docs: reorder & testing

gateway/cmd/gateway/main.go

@@ -153,7 +153,11 @@ func newAuthenticatedGRPCDependencies(ctx context.Context, cfg config.Config, lo
 		)
 	}
 
-	sessionCache, err := session.NewBackendCache(backend.REST())
+	sessionCache, err := session.NewMemoryCache(backend.REST(), session.MemoryCacheOptions{
+		MaxEntries: cfg.SessionCache.MaxEntries,
+		TTL:        cfg.SessionCache.TTL,
+		Logger:     logger,
+	})
 	if err != nil {
 		return grpcapi.ServerDependencies{}, nil, nil, errors.Join(
 			fmt.Errorf("build authenticated grpc dependencies: %w", err),
@@ -171,20 +175,27 @@ func newAuthenticatedGRPCDependencies(ctx context.Context, cfg config.Config, lo
 
 	pushHub := push.NewHubWithObserver(0, telemetry.NewPushObserver(telemetryRuntime))
 
-	dispatcher := events.NewDispatcher(pushHub, pushHub, logger, telemetryRuntime)
+	// Composite invalidator: every session_invalidation event flips the
+	// cached record to revoked AND closes any active push subscription.
+	invalidator := &cacheAndHubInvalidator{cache: sessionCache, hub: pushHub}
+	dispatcher := events.NewDispatcher(pushHub, invalidator, logger, telemetryRuntime)
 	pushClient := backend.Push().
 		WithLogger(logger).
 		WithHandler(dispatcher)
 
 	userRoutes := backendclient.UserRoutes(backend.REST())
 	lobbyRoutes := backendclient.LobbyRoutes(backend.REST())
-	allRoutes := make(map[string]downstream.Client, len(userRoutes)+len(lobbyRoutes))
+	gameRoutes := backendclient.GameRoutes(backend.REST())
+	allRoutes := make(map[string]downstream.Client, len(userRoutes)+len(lobbyRoutes)+len(gameRoutes))
 	for k, v := range userRoutes {
 		allRoutes[k] = v
 	}
 	for k, v := range lobbyRoutes {
 		allRoutes[k] = v
 	}
+	for k, v := range gameRoutes {
+		allRoutes[k] = v
+	}
 
 	cleanup := func() error {
 		return closeRedisClient()
@@ -202,6 +213,40 @@ func newAuthenticatedGRPCDependencies(ctx context.Context, cfg config.Config, lo
 	}, []app.Component{pushClient}, cleanup, nil
 }
 
+// cacheAndHubInvalidator fans every session-invalidation push frame
+// out to both the session cache (so subsequent Lookups see the
+// session as revoked without a backend round-trip) and the push hub
+// (so any active SubscribeEvents stream bound to the session is
+// closed immediately). The shape matches `events.SessionInvalidator`.
+type cacheAndHubInvalidator struct {
+	cache session.Cache
+	hub *push.Hub
+}
+
+func (c *cacheAndHubInvalidator) RevokeDeviceSession(deviceSessionID string) {
+	if c == nil {
+		return
+	}
+	if c.cache != nil {
+		c.cache.MarkRevoked(deviceSessionID)
+	}
+	if c.hub != nil {
+		c.hub.RevokeDeviceSession(deviceSessionID)
+	}
+}
+
+func (c *cacheAndHubInvalidator) RevokeAllForUser(userID string) {
+	if c == nil {
+		return
+	}
+	if c.cache != nil {
+		c.cache.MarkAllRevokedForUser(userID)
+	}
+	if c.hub != nil {
+		c.hub.RevokeAllForUser(userID)
+	}
+}
+
 // authServiceAdapter adapts backendclient.RESTClient to the
 // restapi.AuthServiceClient interface so the public REST handlers can stay
 // unchanged. The two surfaces share the same JSON wire shape; only the Go