Argo CD session validity after IdP credential revocation

Designing least-privilege access in Argo CD with project-scoped RBAC and external IdP authentication via OIDC. Authentication is delegated to the IdP and authorization is enforced through project roles and global roles.

The uncertainty is how session continuity is handled when IdP credentials expire or are revoked. UI access uses an Argo CD server cookie whose lifetime is separate from the IdP token, and API access relies on long-lived personal access tokens and service accounts.

Which mechanism controls the maximum lifetime of an active UI session after IdP revocation? Does Argo CD perform proactive IdP validation on each request, or does the session remain usable until the server cookie expires? How are personal access tokens affected by IdP credential expiration?