auth.m2m: Add token revocation and introspection endpoints

[intel352]

Use Case

The auth.m2m module currently supports token issuance (POST /oauth/token) and JWKS (GET /oauth/jwks). For a complete OAuth2 implementation, token revocation and introspection are also needed.

Proposed Endpoints

Token Revocation (RFC 7009)

POST /oauth/revoke
Content-Type: application/x-www-form-urlencoded

token=<access_token>&token_type_hint=access_token

Response: 200 OK (empty body)

This would add the token's JTI to the blacklist (the oauth2_jti_blacklist table pattern is already used in Chimera's cleanup jobs).

Token Introspection (RFC 7662)

POST /oauth/introspect
Content-Type: application/x-www-form-urlencoded

token=<access_token>

Response:

{
  "active": true,
  "client_id": "my-client",
  "scope": "admin read write",
  "exp": 1735689600,
  "iat": 1735686000,
  "iss": "chimera"
}

Context

Chimera's main branch uses Fosite for full OAuth2 with revocation and introspection. The workflow engine branch uses auth.m2m which lacks these endpoints. While not blocking for current use cases, they would improve OAuth2 completeness.

🤖 Generated with Claude Code