Persist revoked sessions in MongoDB and Dapper identity storage #8588

Problem

Sign-out revocation (POST /identity/logout + IRevokedSessionStore) is durable only when Identity persistence is EF Core (EFCoreRevokedSessionStore + the RevokedSessions migrations). The in-repo MongoDB and Dapper identity modules still expose only UserStore, RoleStore, and ApplicationStore. They do not implement IRevokedSessionStore and do not override IdentityFeature.RevokedSessionStore, so those hosts keep the default MemoryRevokedSessionStore.

On a multi-node Mongo/Dapper deployment, a logout on one node does not revoke the session on the others. A process restart also forgets revocations. Refresh tokens of a signed-out session can then be exchanged again.

This has not been published from main yet (it arrives with the 3.9 identity forward-port). Target 3.10 so the first main-line release that ships session revocation also has durable Mongo/Dapper stores.

Expected

MongoDB and Dapper identity persistence persist revoked sessions the same way EF Core does: add, exists, and delete-expired, tenant-agnostic, indexed on ExpiresAt. IdentityFeature.RevokedSessionStore is overridden when those modules are enabled, matching Elsa.Persistence.EFCore Identity.

Out of scope

• EF Core RevokedSessions migrations (already on chore: forward-port 3.9 identity work (#8549 #8552 #8556 #8562 #8564 #8565) to main #8572 / release/3.9.0).
• Changing the logout or refresh-token contract.

Related

• chore: forward-port 3.9 identity work (#8549 #8552 #8556 #8562 #8564 #8565) to main #8572 (forward-port of feat(identity): revoke the sign-in session on POST /identity/logout #8552 session revocation to main)
• src/extensions/persistence/Elsa.Persistence.MongoDb/Modules/Identity
• src/extensions/persistence/Elsa.Persistence.Dapper/Modules/Identity