feat(auth): add GET /auth/portal-logout for cross-app logout chain

[awais786]

Summary

Lets the foss-server-bundle portal's "Log out of all apps" button include Outline in the redirect chain. Browser security forbids cross-origin Set-Cookie, so the portal cannot clear Outline's accessToken cookie on docs.<domain> directly — it has to navigate the browser to a same-origin Outline URL that clears the cookie itself.

Endpoint

GET /auth/portal-logout?next=<absolute_url>

1. Clears accessToken + lastSignedIn cookies (same shape as the auth() catch block already uses for cookie-transported 401s).
2. Validates next against MPASS_SIGNOUT_NEXT_ALLOWED_HOSTS — suffix match on a dot boundary, so foss.arbisoft.com matches subdomains but not foss.arbisoft.com.evil.example.
3. 302s to next, or returns 200 + {ok: true} if next is missing/invalid (cookies still cleared either way).

CSRF-exempt: the portal cannot share Outline's CSRF token cross-origin. Residual risk is force-logout (<img> embedding) — low impact, ForwardAuth re-auths on the next request.

New env var

# Comma-separated host suffixes. Each entry matches exact host + all
# subdomains. Empty list rejects every ?next= — cookies still cleared.
MPASS_SIGNOUT_NEXT_ALLOWED_HOSTS=foss.arbisoft.com,localhost

Operators normalise on write: leading dots are stripped, lowercased, blanks filtered.

Portal-side wiring

Once this lands, the portal can do:

window.location =
  'https://docs.<domain>/auth/portal-logout?next=' +
    encodeURIComponent(nextHopUrl);

Or chain through multiple apps:

'https://pm.<domain>/auth/portal-sign-out?next=' +
  encodeURIComponent(
    'https://docs.<domain>/auth/portal-logout?next=' +
      encodeURIComponent(
        '/oauth2/sign_out?rd=' + encodeURIComponent(cognitoLogoutUrl)
      )
  );

Test plan

• pnpm test server/routes/auth/index.test.ts — 8 new cases in the auth/portal-logout describe block:
  • clears accessToken + lastSignedIn cookies on every call (incl. empty allowlist)
  • 302 to allowlisted next host
  • subdomain match (e.g. docs.foss.arbisoft.com against foss.arbisoft.com)
  • rejects host outside allowlist (200, cookies still cleared)
  • dot-boundary enforcement (rejects foss.arbisoft.com.evil)
  • empty allowlist rejects all ?next=
  • malformed ?next= rejected
  • missing ?next= → 200 + cookies cleared
• pnpm tsc --noEmit clean
• Manual: set MPASS_SIGNOUT_NEXT_ALLOWED_HOSTS=foss.arbisoft.com,localhost in dev env, log in to Outline, then curl -i 'http://docs.localhost/auth/portal-logout?next=http://localhost' — expect 302 + Set-Cookie clearing both cookies.

Relation to other work

• feat(auth): add GET /auth/portal-sign-out/ for cross-app logout chain plane#31 — the analogous endpoint for Plane. Same MPASS_SIGNOUT_NEXT_ALLOWED_HOSTS env var name across apps so operators set it once.
• PR fix(auth): re-auth when proxy identity differs from accessToken JWT #19 in this repo — server-side mismatch detection. Self-healing path (catches all logout vectors). This PR is the synchronous portal-driven path.
• Penpot / Twenty — same pattern needed, separate PRs.

Risk / rollback

Zero behaviour change for non-SSO deployments: MPASS_SIGNOUT_NEXT_ALLOWED_HOSTS defaults to empty → every ?next= is rejected (cookies cleared, no redirect). To disable post-merge, unset the env var.

🤖 Generated with Claude Code