#285 fix sign-out by moving it to a server action

Replace client-side authClient.signOut() with a signOutUser() server
action that proxies to authServer.signOut() via next/headers, removing
the browser SameSite/CSRF fragility that caused the 403.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: b-at-neu

components/layouts/user-menu.tsx

@@ -2,7 +2,6 @@
 
 import { useTheme } from 'next-themes';
 import Link from 'next/link';
-import { useRouter } from 'next/navigation';
 import { useTransition } from 'react';
 
 import {
@@ -16,9 +15,9 @@ import {
 } from 'lucide-react';
 import { toast } from 'sonner';
 
+import { signOutUser } from '@/prisma/actions/auth';
 import { logoutBypassUser } from '@/prisma/services/dev-bypass';
 
-import { authClient } from '@/lib/auth/client';
 import type { NavIdentity } from '@/lib/types';
 
 import {
@@ -57,7 +56,6 @@ export function UserMenu({
   const { name, email, roleLabel, isBypass } = identity;
   const displayName = name ?? email;
   const [pending, startTransition] = useTransition();
-  const router = useRouter();
   // next-themes is loaded with { ssr: false }; `theme` is undefined on first
   // render before the provider resolves. Default to 'system' to match
   // defaultTheme so the radio shows a selection without a flash.
@@ -74,14 +72,11 @@ export function UserMenu({
         await logoutBypassUser();
         return;
       }
-      try {
-        await authClient.signOut();
-        toast.success('Signed out.');
-        router.push('/login');
-        router.refresh();
-      } catch {
-        toast.error('Could not sign out. Please try again.');
+      const result = await signOutUser();
+      if (result && 'error' in result) {
+        toast.error(result.error);
       }
+      // On success the server action redirects to /login — no client navigation needed.
     });
   }
 

prisma/actions/auth.ts

@@ -0,0 +1,20 @@
+'use server';
+
+import { revalidatePath } from 'next/cache';
+import { redirect } from 'next/navigation';
+
+import { authServer } from '@/lib/auth/server';
+import type { ErrorType } from '@/lib/utils';
+
+// Signs out the current real (non-bypass) Neon Auth session.
+// Sends the sign-out request server-side via authServer, which forwards the
+// session cookie through next/headers — avoiding the browser SameSite/CSRF
+// fragility that caused the 403 when sign-out was driven client-side.
+export async function signOutUser(): Promise<ErrorType | void> {
+  const result = await authServer.signOut();
+
+  if (result.error) return { error: 'Could not sign out. Please try again.' };
+
+  revalidatePath('/', 'layout');
+  redirect('/login');
+}