Allow Required identity verification denial to terminate the local session

[woksin]

Problem / motivation

AuthProxy 2.15 added fail-closed Required identity verification. A non-positive result correctly denies forwarding and IdentityDetailsResolver.Deny() clears the sealed authorization record, readable identity cookie, and in-memory result. The primary cookie-authentication session and the remaining AuthProxy session cookies survive, however. IdentityMiddleware then serves the forbidden page while the browser remains locally authenticated.

Some applications use the identity verifier for current access, not only profile enrichment. When access is revoked, or the verifier is technically unavailable, they need the proxy-owned local session to end so the next navigation starts a clean sign-in rather than repeatedly presenting an authenticated-but-denied session. Downstream application middleware cannot safely clear the proxy cookie because the scheme and cookies are owned by AuthProxy.

The current generic seam is therefore missing: AuthProxy already has SessionTermination.SignOutAndClearCookies() for logout and unforwardable identities, but a Required verification denial cannot opt into it.

Ada cost is presently a blocked production edge-acceptance row and investigation time; there is no Ada source workaround yet. Ada policy happens to require invitation-only membership, but that policy is not the framework ask. The framework ask is an opt-in way for any application-authoritative verifier to say that losing current authorization invalidates the local proxy session.

Proposed solution

Add an additive, explicit configuration option for Required identity verification denials to terminate the local AuthProxy session. Preserve current behavior by default for deployments that want an authenticated denial page.

When enabled, every negative or indeterminate Required outcome should:

• deny before any protected upstream route or asset;
• clear the sealed authorization record, readable identity cookie, and in-memory result as today;
• sign out the cookie authentication scheme and clear all AuthProxy-issued session cookies through the existing single session-termination path;
• return the same bounded denial for explicit rejection, timeout, cancellation, transport failure, non-success, empty, malformed, ambiguous, and tenant-less outcomes;
• leave AuthProxy authentication/provider and declared anonymous surfaces reachable for a clean re-entry.

The option may be global or per verifying service, provided multiple required services have deterministic fail-closed composition.

Alternatives considered

• Clearing cookies in the downstream service: it does not own AuthProxy cookie authentication and is too late for proxy-owned routing.
• Treating the existing positive-state clearing as session termination: the authentication cookie remains, so the browser is still locally signed in.
• Making termination unconditional in Required mode: potentially changes the interaction contract for existing 2.15+ deployments, so an additive opt-in is safer unless compatibility analysis proves unconditional termination acceptable.

Verify by

Through a real UseIngress() host with Required verification and the option enabled, exercise success followed by explicit deny, timeout/cancellation, connection failure, 500, empty, malformed, ambiguous, and tenant-less resolution. Each failure must reach no protected upstream, expire the authentication cookie and every AuthProxy session cookie, and allow provider/authentication plus declared anonymous paths. Repeat with the option disabled to preserve the current authenticated-denial behavior.

[woksin]

Fixed in #104.