endsession

type Config struct {
	Store            storm.SessionStore
	ClientStore      storm.ClientStore
	KeyStore         protocol.KeyStore
	DefaultLogoutURI string
	// Offset is the clock skew tolerance for token validation (default: 0).
	Offset time.Duration
	// MaxAgeIAT is the maximum allowed age of the id_token_hint's iat claim.
	// Per OIDC Session Management §5, expired tokens can still be trusted for logout.
	// Set to 0 to disable iat_max_age checking.
	MaxAgeIAT time.Duration
	// MaxAge is the maximum allowed time since auth_time.
	// Set to 0 to disable auth_time max_age checking.
	MaxAge  time.Duration
	Decoder *protocol.Decoder
	// LogoutHook is called after a session is terminated.
	// Use this to trigger back-channel logout, audit logging, etc.
	LogoutHook LogoutHook
	// LogoutTemplate overrides the default logout HTML template.
	// The template receives a map with "Title", "Heading", and "Message" keys.
	// If nil, the embedded default template is used.
	LogoutTemplate *template.Template
}

type LogoutHook interface {
	PostLogout(ctx context.Context, userID, clientID, sid string)
}

type LogoutHookFunc func(ctx context.Context, userID, clientID, sid string)

type Plugin struct {
	// contains filtered or unexported fields
}