From e748c875bcd59bcf3ecce6baca6660eb0a0073cf Mon Sep 17 00:00:00 2001
From: Denozordec <shatskiy.blog@gmail.com>
Date: Sat, 18 Jul 2026 18:36:34 +0700
Subject: [PATCH] refactor(auth): replace redirectToPortalLogin with
 redirectToPortalLogout

Updated authentication flow to use redirectToPortalLogout instead of redirectToPortalLogin in NavUser and AppearanceSettingsPage components. Introduced redirectToPortalLogout function to handle SSO session termination and redirect users to the logout URL.
---
 apps/web/src/components/nav-user.tsx              | 4 ++--
 apps/web/src/lib/auth.ts                          | 8 ++++++++
 apps/web/src/routes/_auth/settings/appearance.tsx | 4 ++--
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/apps/web/src/components/nav-user.tsx b/apps/web/src/components/nav-user.tsx
index 1583e5b..f277b78 100644
--- a/apps/web/src/components/nav-user.tsx
+++ b/apps/web/src/components/nav-user.tsx
@@ -38,7 +38,7 @@ import {
   clearToken,
   getClaims,
   isAuthEnabled,
-  redirectToPortalLogin,
+  redirectToPortalLogout,
   resetPortalHandoff,
 } from '@/lib/auth'
 
@@ -130,7 +130,7 @@ export function NavUser() {
     clearToken()
     resetPortalHandoff()
     if (authOn) {
-      redirectToPortalLogin()
+      redirectToPortalLogout()
       return
     }
     window.location.href = '/login'
diff --git a/apps/web/src/lib/auth.ts b/apps/web/src/lib/auth.ts
index 04e687a..466cf9c 100644
--- a/apps/web/src/lib/auth.ts
+++ b/apps/web/src/lib/auth.ts
@@ -146,6 +146,14 @@ export function redirectToPortalLogin(returnTo?: string): boolean {
   return true
 }
 
+/** End portal SSO session (refresh cookie + portal token). Do not pass return_to. */
+export function redirectToPortalLogout(): void {
+  clearToken()
+  resetPortalHandoff()
+  const url = `${authPortalUrl()}/logout`
+  window.location.assign(url)
+}
+
 export function parseHashToken(hash: string): {
   accessToken: string | null
   expiresAt: string | null
diff --git a/apps/web/src/routes/_auth/settings/appearance.tsx b/apps/web/src/routes/_auth/settings/appearance.tsx
index 207f667..5d6092c 100644
--- a/apps/web/src/routes/_auth/settings/appearance.tsx
+++ b/apps/web/src/routes/_auth/settings/appearance.tsx
@@ -7,7 +7,7 @@ import { api } from '@/lib/api-client'
 import {
   clearToken,
   isAuthEnabled,
-  redirectToPortalLogin,
+  redirectToPortalLogout,
   resetPortalHandoff,
 } from '@/lib/auth'
 import { SettingRow } from '@/components/setting-row'
@@ -60,7 +60,7 @@ function AppearanceSettingsPage() {
     clearToken()
     resetPortalHandoff()
     if (isAuthEnabled()) {
-      redirectToPortalLogin()
+      redirectToPortalLogout()
       return
     }
     void navigate({ to: '/login' })