feat(oauth): design the RP-initiated logout pages

[lorenzocorallo]

Summary

When an app signs a user out through /oauth2/end-session, the OAuth provider plugin answers with bare, unstyled HTML. The plugin has no option to restyle it.

• src/routes/api/auth/$.ts: for end-session requests, the handler recognises the plugin's logout pages by their data-oidc-logout-* markers. It answers with a 303 to /logout and keeps every Set-Cookie, including the signed confirmation cookie. The plugin still owns the protocol logic.
• src/routes/logout.tsx: a new page in the login card layout, with three states:
  • Confirm: shows the account and has Stay signed in and Sign out buttons. Sign out is a native POST to /api/auth/oauth2/end-session/confirm.
  • Signed out, including a note when the app's return address isn't registered.
  • Errors: expired request, app not allowed, token not verified, and a generic fallback.
• The query carries only fixed codes, never the plugin's message text, so nobody can put arbitrary text on the page through a link.

Screenshots

Before	After

Dark	Signed out	Error

Testing

• src/auth/logout-page.test.ts covers detecting each page, keeping the cookies through the redirect, and leaving other responses untouched.
• Tested locally with a real session: end-session → /logout → Sign out deletes the session and lands on the signed-out page.
• vp lint, vp fmt --check, and vp test pass.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d9929762-f2cb-43b7-b6a5-bff0da4a5297

---

📥 Commits

Reviewing files that changed from the base of the PR and between 8a1e2e9 and 337c115.

---

📒 Files selected for processing (5)

• src/auth/logout-page.test.ts
• src/auth/logout-page.ts
• src/routeTree.gen.ts
• src/routes/api/auth/$.ts
• src/routes/logout.tsx

---

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}