captured core.logout-token

Sign out with an access token

The developer portal's server, or any caller holding the token /auth/login minted, posts it as a Bearer token. QAuth accepts it even when it has expired, as long as QAuth signed it. It ends the user's browser sessions, invalidates their unredeemed authorization codes, revokes their refresh tokens at every client and on every device, denylists the token when it is still live, and records the sign-out. It refuses any other token with 401.

What this view shows

POST /auth/logout from the request to the response, in the order the server runs its checks.

Open world: what is not drawn here is not ruled out. Only the guarantees below are binding.

Left out of this view:

a store failure while the token is checked (the system client lookup, the user lookup) answers 500 before anything is ended
a failure to record a refused sign-out (user.sign_out_failed) turns that refusal into a 500
Fastify's own refusals before the header check, such as an empty body sent as application/json (400)
the four causes of a 421 (a malformed host, an unknown host, a disabled realm, a realm with no issuer) give one answer and are drawn as one exit
a token with no jti, minted before the claim existed, is not denylisted
a token whose sub is empty or not a UUID: QAuth never mints one for the portal
with RATE_LIMIT_ENABLED=false the logout limit is not applied
the effects are not one transaction: a failure part way leaves the steps before it done

The main story

When: The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token is the one /auth/login mints for the developer portal, the token's subject is a user of this realm, the token is bound to no key, the request carries no session cookie of the user's.

Wait for a logout request: POST /auth/logout arrives
Find the realm of the host: the request has its realm
Count the request against the logout limit: the address is under its limit
Check the Authorization header against the schema: the header matches the schema
Read the token from the header: the header holds one token
Verify the token, and accept it expired: the token verifies
Accept only the portal's own token: the token is the portal's
Refuse a DPoP-bound token: the token is bound to no key
Find the token's user in this realm: the subject is a user of this realm
End the user's browser sessions: the sessions are ended
Invalidate the user's unredeemed authorization codes: the codes are spent
Revoke every active refresh token of the user: the refresh tokens are revoked and the token is still live
Denylist the token of this request: the token is denylisted
Record the sign-out: the event is recorded

Result: The user is signed out.

The flow

Show failure paths and “the user closes the page”

blue line: the main storyred dashed line: a failure path (shown with “Show failure paths”)dotted line: decided by a rule, nobody actsdashed grey box: the server decides, nothing is shown

