A harness that disconnects revokes its token: POST /oauth/revoke (RFC 7009) and revocation_endpoint in the metadata #8367

POST /oauth/revoke (RFC 7009) now ends a token that OAuth minted, so a harness that disconnects loses its access. bun x tsc --noEmit, bun scripts/gate.ts and the OAuth, discovery and migration tests pass; the forge's full check runs on this push.

• Route: it takes a form-encoded or JSON token and needs no session. It always answers an empty 200 with no-store, whether the token was OAuth-minted, unknown, empty, already revoked or a personal one. A personal token made in settings is left alone and still works.
• Timing: I didn't measure that a hit and a miss take similar time. Both run the same single hash lookup, and a hit adds one delete and an event write.
• Rate limit: 60 requests per minute per address. /oauth/token has no limiter today, so I added a separate one for this route rather than sharing registration's.
• Metadata: both well-known documents name revocation_endpoint, and I also added revocation_endpoint_auth_methods_supported: ["none"].
• Audit: a revocation writes a token.deleted event for the token's owner, with via: "oauth_revoke" in the payload.
• Migration: nothing in the database marked a token as OAuth-minted, so I added a new oauth_token table (migration 20261102160000-oauth-token, with its pin). redeemCode writes a row for each token it mints.
• Tests: test/oauth-revoke.test.ts covers revoke → 401 from /mcp and /api/v1, the audit event, unknown/empty/repeat → 200 with no body, a personal token surviving, and both metadata documents.

Not done:

• Tokens OAuth minted before this migration carry no mark, so this route can't revoke them. Their owners still delete them in settings.
• token_type_hint is ignored (RFC 7009 allows that), and there are no refresh tokens to revoke.

Try it: connect a client over OAuth, then run curl -X POST -d token=forge_… $FORGE_URL/oauth/revoke. The next call with that token gets a 401.

Closes #8360

POST /oauth/revoke (RFC 7009) now ends a token that OAuth minted, so a harness that disconnects loses its access. bun x tsc --noEmit, bun scripts/gate.ts and the OAuth, discovery and migration tests pass; the forge's full check runs on this push.

• Route: it takes a form-encoded or JSON token and needs no session. It always answers an empty 200 with no-store, whether the token was OAuth-minted, unknown, empty, already revoked or a personal one. A personal token made in settings is left alone and still works.
• Timing: I didn't measure that a hit and a miss take similar time. Both run the same single hash lookup, and a hit adds one delete and an event write.
• Rate limit: 60 requests per minute per address. /oauth/token has no limiter today, so I added a separate one for this route rather than sharing registration's.
• Metadata: both well-known documents name revocation_endpoint, and I also added revocation_endpoint_auth_methods_supported: ["none"].
• Audit: a revocation writes a token.deleted event for the token's owner, with via: "oauth_revoke" in the payload.
• Migration: nothing in the database marked a token as OAuth-minted, so I added a new oauth_token table (migration 20261102160000-oauth-token, with its pin). redeemCode writes a row for each token it mints.
• Tests: test/oauth-revoke.test.ts covers revoke → 401 from /mcp and /api/v1, the audit event, unknown/empty/repeat → 200 with no body, a personal token surviving, and both metadata documents.

Not done:

• Tokens OAuth minted before this migration carry no mark, so this route can't revoke them. Their owners still delete them in settings.
• token_type_hint is ignored (RFC 7009 allows that), and there are no refresh tokens to revoke.

Try it: connect a client over OAuth, then run curl -X POST -d token=forge_… $FORGE_URL/oauth/revoke. The next call with that token gets a 401.

I've pushed the review changes to the same branch. bun x tsc --noEmit, bun scripts/gate.ts, test/oauth-revoke.test.ts (7 tests) and test/readme-cap.test.ts all pass. I did not run bun scripts/design-lint.ts (no src/web/ change) or the full suite; the forge's check runs that on the push.

POST /oauth/revoke (RFC 7009) ends a harness's own OAuth-minted token and is listed as revocation_endpoint in both well-known documents. It answers an empty 200 for any token it is given, including unknown, repeated and personal ones, so it never says whether a token existed.

Changes in this round

• How-to: docs/features/oauth-revoke.md covers how to call it, what it answers (200, 413, 429 with Retry-After), and that tokens minted before the migration can't be revoked. README.md is untouched.
• Person's side: I argued no new TUI screen is needed instead of adding one, and the how-to says so. The settings token list and the terminal's sign-ins screen (d deletes) already delete any token, and the delete removes its oauth_token row by cascade. I did not show OAuth-minted tokens as such in either list; say if you want that instead.
• Limits: the revoke now has a whole-forge cap of 600 a minute beside the per-address 60. The 429 test covers the per-address limit only. I didn't test the whole-forge cap, since reaching it would take 600 requests.
• Tests: new tests cover a JSON-body revoke, the oauth_token row going away on revoke, and a settings-style delete cascading to it. The 429 test described above is also new.
• Clean-up: revokeLimiterOf and limiterOf are replaced by one limiterIn(store, app, perMinute) helper, and the long import in src/http/oauth.ts is wrapped.

To try it: curl -X POST https://lab--8367--forge-trevato-apps.open-platform.sh/oauth/revoke -d token=<access_token> answers an empty 200, and the token is then refused at /mcp and /api/v1.

This pull adds POST /oauth/revoke (RFC 7009), so a harness that disconnects can end its own OAuth token. The how-to, the whole-forge cap and the tests for JSON, cascade and 429 came with the earlier commits.

The check failed on one test, "no retry in the gate". Its detector flagged a variable named retry in test/oauth-revoke.test.ts, which only holds the Retry-After header from the 429 response. I renamed it to waitHeader; the assertions are unchanged.

test/flake.test.ts and test/oauth-revoke.test.ts pass here (38 tests). I didn't re-run the gate script or the type check for this change, which only touches a test. The forge's full check runs on the push.

To try it, send a POST to /oauth/revoke with a harness's token. Past the per-address limit it answers 429 with Retry-After.