#285 Fix Sign-Out Returns 403

[b-at-neu]

Closes #285

Summary

• Sign-out was failing with a 403 because authClient.signOut() (browser-side) POSTs to /api/auth/sign-out, which Neon Auth's upstream better-auth rejected due to CSRF/SameSite protection.
• Fix: replace the client-driven call with a new signOutUser() server action that calls authServer.signOut() server-side, forwarding the session cookie via next/headers — bypassing browser origin/CSRF constraints entirely.

Changes

• prisma/actions/auth.ts (new) — signOutUser() server action: calls authServer.signOut(), returns { error } on upstream failure, revalidates layout cache and redirects to /login on success.
• components/layouts/user-menu.tsx — replace the real-auth authClient.signOut() try/catch with signOutUser(); drop the now-unused authClient import and useRouter hook; keep the bypass branch (logoutBypassUser()) unchanged.

Testing plan

• Sign in via real OTP auth; open the user menu; click Log out; verify landing on /login with no error toast and session cleared (revisiting a gated route redirects to login).
• Verify the 403 "Could not sign out. Please try again." toast no longer appears for a normal real-auth sign-out.
• Force an upstream failure (temporarily set NEON_AUTH_BASE_URL to an invalid value) and confirm the action returns the error toast and the menu re-enables without crashing or redirecting.
• In dev with a bypass session: Log out still clears the bypass cookie and redirects to /login/bypass (unchanged path).
• Keyboard: open user menu, tab to Log out, press Enter — sign-out triggers; focus handled correctly by the Radix dropdown primitive.
• Confirm no authClient.signOut references remain in the codebase.

Automated checks

• prettier:check — pass
• eslint:check — pass
• tsc:check — pass

Notes

If the 403 persists in production after this change (server-side path still hits the upstream), the next investigation step is verifying the deployment origin is registered as a trusted origin in the Neon Auth dashboard — a config step outside this repo. The server-side path removes the most common cause (browser SameSite/CSRF fragility) and aligns with the repo's "mutations are server actions, no client fetching" rule.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aplio	Ready	Preview, Comment	Jun 29, 2026 9:54am

[b-at-neu]

Code Review — Cycle 1 · needs revision

1 open — 1 🟠 Medium (see inline)

[b-at-neu]

Revision — Cycle 1

fixed R1-M1 · 1706719

[b-at-neu]

Code Review — Cycle 1 · needs revision

1 open — 1 🟠 Medium (see inline)

[b-at-neu]

Code Review — Cycle 1 · needs revision

3 open — 1 🟡 Low, 2 ⚪ Nit (see inline)

Note: a stale review (Cycle 1 draft) was posted immediately before this one with an incorrect finding (R1-M1 claiming missing auth check — disregard it; getCurrentUser() is present at line 14 of prisma/actions/auth.ts). This review supersedes it.

[b-at-neu]

Revision — Cycle 1

fixed R1-M1, R1-L1, R1-N2, R1-N1 · e0936ed

[b-at-neu]

Code Review — Cycle 4 · needs revision

1 open — 1 🟠 Medium (see inline)

[b-at-neu]

R4-M1 🟠 Medium — toast.success('Signed out.') fires unconditionally before the action is called, so on the error path the user sees a success toast immediately followed by an error toast — contradictory feedback. ENGINEERING.md §4 requires a success toast for success and a specific error toast for { error }; showing both simultaneously violates that model. The rationale in the comment (fires before server redirect) is real but the fix is wrong: redirect() in a server action sends a redirect response to the client after the await resolves, so a toast fired after await signOutUser() on the non-error branch would also display before navigation. Fix: const result = await signOutUser(); if (isError(result)) { toast.error(result.error); } else { toast.success('Signed out.'); }.