What each step answers

Step	The outside world sees
The user is signed out signed_out	200 · body: {"success":true,"message":"Successfully logged out"}
The user is signed out, and the request's session cookie is cleared signed_out.cookie_cleared	200 · headers: {"Set-Cookie":"__Host-qauth_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0, with Secure when SESSION_COOKIE_SECURE is on"} · body: {"success":true,"message":"Successfully logged out"}
Refuse a host QAuth does not answer for misdirected_request.host	421 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#misdirected-request","title":"Misdirected request","status":421,"detail":"This server does not answer for the requested host","instance":"/auth/logout","code":"misdirected_request","trace_id":"the request id"}
Refuse a request over the logout limit too_many_requests.logout_limit	429 · headers: {"x-ratelimit-limit":"LOGOUT_RATE_LIMIT","x-ratelimit-remaining":"0","x-ratelimit-reset":"the seconds until the window resets","retry-after":"the same seconds"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#too-many-requests","title":"Too many requests","status":429,"detail":"Rate limit exceeded, retry in {the rest of the window, such as 1 minute}","instance":"/auth/logout","code":"too_many_requests","trace_id":"the request id"}
Refuse a missing or malformed Authorization header validation_error.authorization	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#validation-error","title":"Validation error","status":400,"detail":"The request is not valid.","instance":"/auth/logout","code":"validation_error","trace_id":"the request id","errors":[{"pointer":"/authorization","message":"the schema's message, such as: Authorization header must be in format: Bearer <token>"}]}
Refuse a header that holds no single token invalid_token.missing_token	401 · headers: {"WWW-Authenticate":"Bearer realm=\"OAuth\""} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#unauthorized","title":"Unauthorized","status":401,"detail":"Missing or invalid Authorization header. Expected format: \"Bearer <token>\"","instance":"/auth/logout","code":"unauthorized","trace_id":"the request id"}
Refuse a token that does not verify invalid_token.unverified	401 · headers: {"WWW-Authenticate":"Bearer realm=\"OAuth\", error=\"invalid_token\", error_description=\"<the body's error>\""} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-access-token","title":"Invalid access token","status":401,"detail":"Invalid JWT token, or Invalid JWT token: <why>","instance":"/auth/logout","code":"invalid_access_token","trace_id":"the request id"}
Refuse a token issued to another client invalid_token.not_management_client	401 · headers: {"WWW-Authenticate":"Bearer realm=\"OAuth\", error=\"invalid_token\", error_description=\"Access token was not issued for the management API\""} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-access-token","title":"Invalid access token","status":401,"detail":"Access token was not issued for the management API","instance":"/auth/logout","code":"invalid_access_token","trace_id":"the request id"}
Refuse a token that acts for an agent invalid_token.delegated	401 · headers: {"WWW-Authenticate":"Bearer realm=\"OAuth\", error=\"invalid_token\", error_description=\"A delegated access token cannot use the management API\""} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-access-token","title":"Invalid access token","status":401,"detail":"A delegated access token cannot use the management API","instance":"/auth/logout","code":"invalid_access_token","trace_id":"the request id"}
Refuse a token for another audience invalid_token.wrong_audience	401 · headers: {"WWW-Authenticate":"Bearer realm=\"OAuth\", error=\"invalid_token\", error_description=\"Access token audience does not match the management API\""} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-access-token","title":"Invalid access token","status":401,"detail":"Access token audience does not match the management API","instance":"/auth/logout","code":"invalid_access_token","trace_id":"the request id"}
Refuse a DPoP-bound token sent as a Bearer token invalid_token.dpop_bound	401 · headers: {"WWW-Authenticate":"Bearer realm=\"OAuth\", error=\"invalid_token\", error_description=\"A DPoP-bound access token cannot be used as a Bearer token\""} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-access-token","title":"Invalid access token","status":401,"detail":"A DPoP-bound access token cannot be used as a Bearer token","instance":"/auth/logout","code":"invalid_access_token","trace_id":"the request id"}
Refuse a token that names no user of this realm invalid_token.subject_not_a_user	401 · headers: {"WWW-Authenticate":"Bearer realm=\"OAuth\", error=\"invalid_token\", error_description=\"Access token subject is not an active user\""} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-access-token","title":"Invalid access token","status":401,"detail":"Access token subject is not an active user","instance":"/auth/logout","code":"invalid_access_token","trace_id":"the request id"}
Refuse a token minted before the account was last disabled, once it is enabled again invalid_token.issued_before_disablement	401 · headers: {"WWW-Authenticate":"Bearer realm=\"OAuth\", error=\"invalid_token\", error_description=\"Access token subject is not an active user\""} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-access-token","title":"Invalid access token","status":401,"detail":"Access token subject is not an active user","instance":"/auth/logout","code":"invalid_access_token","trace_id":"the request id"}
Fail on a store error server_error.store	500 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#internal-error","title":"Internal error","status":500,"instance":"/auth/logout","code":"internal_error","trace_id":"the request id"}

How it decides what happens next

Find the realm of the host

#	If	Then
1	the host names no enabled realm with an issuer	Refuse a host QAuth does not answer for
2	the request has its realm	Count the request against the logout limit

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`host == 'unknown'`	`misdirected_request.host`	1536 of 3072
2	otherwise	`rateLimiting`	1536 of 3072

Count the request against the logout limit

#	If	Then
1	the address has used up its logout requests	Refuse a request over the logout limit
2	the address is under its limit	Check the Authorization header against the schema

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`overLimit`	`too_many_requests.logout_limit`	768 of 1536
2	otherwise	`validatingHeader`	768 of 1536

Check the Authorization header against the schema

#	If	Then
1	the header is missing or does not match ^Bearer .+$	Refuse a missing or malformed Authorization header
2	the header matches the schema	Read the token from the header

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`header == 'invalid'`	`validation_error.authorization`	256 of 768
2	otherwise	`readingToken`	512 of 768

Read the token from the header

#	If	Then
1	the header holds no single token	Refuse a header that holds no single token
2	the header holds one token	Verify the token, and accept it expired

