feat(KLEF-140): IDOR fix in gRPC handlers

[JeremyNRoos]

Pull Request

Summary

This PR resolves a critical Insecure Direct Object Reference (IDOR) vulnerability in the plugin's gRPC handlers. It ensures that session revocation requests originating from the core platform are strictly validated against the authenticated user's ID before being executed against the Keycloak Admin API.

Related Issues

Closes # 140

---

Changes

What's Included

• Updated the RevokeSession gRPC handler to verify that the SessionID belongs to the UserID provided in the request payload.
• Added permission denied (codes.PermissionDenied) responses for session mismatch attempts.

What's Not Included

• No changes to the actual Keycloak container deployment specs.
• No changes to the login or registration flows.

---

Testing

How Was This Tested?

• Tested locally by attempting to revoke a known session ID belonging to User A using an authentication token belonging to User B.
• Verified that the gRPC request correctly fails and returns an unauthorized status.

Test Coverage

• Unit tests added or updated
• Integration tests added or updated
• Manually tested end-to-end

---

Breaking Changes

Does this PR introduce breaking changes?

• Yes
• No

If yes, describe the impact and any required migration steps:

---

Security Considerations

• This PR affects authentication or authorization logic
• This PR touches secrets, tokens, or environment variables
• This PR affects infrastructure, deployment pipelines, or network configuration

If any box is checked, describe the security impact and any mitigations applied:

• IDOR Mitigation: Prevents authenticated malicious actors from iterating through and terminating other users' sessions. The plugin now acts as a strict enforcer of session ownership.

---

Documentation

Does this PR require documentation updates?

• Yes
• No

If yes, check all that apply:

• README.md
• ARCHITECTURE.md
• API reference
• Architecture diagrams (C4 / DDD)
• /docs

---

UI/UX (If Applicable)

• Includes new components or views
• Changes styles or theme tokens
• Responsive behavior verified
• Requires design approval

Screenshots or recordings:

---

Pre-Merge Checklist

• PR title follows semantic format (feat:, fix:, chore:, docs:, refactor:, test:)
• All CI checks passing
• Code follows project style guidelines
• No debug logs or commented-out code left in
• Dependencies reviewed (no unnecessary additions)
• No sensitive information included

---

Reviewer Notes

This brings the Keycloak plugin into compliance with the platform's zero-trust gateway pattern.