[csc-jm]

Fixes #85

[Copilot]

Note

Copilot was unable to complete this review at the selected tier due to model policy or plan restrictions.

🟡 Changes recommended

A critical parse-time syntax error in search_api/services/auth.py (Python 2-style except ValueError, AttributeError in both refresh and another handler) prevents the module from importing, breaking all auth routes and tests until the exception syntax is corrected.

1 open issue

• Python 2 except syntax breaks auth module import · New

What changed in this PR

This PR revokes the LS AAI refresh token when a user logs out (fixes #85). Previously logout only cleared browser cookies, leaving the refresh token valid at LS AAI for about a month; because the refresh cookie uses Path=/refresh, GET /logout never receives it. The PR adds a DELETE /refresh endpoint that reads the refresh cookie, revokes the token at the provider's revocation_endpoint (RFC 7009), and clears both cookies, with the UI calling it before /logout.

Changes:

• Add AuthServiceHandler.revoke() to POST the refresh token to the discovered revocation_endpoint using client-secret basic auth, logging failures without leaking the token and never raising.
• Add the DELETE /refresh route that revokes the token (when present) and always clears both session cookies with 204.
• Update mock auth, unit/integration tests, and documentation (CLAUDE.md, UI handoff doc) to cover revocation.

File	Description
tests/​unit/​services/​test_auth.py	Adds unit tests for revoke() covering basic-auth request shape, failure logging without the token, and missing/unreachable discovery.
tests/​unit/​api/​auth/​test_routes.py	Adds route tests that DELETE /refresh revokes and clears both cookies, and skips revocation when no cookie is present.
tests/​integration/​mockauth.py	Adds a /revoke endpoint and advertises revocation_endpoint in discovery so integration tests can exercise revocation.
tests/​integration/​api/​test_auth.py	Adds an end-to-end test that a revoked refresh token is rejected on a later /refresh.
search_api/​services/​auth.py	Adds the revoke() method; contains a Python 2 except syntax error that prevents the module from importing.
search_api/​api/​auth/​routes.py	Adds the DELETE /refresh route wiring revocation and cookie clearing.
docs/​ui-lsaai-token-handoff.md	Documents DELETE /refresh behavior and the UI's pre-logout revocation flow.
CLAUDE.md	Documents the new revocation-on-logout behavior in the auth overview.

_{Review effort: Max}