Okta: revoke a user's sessions and OAuth tokens

Problem

Okta's DELETE /api/v1/users/{userId}/sessions "revokes all active identity provider sessions of the user" and, with oauthTokens=true (default false), "revokes issued OpenID Connect and OAuth refresh and access tokens", returning 204 (https://developer.okta.com/docs/api/openapi/okta-management/management/tags/usersessions/other/revokeusersessions). The emulator has no such route, so an incident-response or offboarding flow that clears a user's sessions and tokens cannot be tested.

Proposal

• Add DELETE /api/v1/users/:userId/sessions, returning 204, and with oauthTokens=true revoke the OAuth access and refresh tokens issued to the user.
• Keep tokens when oauthTokens is omitted, as it defaults to false. The emulator does not model Okta sessions, so only the token revocation has an effect.

Implementation

A working version with tests and docs is on a fork branch: https://github.com/Unchallenged-com/emulate/tree/okta-revoke-user-sessions. Happy to open a pull request for it.