ThePalaceProject / web-patron / 23415927885

88%

push

github

OpenID Connect logout support (PP-3677) (#106)

## Description

OIDC logout support with two supporting changes:

- OIDC logout flow — SignOut.tsx now detects an OIDC logoutLink on the
auth method, calls the server-side logout endpoint (with Authorization
header and URI template expansion), then navigates to /signed-out. Falls
back to the existing redirect-based flow if no logout link is present.
- URI Template (RFC 6570) expansion utilities - enables handling of
authentication document logout links that contain templated URIs in
their hrefs.

Other fixes:
- Credential storage migration — credentials moved from cookies to
localStorage, with a companion session cookie as an "activeness marker"
so credentials are discarded on browser close (matching previous cookie
behavior). Motivated by OIDC JWTs being too large for cookies.
- Spurious redirect fix — pendingUrlCredentials exposed synchronously in
useCredentials prevents child components from redirecting to login
before the URL token is persisted to state on OIDC/SAML callback.

Note: Currently, logout redirects to the signout page, rather than
attempting a full OIDC provider session logout, which would log the user
out of all applications that use that session (for example, logging out
of Google would de-authorize other Google apps). A future enhancement
will attempt a more nuanced approach that gives the user the option to
log the user out of the session.

## Motivation and Context

Enables this application to interact with the OpenID Connect logout
capabilities being introduced to the Palace Manager on circulation#3120.

[Jira PP-3677]

## How Has This Been Tested?

- Manual testing in a local development environment.
- New and updated tests.
- All tests pass locally.
- [CI
checks](https://github.com/ThePalaceProject/web-patron/actions/runs/23265626245)
pass.

## Checklist:

- [x] I have updated the documentation accordingly.
- [x] All new and existing tests passed.

57 of 74 branches covered (77.03%)

Branch coverage included in aggregate %.

71 of 92 relevant lines covered (77.17%)

11.84 hits per line