Invalidate everything this authorization server issued for one subject
(#296).
The Store owns the credential-change flow — issuing the reset token,
delivering it, writing the new password. What it cannot do from outside is
kill the sessions and tokens already minted against the old credential, and
that is this function's whole job. The service calls it immediately after
the credential write.
The watermark is written first, before any session is cascaded. Two
reasons, and both are the difference between working and not:
A refresh rotation or a concurrent login on another replica can mint a
token during the cascade loop. Enumerating sessions first and writing
the watermark afterwards leaves that token outside both mechanisms —
its session was not in the list, and its iat predates the watermark
that had not yet been written.
On partial failure the safe direction is "tokens dead, some sessions
perhaps alive", not the reverse. A live session with no usable token
can be cleaned up on retry; a live token is the thing being revoked.
This never throws. The caller has already written the new credential and
has no undo, so an exception would replace a partial result it could act on
— retry these sids, alert on that outage — with nothing at all. Every store
call is therefore reported rather than propagated, and complete is the one
field a caller has to check.
Does not fix #276 — the local logout route still does not run the
cascade for its own session. This builds on cascadeLogout, which is
complete; the gap there is that one caller does not invoke it.
Invalidate everything this authorization server issued for one subject (#296).
The Store owns the credential-change flow — issuing the reset token, delivering it, writing the new password. What it cannot do from outside is kill the sessions and tokens already minted against the old credential, and that is this function's whole job. The service calls it immediately after the credential write.
The watermark is written first, before any session is cascaded. Two reasons, and both are the difference between working and not:
iatpredates the watermark that had not yet been written.This never throws. The caller has already written the new credential and has no undo, so an exception would replace a partial result it could act on — retry these sids, alert on that outage — with nothing at all. Every store call is therefore reported rather than propagated, and
completeis the one field a caller has to check.Does not fix #276 — the local logout route still does not run the cascade for its own session. This builds on
cascadeLogout, which is complete; the gap there is that one caller does not invoke it.