feat: delete OAuth refresh token on RP initiated logout (#1480)

tests/resources/export/database.json

@@ -1,6 +1,6 @@
 {
 	"provider": "sqlite",
-	"version": 20260418120000,
+	"version": 20260518222000,
 	"tableOrder": ["users", "user_groups", "oidc_clients", "signup_tokens"],
 	"tables": {
 		"api_keys": [
@@ -171,6 +171,7 @@
 			{
 				"client_id": "3654a746-35d4-4321-ac61-0bdcff2b4055",
 				"authentication_method": "phr",
+				"id_token_jti": "dd75f6f6-ce0a-44b7-a645-7de390ccd2fa",
 				"created_at": "2025-11-25T12:39:02Z",
 				"expires_at": "2025-11-26T12:39:02Z",
 				"id": "4928604e-e689-410c-9b25-5b9b6db9e46e",

tests/specs/oidc.spec.ts

@@ -130,7 +130,7 @@ test('End session without id token hint shows confirmation page', async ({ page
 
 test('End session with id token hint redirects to callback URL', async ({ page }) => {
 	const client = oidcClients.nextcloud;
-	const idToken = await generateIdToken(users.tim, client.id);
+	const idToken = await generateIdToken("fe81c12a-7336-4aee-bebc-d901a873bf48", users.tim, client.id);
 	let redirectedCorrectly = false;
 	await page
 		.goto(

tests/utils/jwt.util.ts

@@ -13,11 +13,12 @@ type User = {
 const privateKey = JSON.parse(PRIVATE_KEY_STRING);
 const privateKeyImported = await jose.importJWK(privateKey, 'RS256');
 
-export async function generateIdToken(user: User, clientId: string, expired = false) {
+export async function generateIdToken(jti: string, user: User, clientId: string, expired = false) {
 	const now = Math.floor(Date.now() / 1000);
 	const expiration = expired ? now + 1 : now + 1000000000; // Either expired or valid for a long time
 
 	const payload = {
+		jti,
 		aud: clientId,
 		email: user.email,
 		email_verified: true,