feat(be): revoke sessions from the user's own settings

[sea-snake]

Design: #4224. Overview: #4230. An app can sign out only its own session (#4245), so "sign this browser out" has to come from somewhere the anchor itself is authenticated. The two revocation surfaces are split by what each caller can prove:

Caller	Authenticated as	May revoke	Names a session by
The app	its own session chain	only its own	nothing; caller() is looked up in the session index
The II frontend	an anchor access method	any session of that anchor	(origin, account, created_at), or a whole device_id

• revoke_account_session takes (identity_number, origin, account_number, created_at). Two browsers signing in during the same round share a created_at, so it can match more than one; revoking both is the right outcome, since the user named that moment at that account.
• revoke_device_sessions takes (identity_number, device_id) and sweeps that anchor's references in one message, writing only rows that hold that device's sessions. Atomic, with no partially-revoked state.
• Both name sessions by locator, never by principal, so they do not touch the principal index; that stays on the app-facing path only.
• Sweeping eagerly is what keeps refresh cheap. Marking a device revoked and checking it during refresh would make revocation O(1) but add an anchor read to a call that otherwise never touches the anchor, and refresh happens every few minutes per active session.
• The device record survives the sweep, so a browser that has been signed out is still one the user recognises, and signing back in from it reuses the same id. Deleting a device record is a separate operation, not specified here.

There is no session listing method, deliberately. A flat "every session of this anchor" call returns a list bounded only by the caps and mixes every origin together. The right decomposition is applications first, then sessions within one, and that wants designing alongside whatever lists applications. Neither exists yet.

Tests: session_revocation_tests (5), including revoking by creation time covering same-round siblings. PocketIC covers revocation by another anchor being Unauthorized, and a whole browser signed out across two apps while a second browser keeps working and the device record stays listed.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 77fad44.

Security Overview

• 🔎 Scanned files: 10 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=1f2ade60-aca8-4ecd-b775-ce83801dac81&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► src/canister_tests/src/api/internet_identity/api_v2.rs     Add revoke_account_session and revoke_device_sessions functions ► src/frontend/src/lib/generated/internet_identity_idl.js     Extend IDL with RevokeAccountSessionRequest, SessionRevokeError, RevokeDeviceSessionsRequest and corresponding functions ► src/frontend/src/lib/generated/internet_identity_types.d.ts     Add RevokeAccountSessionRequest, RevokeDeviceSessionsRequest, SessionRevokeError types and update _SERVICE with revoke_account_session and revoke_device_sessions ► src/internet_identity/internet_identity.did     Define RevokeAccountSessionRequest, RevokeDeviceSessionsRequest, and SessionRevokeError in DID ► src/internet_identity/src/main.rs     Expose revoke_account_session and revoke_device_sessions update calls ► src/internet_identity/src/sessions.rs     Implement revoke_account_session and revoke_device_sessions in session logic ► src/internet_identity/src/storage.rs     Add revoke_account_sessions to remove sessions by locator/origin and creation time ► src/internet_identity/src/storage/tests.rs     Add session_revocation_tests module to validate revocation behavior ► src/internet_identity/tests/integration/sessions.rs     Add integration tests for revoke_account_session and revoke_device_sessions ► src/internet_identity_interface/src/internet_identity/types.rs     Add RevokeAccountSessionRequest, RevokeDeviceSessionsRequest, and SessionRevokeError types in interface

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.