revoke method

Future<void> revoke(String clientId, { required Object? user, required String? actor, })

Revokes client clientId of the current organization; its tokens stop on their next use.

Implementation

Future<void> revoke(
  String clientId, {
  required Object? user,
  required String? actor,
}) async {
  final DVPlatformApi platform = _platform();
  final DVOAuthProvider provider = await _provider(platform);
  final String tenant = const DVTenants().currentTenant;
  final DVOAuthClient? client = await provider.findClient(clientId);
  // The tenant check, not just existence. Without it a caller on one
  // tenant revokes another tenant's client by naming its id, which is the
  // whole of what the ownership check was for.
  if (client == null || client.tenant != tenant) {
    throw StateError(
        'No OAuth client with that id belongs to this tenant.');
  }
  await _authorize<DVOAuthClientResource>(
    authorization,
    user,
    'delete',
    DVOAuthClientResource(
      tenant: tenant,
      client: client,
      scopes: client.scopes,
      redirectUris: client.redirectUris,
      isPublic: client.isPublic,
    ),
  );
  await provider.revokeClient(clientId, actor: actor);
}