feat(KLEF-140): Add authentik custom flow to control sessions

[JeremyNRoos]

Pull Request

Summary

This PR addresses a critical Insecure Direct Object Reference (IDOR) vulnerability within the Authentik plugin's gRPC service. It implements strict cross-checking to guarantee that a user cannot terminate active sessions belonging to other accounts.

Related Issues

Closes #

---

Changes

What's Included

• Implemented an ownership cross-check in the RevokeSession gRPC handler.
• The handler now queries Authentik to verify that the target SessionID is explicitly tied to the UserID included in the request before issuing a termination command.

What's Not Included

• No changes to Authentik's PostgreSQL/Redis companion configurations.

---

Testing

How Was This Tested?

• Simulated cross-account session termination requests via the core platform API.
• Confirmed that the plugin correctly rejects the request with codes.PermissionDenied if ownership validation fails.

Test Coverage

• Unit tests added or updated
• Integration tests added or updated
• Manually tested end-to-end

---

Breaking Changes

Does this PR introduce breaking changes?

• Yes
• No

If yes, describe the impact and any required migration steps:

---

Security Considerations

• This PR affects authentication or authorization logic
• This PR touches secrets, tokens, or environment variables
• This PR affects infrastructure, deployment pipelines, or network configuration

If any box is checked, describe the security impact and any mitigations applied:

• Session Protection: Closes a vulnerability where the core platform delegated session trust entirely to the plugin without the plugin enforcing ownership bounds.

---

Documentation

Does this PR require documentation updates?

• Yes
• No

If yes, check all that apply:

• README.md
• ARCHITECTURE.md
• API reference
• Architecture diagrams (C4 / DDD)
• /docs

---

UI/UX (If Applicable)

• Includes new components or views
• Changes styles or theme tokens
• Responsive behavior verified
• Requires design approval

Screenshots or recordings:

---

Pre-Merge Checklist

• PR title follows semantic format (feat:, fix:, chore:, docs:, refactor:, test:)
• All CI checks passing
• Code follows project style guidelines
• No debug logs or commented-out code left in
• Dependencies reviewed (no unnecessary additions)
• No sensitive information included

---

Reviewer Notes

Ensure the Authentik API calls used for session verification are optimized to avoid latency spikes during batch revocation events.