fix(console): revoke sessions on logout

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Closes rustfs/backlog#1087

Supersedes #169, which no longer merges cleanly with the current login admission and platform-security changes on main.

Summary of Changes

• Replace the stateless encrypted cookie payload with a 128-bit random session reference backed by an encrypted, bounded in-process store.
• Revoke the referenced session immediately on logout and reject replay of the leaked cookie.
• Bound total sessions, sessions per Kubernetes token, and stored bearer-token size.
• Preserve the current login body limit, rate limit, concurrency limit, timeout, and Console error contracts.
• Reject untrusted browser logout origins while keeping legacy non-browser empty POST clients compatible.
• Enforce one Console replica with a Recreate rollout in Helm and development manifests.
• Document upgrade, restart, rollback, reverse-proxy, and forced-sign-in behavior.

The previous logout handler only expired the browser cookie. A copied encrypted cookie remained self-validating for its full 12-hour TTL because the server held no revocation state. The new reference is valid only while its server-side entry exists, so logout removes the authority needed for replay.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased] (N/A: this repository does not contain CHANGELOG.md)
• CI/CD passed (pending)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: Console must run as one process; restarts and upgrades invalidate active sessions and require users to sign in again.

Verification

cargo test console::
cargo test --manifest-path e2e/Cargo.toml --test sts_manifest console_session_deployments_enforce_single_recreate_process
make pre-commit

Additional Notes

• The Helm chart rejects console.replicas values other than 1 while Console is enabled.
• Recreate prevents old stateless-cookie and new reference-cookie processes from serving traffic concurrently.
• Custom deployments must preserve the single-process and Recreate constraints.
• Live Kubernetes upgrade and rollback tests were not run locally.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.

[GatewayJ]

@codex

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f37254a7be

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".