Function revokeToken

packages/web/src/ee/features/oauth/server.ts:206–216

(rawToken: string)

// Revokes an access token or refresh token by hashing it and deleting the DB record.
// Per RFC 7009, revocation always succeeds even if the token doesn't exist.
export async function revokeToken(rawToken: string): Promise<void> {
    if (rawToken.startsWith(OAUTH_ACCESS_TOKEN_PREFIX)) {
        const secret = rawToken.slice(OAUTH_ACCESS_TOKEN_PREFIX.length);
        const hash = hashSecret(secret);
        await __unsafePrisma.oAuthToken.deleteMany({ where: { hash } });
    } else if (rawToken.startsWith(OAUTH_REFRESH_TOKEN_PREFIX)) {
        const secret = rawToken.slice(OAUTH_REFRESH_TOKEN_PREFIX.length);
        const hash = hashSecret(secret);
        await __unsafePrisma.oAuthRefreshToken.deleteMany({ where: { hash } });
    }
}