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`header == 'notOneToken'`	`invalid_token.missing_token`	256 of 512
2	otherwise	`verifyingToken`	256 of 512

Verify the token, and accept it expired

#	If	Then
1	the token does not verify	Refuse a token that does not verify
2	the token has expired, but QAuth signed it: its claims are read anyway	Accept only the portal's own token
3	the token verifies	Accept only the portal's own token

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`signature == 'invalid'`	`invalid_token.unverified`	128 of 256
2	`expired`	`checkingManagementToken`	64 of 256
3	otherwise	`checkingManagementToken`	64 of 256

Accept only the portal's own token

#	If	Then
1	the token's client_id is not the system client's	Refuse a token issued to another client
2	the token acts for an agent	Refuse a token that acts for an agent
3	the token's audience is not exactly the developer API's (#524), nor, on a live token, the system client's id	Refuse a token for another audience
4	the token is the portal's	Refuse a DPoP-bound token

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`issuedFor == 'otherClient'`	`invalid_token.not_management_client`	32 of 128
2	`issuedFor == 'delegated'`	`invalid_token.delegated`	32 of 128
3	`issuedFor == 'otherAudience'`	`invalid_token.wrong_audience`	32 of 128
4	otherwise	`checkingBinding`	32 of 128

Refuse a DPoP-bound token

#	If	Then
1	the token is bound to a DPoP key	Refuse a DPoP-bound token sent as a Bearer token
2	the token is bound to no key	Find the token's user in this realm

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`dpopBound`	`invalid_token.dpop_bound`	16 of 32
2	otherwise	`findingUser`	16 of 32

Find the token's user in this realm

#	If	Then
1	the account was disabled after the token was minted and is enabled again: the token must not sign the owner out of the sessions started since (#748)	Refuse a token minted before the account was last disabled, once it is enabled again
2	the subject names no user of this realm: deleted since the token was minted, or a user of another realm	Refuse a token that names no user of this realm
3	the subject is a user of this realm	End the user's browser sessions

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`subject == 'reenabled'`	`invalid_token.issued_before_disablement`	4 of 16
2	`subject != 'user'`	`invalid_token.subject_not_a_user`	8 of 16
3	otherwise	`endingSessions`	4 of 16

