Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- When identity POSTs a logout_token to /api/v1/auth/oidc/backchannel-logout, the API shall verify it (RS256 vs their JWKS, iss=identity.rodmena.co.uk, aud=our client_id, exp future, events contains the backchannel-logout URI, REJECT any token carrying nonce) and return 200 on success / 400 on verification failure (never blind 200).
- When Highway issues an OIDC session JWT, it shall record the identity sub+sid alongside the email so a logout_token (which carries sub/sid, never email) can be resolved to Highway sessions.
- When a verified logout_token arrives, Highway shall revoke the matching session(s): by sid (single device) when present, else by sub (all devices), and the RBAC middleware shall reject revoked OIDC-issued Highway JWTs from that point.
- If the logout_token cannot be resolved to any known session, then the endpoint shall still return 200 (idempotent, per OIDC Back-Channel Logout semantics) while logging the unmatched sid.
- When implemented, Highway shall reply the registered https URI to identity thread thr-9dbe1df000c8432f8fe2 and verify propagation live (sign in via RODMENA ID, sign out AT identity, observe Highway session rejected).
Design notes: Highway JWTs are stateless today - needs sid claim in OIDC-issued JWTs + revocation store (oidc session table via highway-core migration) + middleware check with short cache. Trade-off documented in identity notice 01KYW29QA9J6H7KEEF71KSGBGY: their backchannel fires on logout, password reset/change, device revoke, account-claim - compromise-shaped events where all-device revocation is right. Their stateless-access-token 15-min caveat does not affect us (we never use their access tokens).

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #842