:04, a delayed presence message says online=true. A naive client paints the learner green again. The failure is subtle because every individual packet looks valid: the heartbeat was signed, the event was delivered, and the browser connection is still open. Only the version tells you that the packet belongs to an earlier authorization decision. I keep that version beside the member ID in logs and in the client cache, so a replay is visible during an incident instead of becoming a mysterious roster flicker.
The fix is an ordering check, not a faster socket. Every presence update carries membership_version. The client compares it with its local value, and the server validates the token before accepting a heartbeat. Events with version 43 cannot overwrite version 44. When the tab reconnects, it must obtain a token for version 44; a revoked member gets no token and therefore no room session.
Measure the transition.
Keep authentication, subscription state, and business events observable separately. Log the token decision (accepted, expired, or revoked), the subscription transition, and the event identifier as three fields. That lets an evaluator distinguish “the member is forbidden” from “the member is allowed but the roster update was delayed.” Those are different failures with different fixes.
One short rule: stale data must lose.
| State | Server action | Client view |
|---|---|---|
| Current version | accept token and heartbeat | show presence |
| Older version | reject join or heartbeat | fetch a snapshot |
| Revoked member | deny token renewal | remove from roster |
Testing recovery instead of the happy path
My notebook-to-prod check uses a matrix, not a single integration test. I replay duplicate revocations, an event arriving before the room snapshot, an expired token during a live session, and a reconnect that sends an old membership version. The expected result is idempotent: one logical revocation, one terminal membership state, and no new media permission.
For a WebRTC classroom, authorization still belongs outside the media channel. The W3C WebRTC Recommendation describes the browser objects and connection model, but it does not decide whether a particular learner may enter your room. Your signaling and token service make that decision; closing a peer connection is the enforcement action after revocation. The roster event is a UX signal, not proof of identity.
I also put a cost guard around the recovery path. A full snapshot on every heartbeat wastes bandwidth and makes prompt-driven assistants harder to evaluate because the state changes too often. Send snapshots on join or version mismatch, and send small events for ordinary presence changes. Your mileage may vary with class size, but the contract stays the same.
Trade-offs and an operational decision rule
Short token lifetimes limit the window in which a stolen credential can be useful, while aggressive expiry can kick a learner during a flaky connection. Long-lived tokens reduce renewal traffic but make revocation less immediate. The right value depends on the classroom's risk and network profile; measure the observed revocation-to-disconnect interval instead of choosing from a slogan.
An in-memory presence cache is quick and easy to invalidate, yet it disappears during a process restart. A durable membership record survives restart but needs a fan-out mechanism to notify every connected room. A single authoritative write plus replayable events costs more design work than a boolean online flag. It buys a state transition you can audit.
The catch is scope. This contract is not suitable when you need a complete recording platform, identity proofing, or guaranteed delivery across an offline-first client; choose a system designed for those requirements and keep the same versioned boundary. It is a good fit when the hard requirement is accurate access revocation and presence in a shared logistics classroom.
Before shipping, I check four things in prose: the membership write and revocation event have one version; reconnects fetch state when versions diverge; expired and revoked tokens produce distinct metrics; and a duplicate event cannot move a member from revoked back to online. If any answer is vague, the API choice is premature.
