revoke method

Future<void> revoke(
  1. OAuthSession session
)

Revokes session at the authorization server and removes it locally.

When the server publishes an RFC 7009 revocation_endpoint, the refresh token is POSTed to it with a DPoP proof so the grant actually dies at the server; the refresh token is used in preference to the access token because revoking it takes the whole grant down with it, whereas revoking an access token leaves the refresh token able to mint new ones. A server that publishes no such endpoint (the common case for atproto entryways today) is simply skipped.

The network call is best-effort: RFC 7009 Section 2.2 already requires a 200 for an unknown token, and a logout must not be blocked by an unreachable or misbehaving server. Any failure is swallowed and the local delete still happens, so this method never throws for a network or server-side reason.

Implementation

Future<void> revoke(final OAuthSession session) async {
  try {
    await _revokeAtServer(session);
  } on Exception {
    // Best-effort: a failed server-side revocation must not strand the
    // session in the local store.
  }

  await _sessionStore.delete(session.sub);
}