feat(authn/oidc): add front-channel logout support

[erka]

• Add AllowFrontChannelLogout config option for OIDC providers
• Route GET /auth/v1/method/oidc/{provider}/revoke to Revoke handler
• Validate iss/sid query params on front-channel logout requests
• Clear session cookies via ForwardRevokeOIDCResponseOption only when
  front-channel logout succeeds (gated by provider config)
• Set SameSite=None on cleared cookies so browser discards them in
  cross-origin iframe context (required by OIDC front-channel logout)
• Add proto fields iss/sid to RevokeOIDCRequest for front-channel params

[github-actions]

The latest Buf updates on your PR. Results from workflow Proto / proto-lint (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jul 15, 2026, 11:00 PM

[codecov]

Codecov Report

❌ Patch coverage is 84.28571% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.37%. Comparing base (555c557) to head (e45a25e).

Files with missing lines	Patch %	Lines
internal/server/authn/method/oidc/server.go	75.00%	8 Missing and 1 partial ⚠️
internal/cmd/authn.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##               v2    #6164      +/-   ##
==========================================
+ Coverage   62.27%   62.37%   +0.09%     
==========================================
  Files         145      145              
  Lines       14815    14867      +52     
==========================================
+ Hits         9226     9273      +47     
- Misses       4829     4833       +4     
- Partials      760      761       +1     

Flag	Coverage Δ
integrationtests	33.38% <0.00%> (-0.13%)	⬇️
unittests	53.98% <84.28%> (+0.12%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Verdict: request changes

The front-channel logout wiring is well-structured and the session.secure validation is solid, but the prior review’s major concern remains unaddressed: ForwardRevokeOIDCResponseOption unconditionally clears session cookies for every successful GET /auth/v1/method/oidc/{provider}/revoke—including no-op responses where sid/iss is missing or no matching session was found. This incorrectly logs out the currently authenticated user when the front-channel request targets a different (or absent) session.

internal/server/authn/middleware/http/middleware.go

• major (L71): Clearing session cookies unconditionally for every successful GET /auth/v1/method/oidc/{provider}/revoke will force-logout the current browser user even when the Revoke handler returned a no-op because sid/iss was missing, mismatched, or no session was found. The handler should signal when sessions were actually terminated (e.g., by setting outgoing gRPC metadata such as x-oidc-session-cleared), and this middleware should check for that signal before calling clearAllCookies.

🤖 Automated review by the Flipt PR review agent.

[erka]

I'll stop here. If anyone has security concerns about Front-Channel Logout, Back-Channel Logout is available as an alternative. Azure, please consider supporting Back-Channel Logout as well.

[erka]

The front-channel logout wiring is well-structured and the session.secure validation is solid, but the prior review’s major concern remains unaddressed: ForwardRevokeOIDCResponseOption unconditionally clears session cookies for every successful GET /auth/v1/method/oidc/{provider}/revoke—including no-op responses where sid/iss is missing or no matching session was found. This incorrectly logs out the currently authenticated user when the front-channel request targets a different (or absent) session.

OIDC Front-Channel Logout specifies that sid and iss are optional. Because the logout URL is loaded in a hidden iframe, no cookies are sent to Flipt, so there is nothing to clean up on the server side without additional hints. If sid and iss are not provided, Flipt can only clear the browser cookies. Likewise, if no authentication record is found in Flipt, clearing the browser cookies is sufficient, as I see it.