fix(auth): clear session in a plain route handler so logout sticks

Sign-out ran inside the auth.signOut tRPC mutation, whose route is wrapped
by the Auth.js auth() helper. With the JWT session strategy that wrapper
re-issues a refreshed session cookie at the end of the request, clobbering
the Set-Cookie deletion that signOut() emits — so the authjs.session-token
survived and /dashboard stayed authenticated after logout.

Move sign-out to a dedicated GET /api/auth/sign-out route (not auth()-wrapped),
hard-navigated to by the logout button, so the cookie deletion is the final
word and the overlay stays up until unload. Skip the Ory RP-initiated logout
round-trip and redirect straight to the post-logout page, relying on the
existing Kratos + Hydra admin revocations. Remove the broken tRPC signOut
procedure.

Author: huv1k

src/app/api/auth/sign-out/route.ts

@@ -0,0 +1,16 @@
+import 'server-only'
+
+import { type NextRequest, NextResponse } from 'next/server'
+import { auth } from '@/core/server/auth'
+
+// Sign-out lives in a plain route handler — NOT the auth()-wrapped tRPC route.
+// The Auth.js route wrapper re-issues a refreshed JWT session cookie at the end
+// of every request, which would clobber the session-cookie deletion that
+// signOut() emits, leaving the user logged in. Here nothing re-wraps the
+// request, so the deletion sticks. The client hard-navigates to this route, so
+// the logout overlay stays up until the document unloads (no soft RSC redirect
+// re-rendering the signed-out dashboard underneath it).
+export async function GET(request: NextRequest) {
+  const { redirectTo } = await auth.signOut({ origin: request.nextUrl.origin })
+  return NextResponse.redirect(new URL(redirectTo, request.nextUrl.origin))
+}

src/core/server/api/routers/auth.ts

@@ -1,37 +1,12 @@
-import { z } from 'zod'
 import { ConfirmEmailInputSchema } from '@/core/modules/auth/models'
-import { auth } from '@/core/server/auth'
 import { verifyOtpAndBuildRedirect } from '@/core/server/auth/verify-otp'
 import { createTRPCRouter } from '@/core/server/trpc/init'
 import { publicProcedure } from '@/core/server/trpc/procedures'
-import { relativeUrlSchema } from '@/core/shared/schemas/url'
 
 export const authRouter = createTRPCRouter({
   verifyOtp: publicProcedure
     .input(ConfirmEmailInputSchema)
     .mutation(({ ctx, input }) =>
       verifyOtpAndBuildRedirect(input, ctx.requestOrigin)
     ),
-
-  // Returns the URL the client should HARD-navigate to (via window.location)
-  // rather than redirect()-ing server-side: a soft RSC navigation re-renders the
-  // signed-out dashboard and tears down the "Logging out..." overlay before the
-  // browser leaves the page. publicProcedure (no auth guard) keeps sign-out
-  // resilient even if the session is already gone.
-  signOut: publicProcedure
-    .input(
-      z
-        .object({
-          returnTo: relativeUrlSchema.optional(),
-        })
-        .optional()
-    )
-    .mutation(async ({ ctx, input }) => {
-      const { redirectTo } = await auth.signOut({
-        origin: ctx.requestOrigin,
-        returnTo: input?.returnTo,
-      })
-
-      return { url: redirectTo }
-    }),
 })

src/core/server/auth/ory/signout-flow.ts

@@ -6,19 +6,15 @@ import { l, serializeErrorForLog } from '@/core/shared/clients/logger/logger'
 import { readOrySessionFields } from './authjs-session-boundary'
 import { revokeKratosSessionsForIdentity } from './kratos-session'
 import { revokeOryOAuthSessionsForSubject } from './oauth-session'
-import { buildOryLogoutUrl, ORY_POST_LOGOUT_PATH } from './signout'
+import { ORY_POST_LOGOUT_PATH } from './signout'
 
 export async function completeOrySignOut(origin = BASE_URL): Promise<string> {
-  const postLogoutUrl = new URL(ORY_POST_LOGOUT_PATH, origin)
-
-  let idToken: string | undefined
   let identityId: string | undefined
   let userId: string | undefined
   try {
     const session = await auth()
     const serverFields = readOrySessionFields(session)
     userId = session?.user?.id
-    idToken = serverFields?.idToken
     // The Kratos identity id resolved at sign-in — NOT the OIDC subject (which
     // is the E2B user id) — so we revoke the right identity's Kratos sessions.
     identityId = serverFields?.identityId
@@ -53,6 +49,8 @@ export async function completeOrySignOut(origin = BASE_URL): Promise<string> {
     identityId ? revokeKratosSessionsForIdentity(identityId) : null,
   ])
 
