feat: The OIDC logout flow is supported

[mrudatsprint]

Issue:

• https://linear.app/fusionauth/issue/ENG-4802/sdkcore-implement-startlogout-and-getaccesstoken

Description:

The OIDC logout flow will clear the key pair, stored tokens and in-memory nonces.

Note, added an accessor to return the access token.

[Copilot]

Pull request overview

This PR adds support for the OIDC logout flow in @fusionauth-sdk/core, ensuring DPoP-mode logout clears local DPoP state (key pair, tokens, nonces) before redirecting, and introduces an accessor for reading the DPoP-bound access token (with tests).

Changes:

• Implement DPoP-aware startLogout() which clears DPoP state prior to redirecting to the logout URL.
• Add getAccessToken() to SDKCore and DPoPManager, with corresponding unit tests.
• Extend the DPoP e2e smoke suite to validate logout state clearing + redirect behavior.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
yarn.lock	Dependency lock updates related to the repo’s toolchain/dev dependencies.
packages/core/src/SDKCore/SDKCore.ts	Adds DPoP-aware logout flow and a getAccessToken() accessor on SDKCore.
packages/core/src/SDKCore/SDKCore.test.ts	Unit tests for SDKCore.getAccessToken() behavior in DPoP vs cookie mode.
packages/core/src/DPoP/DPoPManager.ts	Adds DPoPManager.getAccessToken() to expose the stored access token.
packages/core/src/DPoP/DPoPManager.test.ts	Unit tests for DPoPManager.getAccessToken() and post-clear behavior.
e2e/tests/dpop-smoke.test.ts	Adds an e2e test ensuring startLogout() clears DPoP state before redirect.

Comments suppressed due to low confidence (1)

packages/core/src/SDKCore/SDKCore.ts:109

• In DPoP mode, if DPoPManager.clear() rejects, the .catch(...) handler prevents the redirect from happening at all, leaving the app stuck in a partially-logged-out state. Consider making the redirect unconditional (e.g., in a finally) and treat clearing local state as best-effort.

  startLogout(): void {
    if (this.dpopManager) {
      this.startDpopLogout().catch(error => {
        console.error('FusionAuth SDK: startLogout failed', error);
      });
      return;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

packages/core/src/SDKCore/SDKCore.ts:101

• The JSDoc has a grammatical error: “starting an asynchronously flow” should be “starting an asynchronous flow” (or similar).

   * In DPoP mode, this synchronously returns after starting an
   * asynchronously flow.
   *

[mrudatsprint]

self-review

[mrudatsprint]

This is exposed so the application can call a resource server and is not able to use fetch. In this case the application needs to call generateProof and would need the accessToken in order to add it to the Authorization: DPoP header.