Add logout

Author: trueleo

server/src/handlers/http.rs

@@ -247,6 +247,7 @@ pub fn configure_routes(cfg: &mut web::ServiceConfig, oidc_client: Option<Arc<op
 
     let mut oauth_api = web::scope("/o")
         .service(resource("/login").route(web::get().to(oidc::login)))
+        .service(resource("/logout").route(web::get().to(oidc::logout)))
         .service(resource("/code").route(web::get().to(oidc::reply_login)));
 
     if let Some(client) = oidc_client {

server/src/handlers/http/oidc.rs

@@ -101,6 +101,22 @@ pub async fn login(
     }
 }
 
+pub async fn logout(
+    req: HttpRequest,
+    query: web::Query<RedirectAfterLogin>,
+    oidc_client: Data<openid::Client>,
+) -> HttpResponse {
+    let Some(session) = extract_session_key_from_req(&req).ok() else {
+        return return_to_client(query.redirect.as_str(), None);
+    };
+    Users.remove_session(&session);
+    if let Some(url) = oidc_client.config().end_session_endpoint.clone() {
+        redirect_to_oidc_logout(url, &query.redirect)
+    } else {
+        return_to_client(query.redirect.as_str(), None)
+    }
+}
+
 /// Handler for code callback
 /// User should be redirected to page they were trying to access with cookie
 pub async fn reply_login(
@@ -156,6 +172,13 @@ fn redirect_to_oidc(
         .finish()
 }
 
+fn redirect_to_oidc_logout(mut logout_endpoint: Url, redirect: &Url) -> HttpResponse {
+    logout_endpoint.set_query(Some(&format!("post_logout_redirect_uri={}", redirect)));
+    HttpResponse::TemporaryRedirect()
+        .insert_header((header::LOCATION, logout_endpoint.to_string()))
+        .finish()
+}
+
 fn return_to_client(url: &str, cookies: impl IntoIterator<Item = Cookie<'static>>) -> HttpResponse {
     let mut response = HttpResponse::MovedPermanently();
     response.insert_header((header::LOCATION, url));

server/src/rbac/map.rs

@@ -119,6 +119,7 @@ impl Sessions {
         expiry: DateTime<Utc>,
         permissions: Vec<Permission>,
     ) {
+        self.remove_expired_session(&user);
         self.user_sessions
             .entry(user.clone())
             .and_modify(|sessions| sessions.push((key.clone(), expiry)))