Revoke tokens by default upon logout

[Johngren]

:rainbow: Feature

**As an application owner

**I want the tokens of my users to be revoked by default upon logout request

**So that there is no risk of Access Tokens and Refresh Tokens being used after a user is logged out

:sunrise_over_mountains: Additional information

• Breaking change - Release notes important!
• No longer optional to pass invalid_tokens params to logout endpoint
• Remove invalid_tokens params from AM
• Keep the option of being able to pass invalid_tokens but notice customers it will be deprecated

:link: Dependencies

Link a story or other related things...

:camera: Mockups

Insert screenshots, drawings...

:books: Documentation required

Provide link to the issue for documentation update

:superhero: Acceptance criteria

• [ ] Given an end user wants to log out Then all issued tokens for that user will be revoked When calling the logout endpoint

:warning: Potential impacts

What are the impacted versions? 3.19

:heavy_check_mark: Definition of Done

For each User Story everything on the list must be considered, select only what was required

• [ ] Acceptance criteria met and tested
• [ ] Sonar Cloud quality gate passes
• [ ] CircleCi checks pass
• [ ] Cypress or Postman API check passes
• [ ] Test containers passed if modifications on the repository modules
• [ ] Translation for portal UI checked
• [ ] Developer created draft documentation PR
• [ ] New migration scripts checked Can be run multiple times but only makes changes the first time Display to user what script has done
• [ ] Validated on appropriate environment
• [ ] Existing test cases refactored

:rocket:

[omatthewsgravitee]

Hey team! Please add your planning poker estimate with ZenHub @ashraf706 @farmborough @leleueri @remisultan @patelami