feat(be): revoke sessions from the user's own settings

The app can sign out only its own session, so "sign this browser out" has to come
from somewhere the anchor is authenticated. These two are authenticated by an
anchor access method rather than by a session chain, and name sessions by locator
rather than by principal, so the principal index stays on the app-facing path.

Signing a browser out is an eager sweep of that anchor's references in one
message, so refresh never has to read the anchor to find out whether its device
was revoked: refresh happens every few minutes per active session, this happens
rarely. The device record survives the sweep, so a browser that has been signed
out is still one the user recognises and signing back in from it reuses the same
id.

Implements docs/ongoing/revocable-app-sessions.md §8.2, §9.3 (S16, S20).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: sea-snake

src/canister_tests/src/api/internet_identity/api_v2.rs

@@ -878,3 +878,37 @@ pub fn app_revoke_session_with_bundle(
     )
     .map(|_| ())
 }
+
+pub fn revoke_account_session(
+    env: &PocketIc,
+    canister_id: CanisterId,
+    sender: Principal,
+    request: RevokeAccountSessionRequest,
+) -> Result<Result<(), SessionRevokeError>, RejectResponse> {
+    call_candid_as(
+        env,
+        canister_id,
+        RawEffectivePrincipal::None,
+        sender,
+        "revoke_account_session",
+        (request,),
+    )
+    .map(|(x,)| x)
+}
+
+pub fn revoke_device_sessions(
+    env: &PocketIc,
+    canister_id: CanisterId,
+    sender: Principal,
+    request: RevokeDeviceSessionsRequest,
+) -> Result<Result<(), SessionRevokeError>, RejectResponse> {
+    call_candid_as(
+        env,
+        canister_id,
+        RawEffectivePrincipal::None,
+        sender,
+        "revoke_device_sessions",
+        (request,),
+    )
+    .map(|(x,)| x)
+}

src/frontend/src/lib/generated/internet_identity_idl.js

@@ -807,6 +807,20 @@ export const idlFactory = ({ IDL }) => {
     'canister_full' : IDL.Null,
     'registered' : IDL.Record({ 'user_number' : UserNumber }),
   });
+  const RevokeAccountSessionRequest = IDL.Record({
+    'origin' : IDL.Text,
+    'created_at' : Timestamp,
+    'account_number' : IDL.Opt(AccountNumber),
+    'identity_number' : UserNumber,
+  });
+  const SessionRevokeError = IDL.Variant({
+    'InternalCanisterError' : IDL.Text,
+    'Unauthorized' : IDL.Principal,
+  });
+  const RevokeDeviceSessionsRequest = IDL.Record({
+    'device_id' : IDL.Nat32,
+    'identity_number' : UserNumber,
+  });
   const SetDefaultAccountError = IDL.Variant({
     'NoSuchOrigin' : IDL.Record({ 'anchor_number' : UserNumber }),
     'NoSuchAnchor' : IDL.Null,
@@ -1440,6 +1454,16 @@ export const idlFactory = ({ IDL }) => {
       ),
     'remove' : IDL.Func([UserNumber, DeviceKey], [], []),
     'replace' : IDL.Func([UserNumber, DeviceKey, DeviceData], [], []),
+    'revoke_account_session' : IDL.Func(
+        [RevokeAccountSessionRequest],
+        [IDL.Variant({ 'Ok' : IDL.Null, 'Err' : SessionRevokeError })],
+        [],
+      ),
+    'revoke_device_sessions' : IDL.Func(
+        [RevokeDeviceSessionsRequest],
+        [IDL.Variant({ 'Ok' : IDL.Null, 'Err' : SessionRevokeError })],
+        [],
+      ),
     'set_default_account' : IDL.Func(
         [UserNumber, FrontendHostname, IDL.Opt(AccountNumber)],
         [IDL.Variant({ 'Ok' : AccountInfo, 'Err' : SetDefaultAccountError })],

