When an App Token is deleted from the database, it is currently still possible to use it with the initial scope until its expiration date. This should not be allowed.
Once an app token is deleted in the database, it should no longer be valid for authentication. Make the necessary changes to the authentication, claims initialization and verification and surrounding code to implement this requirement