feat(be): revoke sessions from the user's own settings

[sea-snake]

Design: #4224 (docs/ongoing/revocable-app-sessions.md §8.2, §9.3 — S16, S20). Overview: #4230.

Ships with #4249, which is the UI for it.

Motivation

An app can sign out only its own session (#4245), so "sign this browser out" has to come
from somewhere the anchor itself is authenticated. The two revocation surfaces are split by
what each caller can prove:

Caller	Authenticated as	May revoke	Names a session by
The app	its own session chain	only its own	nothing; the bundle rides as caller info
The II frontend	an anchor access method	any session of that anchor	(origin, account, created_at), or a whole device_id

Changes

• revoke_account_session takes (identity_number, origin, account_number, created_at).
  Two browsers signing in during the same round share a created_at, so it can match more
  than one; revoking both is the right outcome — the user named that moment at that account.
• revoke_device_sessions takes (identity_number, device_id) and sweeps that anchor's
  references in one message, writing only rows that hold that device's sessions. Atomic,
  with no partially-revoked state.
• Both name sessions by locator, never by principal, so they do not touch the principal
  index — that stays on the app-facing path only.
• Doing the sweep eagerly is what keeps refresh cheap. Marking a device revoked and checking
  it during refresh would make revocation O(1) but add an anchor read to a call that
  otherwise never touches the anchor. Refresh happens every few minutes per active session;
  this happens rarely.
• The device record survives the sweep, so a browser that has been signed out is still
  one the user recognises, and signing back in from it reuses the same id. Deleting a device
  record is a separate operation and is not specified here.

There is no session listing method, deliberately. A flat "every session of this anchor" call
returns a list bounded only by the caps and mixing every origin together. The right
decomposition is applications first, then sessions within one, and that wants designing
alongside whatever lists applications. Neither exists yet.

Tests

New session_revocation_tests (5): signing a browser out sweeps every application, leaves
another anchor alone, writes nothing when there is nothing to revoke, revoking by creation
time covers same-round siblings, and revoking at an unknown origin is a no-op.

PocketIC (3): revoking one session from settings stops its refresh, revocation by another
anchor is Unauthorized, and signing a whole browser out kills its sessions across two
apps while leaving a second browser working and leaving the device record listed.

All 770 canister unit tests pass, plus the sessions suite.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 154bb92.

Security Overview

• 🔎 Scanned files: 10 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=adc7fbee-79d9-496f-8b10-71ed3be0d5b4&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► src/canister_tests/src/api/internet_identity/api_v2.rs     Add revoke_account_session and revoke_device_sessions endpoints in test API calls ► src/frontend/src/lib/generated/internet_identity_idl.js     Add RevokeAccountSessionRequest, SessionRevokeError, RevokeDeviceSessionsRequest types and methods ► src/frontend/src/lib/generated/internet_identity_types.d.ts     Add RevokeAccountSessionRequest, RevokeDeviceSessionsRequest, SessionRevokeError types ► src/internet_identity/internet_identity.did     Declare RevokeAccountSessionRequest, RevokeDeviceSessionsRequest, SessionRevokeError in DID interface ► src/internet_identity/src/main.rs     Expose revoke_account_session and revoke_device_sessions update calls ► src/internet_identity/src/sessions.rs     Implement revoke_account_session and revoke_device_sessions functions ► src/internet_identity/src/storage.rs     Add revoke_account_sessions method to storage layer and integrate removal logic ► src/internet_identity/src/storage/tests.rs     Add session revocation tests ► src/internet_identity/tests/integration/sessions.rs     Update integration tests to include revoke_account_session and revoke_device_sessions usage ► src/internet_identity_interface/src/internet_identity/types.rs     Add RevokeAccountSessionRequest, RevokeDeviceSessionsRequest, SessionRevokeError definitions

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.