Every way it can end

It ends with	When	What happens
The user is signed out ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has expired, the token is the one /auth/login mints for the developer portal, the token's subject is a user of this realm, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header matches the schema Read the token from the header: the header holds one token Verify the token, and accept it expired: the token has expired, but QAuth signed it: its claims are read anyway Accept only the portal's own token: the token is the portal's Refuse a DPoP-bound token: the token is bound to no key Find the token's user in this realm: the subject is a user of this realm End the user's browser sessions: the sessions are ended Invalidate the user's unredeemed authorization codes: the codes are spent Revoke every active refresh token of the user: the token has expired, so it is already inert and is not denylisted Record the sign-out: the event is recorded
The user is signed out, and the request's session cookie is cleared ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has expired, the token is the one /auth/login mints for the developer portal, the token's subject is a user of this realm, the token is bound to no key, the request carries the session cookie of one of the user's browser sessions	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header matches the schema Read the token from the header: the header holds one token Verify the token, and accept it expired: the token has expired, but QAuth signed it: its claims are read anyway Accept only the portal's own token: the token is the portal's Refuse a DPoP-bound token: the token is bound to no key Find the token's user in this realm: the subject is a user of this realm End the user's browser sessions: the sessions are ended Invalidate the user's unredeemed authorization codes: the codes are spent Revoke every active refresh token of the user: the token has expired, so it is already inert and is not denylisted Record the sign-out: the request's own session was one of those ended
Refuse a host QAuth does not answer for ends here	The host names no realm, a disabled realm or a realm with no issuer, the address is under its logout limit, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token is the one /auth/login mints for the developer portal, the token's subject is a user of this realm, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the host names no enabled realm with an issuer
Refuse a request over the logout limit ends here	The host is a host of an enabled realm that has an issuer, this client address has used up its logout requests for the window, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token is the one /auth/login mints for the developer portal, the token's subject is a user of this realm, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address has used up its logout requests
Refuse a missing or malformed Authorization header ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is missing, or does not match ^Bearer .+$, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token is the one /auth/login mints for the developer portal, the token's subject is a user of this realm, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header is missing or does not match ^Bearer .+$
Refuse a header that holds no single token ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the header matches ^Bearer .+$ but is not two parts split by one space, such as Bearer a b, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token is the one /auth/login mints for the developer portal, the token's subject is a user of this realm, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header matches the schema Read the token from the header: the header holds no single token
Refuse a token that does not verify ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is Bearer and one token, the token is no JWT, its signature or issuer does not verify, or it is live and its typ or claims do not verify, the token has not expired, the token is the one /auth/login mints for the developer portal, the token's subject is a user of this realm, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header matches the schema Read the token from the header: the header holds one token Verify the token, and accept it expired: the token does not verify
Refuse a token issued to another client ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token was issued to another client, the token's subject is a user of this realm, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header matches the schema Read the token from the header: the header holds one token Verify the token, and accept it expired: the token verifies Accept only the portal's own token: the token's client_id is not the system client's
Refuse a token that acts for an agent ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token carries an act claim: it acts for an agent, the token's subject is a user of this realm, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header matches the schema Read the token from the header: the header holds one token Verify the token, and accept it expired: the token verifies Accept only the portal's own token: the token acts for an agent
Refuse a token for another audience ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token was issued to the system client for another audience, the token's subject is a user of this realm, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header matches the schema Read the token from the header: the header holds one token Verify the token, and accept it expired: the token verifies Accept only the portal's own token: the token's audience is not exactly the developer API's (#524), nor, on a live token, the system client's id
Refuse a DPoP-bound token sent as a Bearer token ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token is the one /auth/login mints for the developer portal, the token's subject is a user of this realm, the token is bound to a DPoP key (cnf), the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header matches the schema Read the token from the header: the header holds one token Verify the token, and accept it expired: the token verifies Accept only the portal's own token: the token is the portal's Refuse a DPoP-bound token: the token is bound to a DPoP key
Refuse a token that names no user of this realm ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token is the one /auth/login mints for the developer portal, the token's subject names no user any more, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header matches the schema Read the token from the header: the header holds one token Verify the token, and accept it expired: the token verifies Accept only the portal's own token: the token is the portal's Refuse a DPoP-bound token: the token is bound to no key Find the token's user in this realm: the subject names no user of this realm: deleted since the token was minted, or a user of another realm
Refuse a token minted before the account was last disabled, once it is enabled again ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token is the one /auth/login mints for the developer portal, the token's subject is a user of this realm, disabled after the token was minted and enabled again since, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header matches the schema Read the token from the header: the header holds one token Verify the token, and accept it expired: the token verifies Accept only the portal's own token: the token is the portal's Refuse a DPoP-bound token: the token is bound to no key Find the token's user in this realm: the account was disabled after the token was minted and is enabled again: the token must not sign the owner out of the sessions started since (#748)
Fail on a store error ends here	The host is a host of an enabled realm that has an issuer, the address is under its logout limit, the Authorization header is Bearer and one token, QAuth signed the token, for the issuer of this realm's tokens, the token has not expired, the token is the one /auth/login mints for the developer portal, the token's subject is a user of this realm, the token is bound to no key, the request carries no session cookie of the user's	Wait for a logout request: POST /auth/logout arrives Find the realm of the host: the request has its realm Count the request against the logout limit: the address is under its limit Check the Authorization header against the schema: the header matches the schema Read the token from the header: the header holds one token Verify the token, and accept it expired: the token verifies Accept only the portal's own token: the token is the portal's Refuse a DPoP-bound token: the token is bound to no key Find the token's user in this realm: the subject is a user of this realm End the user's browser sessions: it fails, because the session store fails

Each row is also a generated test: set the starting situation, send the events, expect the ending.

What is guaranteed

These hold in all 12498 situations the model can reach, from 3072 different starting situations.

