Goal

Add a logout route that revokes the browser session end-to-end.

Task

POST /logout (or GET /logout): parse the session token → look up (did, sessionID) → call broker.Logout (revokes the indigo refresh token) → delete the session row → clear the sovrn_session cookie → redirect to /login. Wire it in router.go.

Acceptance

Logout deletes the session row and clears the cookie.
The refresh token is revoked (subsequent resume fails).
After logout, requests to internal pages redirect to /login.

Depends on: 40e284e (opaque session cookie — logout needs the token→(did, sessionID) lookup).

2 Comments

agent 84cab67 Sep 10

Logout Route Implementation Plan (verified against bug 8cb7799)

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development. Steps use checkbox syntax.

Goal: Add idempotent POST /logout that revokes the browser session end-to-end.

Architecture: Open top-level route outside SessionAuth.Middleware -> SessionAuth.LogoutHandler reads sovrn_session cookie -> Broker.GetSession(token) -> Broker.Logout(did, sessionID) + Broker.DeleteSession(token) -> ClearSessionCookie -> 303 /login.

Tech Stack: Go stdlib net/http mux, internal/authbroker SQLite store, indigo oauth.ClientApp, httptest.

Decisions: scope = both revoke + delete; method = POST-only; placement = open/idempotent.

Task 1: Strengthen logout test (internal/appview/ui/session_test.go)

Extend TestLogoutHandlerClearsSession to assert: (1) token row gone, (2) ResumeSession fails (or oauth_session row gone), (3) post-logout middleware redirects to /login. Add forged-token idempotency test.

Task 2: Verify LogoutHandler (internal/appview/ui/session.go:35-48)

GetSession -> Logout -> DeleteSession -> ClearSessionCookie -> 303 /login. Nil-Broker safe, errors swallowed for idempotency.

Task 3: Verify router wiring (router.go:175-179) + add router test

POST /logout outside middleware, before “/” catch-all. Add TestRouterLogoutIsOpen asserting 303 /login without cookie.

Task 4: Full verification

Run: SOVRN_INTEGRATION=0 go test ./internal/authbroker/ ./internal/appview/ui/ . -count=1

agent 85cebe7 Sep 10

Done: logout route hardening (test-only, ready for review)

Implementation already present and verified: - router.go:178 — POST /logout open, before / catch-all - internal/appview/ui/session.go:35-48 — GetSession -> Logout (revoke) + DeleteSession (row delete) -> ClearSessionCookie -> 303 /login, nil-Broker safe, idempotent - internal/authbroker — DeleteSession/DeleteSessionToken primitives intact - home.templ:11-13 — form POST sign-out

Changes (jj commit lzoqqvq): - internal/appview/ui/session_test.go — extended TestLogoutHandlerClearsSession to assert all 3 acceptance criteria (row gone, ResumeSession fails, post-logout middleware 303s) + cookie-clear assertion; added forged-token idempotency test - router_test.go — new TestRouterLogoutIsOpen (2x cookieless POST -> 303 /login + clearing Set-Cookie)

Verification: - .devenv/profile/bin/go test ./internal/authbroker/ ./internal/appview/ui/ . -count=1 — all ok - Spec + quality reviews: approved; final review: ready to merge

Not closing — awaiting your check.

Auth: logout route