Add event when token is revoked

[MargotDumoulin]

It would be useful to have a more specific event type in order to know when a token is revoked, so devs could adapt their apps behavior based on this information (for instance, we could indicate when a user is logged out because of the single session per user parameter).

Based on the documentation ("Listen to auth events"), we could use it this way :

const { data } = supabase.auth.onAuthStateChange((event, session) => {
  console.log(event, session)

  if (event === 'INITIAL_SESSION') {
    // handle initial session
  } else if (event === 'SIGNED_IN') {
    // handle sign in event
  } else if (event === 'SIGNED_OUT') {
    // handle sign out event
  } else if (event === 'PASSWORD_RECOVERY') {
    // handle password recovery event
  } else if (event === 'TOKEN_REFRESHED') {
    // handle token refreshed event
  } else if (event === 'USER_UPDATED') {
    // handle user updated event
  } else if (event === 'TOKEN_REVOKED') { // <-- NEW EVENT HERE
    // handle token revoked
  }
})

[GaryAustin1]

There is no notification from the server to the clients. So if your "session" is revoked on the server as in your instance of single session per user, the clients won't know until they try and refresh the jwt. At that point the client MAY generate sign_out event or might error, I'm not sure as I've not tested it. Just wanted to point out that there is no way until the token is refreshed the clients can know anything has changed.