Nothing is ended unless the request carries the portal's own token, signed by QAuth and bound to no key, for a user of this realm
A token QAuth signed is never refused as unverified, however long ago it expired
The refresh tokens are swept only after the browser sessions are ended and the unredeemed codes are spent, so no code redeemed later mints a refresh token that survives the logout
A 200 answer means the browser sessions, the unredeemed codes and the refresh tokens have all been ended
An expired token is never written to the denylist
A request for a host QAuth does not answer for is refused before the rate limiter counts it

Exact rules

Id	Never
`only-the-portals-token-ends-access`	`state in ['endingSessions', 'invalidatingCodes', 'revokingRefreshTokens', 'revokingAccessToken', 'recordingSignOut', 'signed_out', 'signed_out.cookie_cleared'] and (host != 'realm' or overLimit or header != 'bearer' or signature != 'valid' or issuedFor != 'portal' or subject != 'user' or dpopBound)`
`signed-by-qauth-is-never-unverified`	`state == 'invalid_token.unverified' and signature == 'valid'`
`codes-before-refresh-tokens`	`state == 'revokingRefreshTokens' and not (sessionsEnded and codesInvalidated)`
`signed-out-means-ended`	`state in ['signed_out', 'signed_out.cookie_cleared'] and not (sessionsEnded and codesInvalidated and refreshTokensRevoked)`
`expired-token-not-denylisted`	`state == 'revokingAccessToken' and expired`
`misdirected-is-not-counted`	`state == 'too_many_requests.logout_limit' and host != 'realm'`

Reference

All transitions (33)

From	Event	Guard	To	Effects	Taken
`idle`	`LOGOUT`		`resolvingRealm`		yes
`resolvingRealm`	`rule 1`	`host == 'unknown'`	`misdirected_request.host`		yes
`resolvingRealm`	`rule 2`		`rateLimiting`		yes
`rateLimiting`	`rule 1`	`overLimit`	`too_many_requests.logout_limit`		yes
`rateLimiting`	`rule 2`		`validatingHeader`		yes
`validatingHeader`	`rule 1`	`header == 'invalid'`	`validation_error.authorization`		yes
`validatingHeader`	`rule 2`		`readingToken`		yes
`readingToken`	`rule 1`	`header == 'notOneToken'`	`invalid_token.missing_token`		yes
`readingToken`	`rule 2`		`verifyingToken`		yes
`verifyingToken`	`rule 1`	`signature == 'invalid'`	`invalid_token.unverified`		yes
`verifyingToken`	`rule 2`	`expired`	`checkingManagementToken`		yes
`verifyingToken`	`rule 3`		`checkingManagementToken`		yes
`checkingManagementToken`	`rule 1`	`issuedFor == 'otherClient'`	`invalid_token.not_management_client`		yes
`checkingManagementToken`	`rule 2`	`issuedFor == 'delegated'`	`invalid_token.delegated`		yes
`checkingManagementToken`	`rule 3`	`issuedFor == 'otherAudience'`	`invalid_token.wrong_audience`		yes
`checkingManagementToken`	`rule 4`		`checkingBinding`		yes
`checkingBinding`	`rule 1`	`dpopBound`	`invalid_token.dpop_bound`		yes
`checkingBinding`	`rule 2`		`findingUser`		yes
`findingUser`	`rule 1`	`subject == 'reenabled'`	`invalid_token.issued_before_disablement`		yes
`findingUser`	`rule 2`	`subject != 'user'`	`invalid_token.subject_not_a_user`		yes
`findingUser`	`rule 3`		`endingSessions`		yes
`endingSessions`	`DONE`		`invalidatingCodes`	`endSessions`	yes
`endingSessions`	`FAIL.server`		`server_error.store`		yes
`invalidatingCodes`	`DONE`		`revokingRefreshTokens`	`invalidateCodes`	yes
`invalidatingCodes`	`FAIL.server`		`server_error.store`		yes
`revokingRefreshTokens`	`DONE`	`expired`	`recordingSignOut`	`revokeRefreshTokens`	yes
`revokingRefreshTokens`	`DONE`		`revokingAccessToken`	`revokeRefreshTokens`	yes
`revokingRefreshTokens`	`FAIL.server`		`server_error.store`		yes
`revokingAccessToken`	`DONE`		`recordingSignOut`		yes
`revokingAccessToken`	`FAIL.server`		`server_error.store`		yes
`recordingSignOut`	`DONE`	`ownSession`	`signed_out.cookie_cleared`		yes
`recordingSignOut`	`DONE`		`signed_out`		yes
`recordingSignOut`	`FAIL.server`		`server_error.store`		yes