anti c82897193e feat(auth): logout endpoint revokes the presented token ...

POST /auth/logout adds the caller's jti to the denylist and drops the
local negative-cache entry, so the token 401s on its very next use.
Single-session semantics: only this token dies, other sessions for the
same user keep working. Reachable for must_change_password users (it
runs the revocation checks but skips the must_change gate via
get_token_claims) so a session can always be ended; an already-revoked
token is rejected.

2026-05-30 18:21:16 -04:00

3.4 KiB

Raw Blame History

View Raw