feat(auth): add buildIdpLogoutUrl helper#13
Merged
Conversation
Shared, pure builder for the Gatekeeper OIDC end-session (federated logout) URL, so the id_token_hint guard lives in one place instead of being copied per app. Returns null unless every part is present, including the id token: the endpoint requires id_token_hint, so a caller without it must fall back to a local-only sign-out rather than redirect into a validation error. Exported from the /auth subpath with unit tests. NB: the build also re-syncs the committed output for the prior OIDC sign-up change (createOmniOAuthConfig), which was stale in build/.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a shared, pure
buildIdpLogoutUrlto the/authsubpath so the Gatekeeper OIDC end-session (federated logout) URL logic lives in one place instead of being copied per app.Why
A sign-out bug (Gatekeeper's end-session endpoint requires
id_token_hintand 400s without it) was just fixed in herald/backfeed/runa + the tanstack-start template with identical per-app copies of this helper. This is the canonical home; those apps will import from here.Behavior
Returns
nullunless every part is present, including the id token — so a caller lacking the id token falls back to a local-only sign-out rather than redirecting into a validation error. Pure/config-injected, with unit tests (full URL when present; null without an id token; null when any config part is missing; url-encoding).Build note
The committed
build/was stale for the prior OIDC sign-up change (createOmniOAuthConfig) — runningbun run buildre-syncedbuild/index.js+build/auth/oauth.d.tsalongside adding the newbuild/auth/idpLogout.*. Nobuild/react(or other entry) churn; verified nojsxDEVin the build. 285 tests pass; tsc/biome/knip clean.