Logout and token revocation
Auto-generated from the source archive. Do not edit by hand — rerun
catalyst-changelog-syncinstead.
What changed
Section titled “What changed”- Adds a revoke-token flow:
POST /api/o-auth/revoke(RFC 7009) and the GraphQL twinoAuthRevokeToken. The presented refresh token and its paired access token are marked revoked, so any later refresh collapses toinvalid_grant. - Client authentication is HTTP Basic; revocation is idempotent and non-enumerable (unknown or already-revoked tokens return success) and is rate-limited at parity with token issuance. The frontend logout is wired to trigger it.
Why it matters
Section titled “Why it matters”Local-provider login worked, but there was no logout — a “logged out” user’s opaque refresh token stayed valid in the database until natural expiry, so a captured token kept minting access tokens after the session supposedly ended. Logout now ends the session server-side, not just by clearing local storage.