Matthieu MALVACHE 2f20aa835b feat(auth): add RP-initiated logout and OAuth unit tests ...

Logout now revokes the refresh token and redirects to the IdP's
end_session_endpoint so the SSO session is fully terminated. The
end_session_url is validated server-side (HTTPS only) before being
returned to the client, preventing open redirect attacks.

Also adds 14 unit tests covering PKCE (including RFC 7636 test vector)
and OAuth discovery (fallback, caching, required field validation).

2026-02-26 00:07:38 +01:00

..

route.ts

feat(auth): add RP-initiated logout and OAuth unit tests

2026-02-26 00:07:38 +01:00