I need to create a logout button in my app, and I do not know how to revoke simple_oauth tokens programmatically, but I have noticed if the user saves their profile form (form_id: "user_form") in Drupal, it revokes the user's access token.
So I'm wondering if there is a way to programmatically submit the form so I can do so in a logout endpoint for my app.
That is, unless someone can point me to the specific code that revokes a user's access token when the user edit form is saved, so I can fire that hook more directly.
Because the oauth2_token table does not reference the associated user (auth_user_id is always zero), I don't know how to look up a token by UID for the purpose of revoking the token. Thus, even though it seems like a hack, the only thing I can think to do is to try to submit the user edit form programmatically.
UPDATE: I was wrong about "auth_user_id is always zero". See my answer below.