revoke method
Revokes session at the authorization server and removes it locally.
When the server publishes an RFC 7009 revocation_endpoint, the refresh
token is POSTed to it with a DPoP proof so the grant actually dies at the
server; the refresh token is used in preference to the access token
because revoking it takes the whole grant down with it, whereas revoking
an access token leaves the refresh token able to mint new ones. A server
that publishes no such endpoint (the common case for atproto entryways
today) is simply skipped.
The network call is best-effort: RFC 7009 Section 2.2 already
requires a 200 for an unknown token, and a logout must not be blocked
by an unreachable or misbehaving server. Any failure is swallowed and the
local delete still happens, so this method never throws for a network or
server-side reason.
Implementation
Future<void> revoke(final OAuthSession session) async {
try {
await _revokeAtServer(session);
} on Exception {
// Best-effort: a failed server-side revocation must not strand the
// session in the local store.
}
await _sessionStore.delete(session.sub);
}