src/frontend/src/lib/generated/internet_identity_types.d.ts

@@ -1614,6 +1614,16 @@ export type RegistrationFlowNextStep = {
     'Finish' : null
   };
 export type RegistrationId = string;
+export interface RevokeAccountSessionRequest {
+  'origin' : string,
+  'created_at' : Timestamp,
+  'account_number' : [] | [AccountNumber],
+  'identity_number' : UserNumber,
+}
+export interface RevokeDeviceSessionsRequest {
+  'device_id' : number,
+  'identity_number' : UserNumber,
+}
 /**
  * DNSSEC proof bundle and supporting types — see
  * `internet_identity_interface::types::dnssec`.
@@ -1648,6 +1658,8 @@ export interface SessionDeviceInfo {
   'last_used' : Timestamp,
 }
 export type SessionKey = PublicKey;
+export type SessionRevokeError = { 'InternalCanisterError' : string } |
+  { 'Unauthorized' : Principal };
 export type SetDefaultAccountError = {
     'NoSuchOrigin' : { 'anchor_number' : UserNumber }
   } |
@@ -2544,6 +2556,21 @@ export interface _SERVICE {
    * Atomically replace device matching the device key with the new device data
    */
   'replace' : ActorMethod<[UserNumber, DeviceKey, DeviceData], undefined>,
+  /**
+   * Revocation from the user's own settings, authenticated by an anchor access method
+   * rather than by a session chain. Sessions are named by locator, never by principal,
+   * so these do not touch the principal index.
+   */
+  'revoke_account_session' : ActorMethod<
+    [RevokeAccountSessionRequest],
+    { 'Ok' : null } |
+      { 'Err' : SessionRevokeError }
+  >,
+  'revoke_device_sessions' : ActorMethod<
+    [RevokeDeviceSessionsRequest],
+    { 'Ok' : null } |
+      { 'Err' : SessionRevokeError }
+  >,
   'set_default_account' : ActorMethod<
     [UserNumber, FrontendHostname, [] | [AccountNumber]],
     { 'Ok' : AccountInfo } |

src/internet_identity/internet_identity.did

@@ -1087,6 +1087,23 @@ type AppGetDelegationRequest = record {
     expiration : Timestamp;
 };
 
+type RevokeAccountSessionRequest = record {
+    identity_number : UserNumber;
+    origin : text;
+    account_number : opt AccountNumber;
+    created_at : Timestamp;
+};
+
+type RevokeDeviceSessionsRequest = record {
+    identity_number : UserNumber;
+    device_id : nat32;
+};
+
+type SessionRevokeError = variant {
+    Unauthorized : principal;
+    InternalCanisterError : text;
+};
+
 type AppSessionError = variant {
     // No session bundle was attached, or one this canister did not sign.
     NoSuchSession;
@@ -1969,6 +1986,12 @@ service : (opt InternetIdentityInit) -> {
     // session was already gone. An app can revoke only its own session.
     app_revoke_session : () -> ();
 
+    // Revocation from the user's own settings, authenticated by an anchor access method
+    // rather than by a session chain. Sessions are named by locator, never by principal,
+    // so these do not touch the principal index.
+    revoke_account_session : (RevokeAccountSessionRequest) -> (variant { Ok; Err : SessionRevokeError });
+    revoke_device_sessions : (RevokeDeviceSessionsRequest) -> (variant { Ok; Err : SessionRevokeError });
+
     prepare_account_delegation : (
         anchor_number : UserNumber,
         origin : FrontendHostname,

src/internet_identity/src/main.rs

@@ -515,6 +515,16 @@ fn app_prepare_delegation(
     sessions::app_prepare_delegation(request)
 }
 
