feat(OIDC): add support for end_session for V2 tokens (#6226)

This PR adds support for the OIDC end_session_endpoint for V2 tokens. Sending an id_token_hint as parameter will directly terminate the underlying (SSO) session and all its tokens. Without this param, the user will be redirected to the Login UI, where he will able to choose if to logout.

internal/query/access_token.go

@@ -9,6 +9,7 @@ import (
 	caos_errs "github.com/zitadel/zitadel/internal/errors"
 	"github.com/zitadel/zitadel/internal/eventstore"
 	"github.com/zitadel/zitadel/internal/repository/oidcsession"
+	"github.com/zitadel/zitadel/internal/repository/session"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 )
 
@@ -28,7 +29,7 @@ type OIDCSessionAccessTokenReadModel struct {
 	AccessTokenExpiration time.Time
 }
 
-func newOIDCSessionAccessTokenWriteModel(id string) *OIDCSessionAccessTokenReadModel {
+func newOIDCSessionAccessTokenReadModel(id string) *OIDCSessionAccessTokenReadModel {
 	return &OIDCSessionAccessTokenReadModel{
 		WriteModel: eventstore.WriteModel{
 			AggregateID: id,
@@ -89,14 +90,14 @@ func (wm *OIDCSessionAccessTokenReadModel) reduceTokenRevoked(e eventstore.Event
 }
 
 // ActiveAccessTokenByToken will check if the token is active by retrieving the OIDCSession events from the eventstore.
-// refreshed or expired tokens will return an error
+// Refreshed or expired tokens will return an error as well as if the underlying sessions has been terminated.
 func (q *Queries) ActiveAccessTokenByToken(ctx context.Context, token string) (model *OIDCSessionAccessTokenReadModel, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
 	split := strings.Split(token, "-")
 	if len(split) != 2 {
-		return nil, caos_errs.ThrowPermissionDenied(nil, "QUERY-SAhtk", "Errors.OIDCSession.Token.Invalid")
+		return nil, caos_errs.ThrowPermissionDenied(nil, "QUERY-LJK2W", "Errors.OIDCSession.Token.Invalid")
 	}
 	model, err = q.accessTokenByOIDCSessionAndTokenID(ctx, split[0], split[1])
 	if err != nil {
@@ -105,14 +106,17 @@ func (q *Queries) ActiveAccessTokenByToken(ctx context.Context, token string) (m
 	if !model.AccessTokenExpiration.After(time.Now()) {
 		return nil, caos_errs.ThrowPermissionDenied(nil, "QUERY-SAF3rf", "Errors.OIDCSession.Token.Expired")
 	}
-	return
+	if err = q.checkSessionNotTerminatedAfter(ctx, model.SessionID, model.AccessTokenCreation); err != nil {
+		return nil, err
+	}
+	return model, nil
 }
 
 func (q *Queries) accessTokenByOIDCSessionAndTokenID(ctx context.Context, oidcSessionID, tokenID string) (model *OIDCSessionAccessTokenReadModel, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	model = newOIDCSessionAccessTokenWriteModel(oidcSessionID)
+	model = newOIDCSessionAccessTokenReadModel(oidcSessionID)
 	if err = q.eventstore.FilterToQueryReducer(ctx, model); err != nil {
 		return nil, caos_errs.ThrowPermissionDenied(err, "QUERY-ASfe2", "Errors.OIDCSession.Token.Invalid")
 	}
@@ -121,3 +125,28 @@ func (q *Queries) accessTokenByOIDCSessionAndTokenID(ctx context.Context, oidcSe
 	}
 	return model, nil
 }
+
+// checkSessionNotTerminatedAfter checks if a [session.TerminateType] event occurred after a certain time
+// and will return an error if so.
+func (q *Queries) checkSessionNotTerminatedAfter(ctx context.Context, sessionID string, creation time.Time) (err error) {
+	ctx, span := tracing.NewSpan(ctx)
+	defer func() { span.EndWithError(err) }()
+
+	events, err := q.eventstore.Filter(ctx, eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
+		AllowTimeTravel().
+		AddQuery().
+		AggregateTypes(session.AggregateType).
+		AggregateIDs(sessionID).
+		EventTypes(
+			session.TerminateType,
+		).
+		CreationDateAfter(creation).
+		Builder())
+	if err != nil {
+		return caos_errs.ThrowPermissionDenied(err, "QUERY-SJ642", "Errors.Internal")
+	}
+	if len(events) > 0 {
+		return caos_errs.ThrowPermissionDenied(nil, "QUERY-IJL3H", "Errors.OIDCSession.Token.Invalid")
+	}
+	return nil
+}