From 4540746da2b14dce09290809bc85537fcf290462 Mon Sep 17 00:00:00 2001
From: inference-bot <bot@inference.coop>
Date: Tue, 29 Sep 2026 21:53:59 -0600
Subject: [PATCH] Logout: clear session + explicit logged-out page (Cloudron
 has no RP-initiated logout; silent re-auth was the bug)

---
 app/main.py | 39 +++++++++++++++++++++++++++++++++++++--
 1 file changed, 37 insertions(+), 2 deletions(-)

diff --git a/app/main.py b/app/main.py
index adb335d..f1bce20 100644
--- a/app/main.py
+++ b/app/main.py
@@ -199,9 +199,44 @@ async def oidc_callback(request: Request):
 
 
 @app.get("/logout")
-async def logout():
-    resp = RedirectResponse("/", status_code=302)
+async def logout(request: Request):
+    """Log out: clear our session, then show an explicit logged-out page.
+
+    Cloudron's OIDC provider removed its RP-initiated logout endpoint (forum:
+    "no app supports this properly"), so we cannot end the SSO session
+    programmatically. Redirecting to / would silently re-authenticate through
+    the still-valid SSO cookie — the "logout does nothing" bug. Instead we
+    clear our cookies and show a page with a manual link to sign out of
+    Cloudron SSO (my.inference.coop/logout) for a full sign-out.
+    """
+    html = """<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>Logged out — Inference Cooperative</title>
+<style>
+  body { font-family: 'Figtree', -apple-system, system-ui, sans-serif; background: #faf8f5;
+         color: #2d3327; display: flex; align-items: center; justify-content: center;
+         min-height: 100vh; margin: 0; }
+  .card { background: #fff; border: 1px solid #e4e0d8; border-radius: 14px;
+          padding: 32px 40px; max-width: 440px; text-align: center; }
+  h1 { font-size: 20px; margin: 0 0 12px; color: #2d3327; }
+  p { font-size: 14px; line-height: 1.6; color: #4a5442; margin: 0 0 16px; }
+  a.btn { display: inline-block; background: #5b8c5a; color: #fff; text-decoration: none;
+          padding: 9px 18px; border-radius: 8px; font-weight: 600; font-size: 14px; }
+  a.btn:hover { background: #4e7a4d; }
+  a.link { color: #3f6e3e; font-size: 13px; }
+</style></head>
+<body><div class="card">
+  <h1>You're logged out</h1>
+  <p>Your dashboard session has been cleared.</p>
+  <p>Note: you may still be signed in to Inference Cooperative SSO
+     (chat, portal, forum share that sign-in). To fully sign out everywhere,
+     log out of your Cloudron account too.</p>
+  <p><a class="btn" href="https://my.inference.coop/logout">Sign out of SSO</a></p>
+  <p><a class="link" href="/">Log back in</a></p>
+</div></body></html>"""
+    resp = HTMLResponse(html)
     resp.delete_cookie(oidc.SESSION_COOKIE)
+    resp.delete_cookie("oidc_state")
+    resp.delete_cookie("oidc_nonce")
     return resp