+#[update]
+fn revoke_account_session(request: RevokeAccountSessionRequest) -> Result<(), SessionRevokeError> {
+    sessions::revoke_account_session(request)
+}
+
+#[update]
+fn revoke_device_sessions(request: RevokeDeviceSessionsRequest) -> Result<(), SessionRevokeError> {
+    sessions::revoke_device_sessions(request)
+}
+
 #[update]
 fn app_revoke_session() {
     sessions::app_revoke_session()

src/internet_identity/src/sessions.rs

@@ -27,7 +27,8 @@ use internet_identity_interface::internet_identity::types::{
     AccountNumber, AccountSessionError, AnchorNumber, AppGetDelegationRequest,
     AppPrepareDelegationRequest, AppPrepareDelegationResponse, AppSessionError, ApplicationNumber,
     Delegation, FrontendHostname, GetAccountSessionRequest, GetAccountSessionResponse,
-    PrepareAccountSessionRequest, PrepareAccountSessionResponse, SignedDelegation, Timestamp,
+    PrepareAccountSessionRequest, PrepareAccountSessionResponse, RevokeAccountSessionRequest,
+    RevokeDeviceSessionsRequest, SessionRevokeError, SignedDelegation, Timestamp,
 };
 use serde_bytes::ByteBuf;
 
@@ -438,3 +439,35 @@ fn account_seed(account: &Account) -> Result<Hash, AppSessionError> {
     })?;
     Ok(account.calculate_seed_with_salt(&salt))
 }
+
+pub fn revoke_account_session(
+    request: RevokeAccountSessionRequest,
+) -> Result<(), SessionRevokeError> {
+    check_authorization(request.identity_number)
+        .map_err(|err| SessionRevokeError::Unauthorized(err.principal))?;
+    check_frontend_length(&request.origin);
+
+    storage_borrow_mut(|storage| {
+        storage.revoke_account_sessions(
+            request.identity_number,
+            &request.origin,
+            request.account_number,
+            request.created_at,
+        )
+    })
+    .map(|_| ())
+    .map_err(|err| SessionRevokeError::InternalCanisterError(err.to_string()))
+}
+
+pub fn revoke_device_sessions(
+    request: RevokeDeviceSessionsRequest,
+) -> Result<(), SessionRevokeError> {
+    check_authorization(request.identity_number)
+        .map_err(|err| SessionRevokeError::Unauthorized(err.principal))?;
+
+    storage_borrow_mut(|storage| {
+        storage.revoke_device_sessions(request.identity_number, request.device_id)
+    })
+    .map(|_| ())
+    .map_err(|err| SessionRevokeError::InternalCanisterError(err.to_string()))
+}

src/internet_identity/src/storage.rs

@@ -1817,6 +1817,45 @@ impl<M: Memory + Clone> Storage<M> {
         self.lookup_account_with_principal_memory.get(&principal)
     }
 
+    /// Removes the sessions an anchor names by locator and creation time. Two browsers
+    /// signing in during the same round share a `created_at`, so this can match both.
+    pub fn revoke_account_sessions(
+        &mut self,
+        anchor_number: AnchorNumber,
+        origin: &FrontendHostname,
+        account_number: Option<AccountNumber>,
+        created_at: Timestamp,
+    ) -> Result<u64, StorageError> {
+        let Some(application_number) = self.lookup_application_number_with_origin(origin) else {
+            return Ok(0);
+        };
+        let Some(references) = self.lookup_account_references(anchor_number, application_number)
+        else {
+            return Ok(0);
+        };
+        let mut references: Vec<AccountReference> =
+            references.into_iter().map(Into::into).collect();
+
+        let Some(reference) = references
+            .iter_mut()
+            .find(|reference| reference.account_number == account_number)
+        else {
+            return Ok(0);
+        };
+
+        let before = reference.sessions.len();
+        reference
+            .sessions
+            .retain(|session| session.created_at != created_at);
+        let removed = (before - reference.sessions.len()) as u64;
+        if removed == 0 {
+            return Ok(0);
+        }
+
+        self.write_reference_list(anchor_number, application_number, references)?;
+        Ok(removed)
+    }
+
     /// Removes one session. Returns whether anything was removed.
     pub fn remove_session(
         &mut self,