Stop signOut() blocking on access token revocation

[brionmario]

Purpose

Follow-up to #70. signOut() awaited requestAccessTokenRevocation() directly in the critical path before the redirect, with a 10s timeout as its upper bound. A slow or unreachable revocation_endpoint (or a CORS-unfriendly OP, which is common for revocation endpoints specifically) stalled the entire sign-out flow, since the app's authenticated UI typically tears down as soon as signOut() is called but the actual redirect doesn't fire until the revocation request settles or times out. That produced a blank/white page for up to 10 seconds on every sign out where revocation was enabled and slow.

Approach

Fires the revocation request without awaiting it, so its latency can't delay the redirect. Revocation stays best-effort exactly as before — failures are still caught and logged, just asynchronously now.

Since the request is no longer awaited, requestAccessTokenRevocation() now accepts an optional accessToken override. signOut() snapshots the access token from storage before firing the request off, instead of letting the request read it lazily from storage — otherwise the concurrent clearSession/clearSessionAsync call right after could remove the token from storage before the fire-and-forget request reads it, sending token=undefined to the OP.

Related Issues

• Revoke tokens when the user logs out thunderid#4891

Related PRs

• Revoke the access token before completing sign out #70

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided.
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[coderabbitai]

Warning

Review limit reached

@brionmario, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 2 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1145bd06-1a39-4b08-925c-827435717153

📥 Commits

Reviewing files that changed from the base of the PR and between 2bc2db2 and 45f97d4.

📒 Files selected for processing (4)

• packages/browser/src/ThunderIDBrowserClient.ts
• packages/browser/src/__tests__/ThunderIDBrowserClient.test.ts
• packages/javascript/src/ThunderIDJavaScriptClient.ts
• packages/javascript/src/__tests__/ThunderIDJavaScriptClient.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}