fix(iam): revoke the single-use sso_state cookie on error paths

Both `delete_cookie` calls in the SSO callback sat in front of a `raise`, so
neither ever reached the client. The consequence is smaller than the refresh
one but real: once the state check passes, the state is meant to be spent,
and a failing code exchange left it replayable for the rest of its 10-minute
window.

Route them through `revoke_cookie` so the deletion survives the raise.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: vianneybacoup

server/src/identity_access_management_context/adapters/primary/fastapi/routes/sso/sso_callback_route.py

@@ -25,12 +25,17 @@
     InvalidSsoCodeException,
     SsoEncryptionUnavailableError,
 )
+from shared_kernel.adapters.primary.cookie_revocation import revoke_cookie
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter(prefix="/auth", tags=["Authentication"])
 
 
+def _revoke_sso_state(request: Request, response: Response) -> None:
+    revoke_cookie(request, response, SSO_STATE_COOKIE, secure=get_cookie_secure_setting(), samesite="lax")
+
+
 def _state_rejection_reason(state: str | None, expected_state: str | None) -> str | None:
     """Why the CSRF state check failed, or None when it passed."""
     if not state:
@@ -87,9 +92,11 @@ async def sso_callback(
         # The body stays generic so a forged state learns nothing. The reason goes
         # to the log only, and never carries the state itself — it is a CSRF token.
         logger.warning("Rejecting SSO callback: %s", rejection_reason)
-        response.delete_cookie(SSO_STATE_COOKIE)
+        _revoke_sso_state(request, response)
         raise HTTPException(status_code=400, detail="Invalid SSO state")
-    response.delete_cookie(SSO_STATE_COOKIE)
+    # The state is single-use: revoke it now, so it stays revoked even when the
+    # code exchange below fails and the route raises.
+    _revoke_sso_state(request, response)
 
     try:
         command = SsoLoginCommand(code=code, redirect_uri=redirect_uri)

server/tests/e2e/test_sso_security.py

@@ -130,3 +130,16 @@ def test_given_no_state_parameter_when_calling_callback_should_log_the_missing_p
     assert response.status_code == 400
     assert response.json()["detail"] == "Invalid SSO state"
     assert "state query parameter missing" in caplog.text
+
+
+def test_given_an_invalid_state_when_calling_callback_should_revoke_the_sso_state_cookie(e2e_client, configured_sso):
+    # The stale state must not survive a rejected callback: the route stages the
+    # deletion before raising, so it has to outlive the HTTPException.
+    e2e_client.get("/api/auth/sso/url")
+    assert e2e_client.cookies.get("sso_state")
+
+    response = e2e_client.get("/api/auth/sso/callback?code=anything&state=forged-state")
+
+    assert response.status_code == 400
+    assert "sso_state=" in " ".join(response.headers.get_list("set-cookie"))
+    assert e2e_client.cookies.get("sso_state") is None