Revoke the access token before completing sign out

[brionmario]

Purpose

signOut() only cleared the local session and, when RP-Initiated Logout is enabled, redirected to the OP's end_session_endpoint. It never revoked the access token itself, so a client-side sign out could leave the token valid at the OP.

Approach

Adds a tokenLifecycle.revokeToken.revokeOnSignOut config (default true) and has signOut() revoke the access token at the OP's revocation_endpoint first, before the existing RP-Initiated Logout / local-only sign-out logic runs.

Revocation is best-effort: if it fails (no revocation_endpoint advertised, network error, non-200 response — e.g. for non-OAuth sessions), the error is caught and logged at debug level, and sign out proceeds exactly as it did before, since the local session must be cleared regardless.

Set tokenLifecycle: { revokeToken: { revokeOnSignOut: false } } to opt out and skip revocation entirely.

Related Issues

• N/A

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 63337ef

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[brionmario]

Superseded by thunder-id#70, opened against the correct upstream repo.