-  const logoutUrl = idToken ? buildOryLogoutUrl({ idToken, origin }) : null
-  return (logoutUrl ?? postLogoutUrl).toString()
+  // The admin revocations above already terminate the Kratos + Hydra sessions
+  // server-side, so we skip the Ory RP-initiated logout round-trip and redirect
+  // straight to the post-logout page — one redirect, no cross-origin hop.
+  return new URL(ORY_POST_LOGOUT_PATH, origin).toString()
 }

src/features/dashboard/sidebar/menu.tsx

@@ -1,13 +1,11 @@
 'use client'
 
 import { Portal } from '@radix-ui/react-portal'
-import { useMutation } from '@tanstack/react-query'
 import Link from 'next/link'
 import { useState } from 'react'
 import { PROTECTED_URLS } from '@/configs/urls'
 import { getTeamDisplayName } from '@/core/modules/teams/utils'
 import { cn } from '@/lib/utils'
-import { useTRPC } from '@/trpc/client'
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -31,31 +29,18 @@ import { TeamAvatar } from './team-avatar'
 
 export default function DashboardSidebarMenu() {
   const { team } = useDashboard()
-  const trpc = useTRPC()
   const [createTeamOpen, setCreateTeamOpen] = useState(false)
-  // explicit state instead of the mutation's isPending: isPending flips back to
-  // false the moment the mutation resolves, which would tear down the overlay a
-  // beat before the hard navigation unloads the page; this stays true until we
-  // navigate away, and only resets if the sign-out fails before that
+  // Stays true until the hard navigation unloads the page; the overlay should
+  // never tear down before then.
   const [isLoggingOut, setIsLoggingOut] = useState(false)
 
-  const signOutMutation = useMutation(
-    trpc.auth.signOut.mutationOptions({
-      onSuccess: ({ url }) => {
-        // Hard navigation (not the Next router): a soft RSC redirect re-renders
-        // the dashboard and tears down this overlay before the browser leaves
-        // the page. window.location keeps the overlay up until unload.
-        window.location.href = url
-      },
-      onError: () => {
-        setIsLoggingOut(false)
-      },
-    })
-  )
-
   const handleLogout = () => {
     setIsLoggingOut(true)
-    signOutMutation.mutate({})
+    // Hard navigation (not the Next router) to a plain route handler that clears
+    // the session cookie server-side: a soft RSC redirect would re-render the
+    // signed-out dashboard and tear down this overlay before the browser leaves
+    // the page. window.location keeps the overlay up until unload.
+    window.location.href = '/api/auth/sign-out'
   }
 
   return (

tests/integration/auth.test.ts

@@ -1,4 +1,5 @@
 import { redirect } from 'next/navigation'
+import { NextRequest } from 'next/server'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { AUTH_URLS, PROTECTED_URLS } from '@/configs/urls'
 import {
@@ -7,8 +8,6 @@ import {
   signInWithOAuthAction,
   signUpAction,
 } from '@/core/server/actions/auth-actions'
-import { authRouter } from '@/core/server/api/routers/auth'
-import { createCallerFactory, createTRPCContext } from '@/core/server/trpc/init'
 import { encodedRedirect } from '@/lib/utils/auth'
 
 // Create hoisted mock functions that can be used throughout the file
@@ -513,48 +512,26 @@ describe('Auth Actions - Integration Tests', () => {
     })
   })
 
-  describe('Sign Out Flow (trpc auth.signOut)', () => {
-    const createCaller = createCallerFactory(authRouter)
-
-    const getCaller = async () =>
-      createCaller(
-        await createTRPCContext({
-          headers: new Headers(),
-          requestUrl: 'http://localhost:3000/api/trpc',
-        })
-      )
+  describe('Sign Out Flow (GET /api/auth/sign-out)', () => {
+    const callSignOutRoute = async () => {
+      const { GET } = await import('@/app/api/auth/sign-out/route')
+      return GET(new NextRequest('https://app.e2b.dev/api/auth/sign-out'))
+    }
 
     /**
-     * AUTHENTICATION TEST: Verifies that sign-out returns the sign-in page url
+     * AUTHENTICATION TEST: the plain (non-auth()-wrapped) route handler clears
+     * the session via the provider and redirects to the sign-in page. Running
+     * the cookie clear here — rather than inside the auth()-wrapped tRPC route —
+     * is what keeps the deletion from being clobbered by a re-issued JWT cookie.
      */
-    it('should return sign-in page url on sign-out', async () => {
-      // Setup: Mock Supabase client to return successful sign-out
-      mockSupabaseClient.auth.signOut.mockResolvedValue({
-        error: null,
-      })
-
-      // Execute and Verify: the mutation returns the URL for the client to hard-navigate to
-      const caller = await getCaller()
-      await expect(caller.signOut()).resolves.toEqual({
-        url: AUTH_URLS.SIGN_IN,
-      })
-    })
+    it('clears the session and redirects to the sign-in page', async () => {
+      mockSupabaseClient.auth.signOut.mockResolvedValue({ error: null })
 
-    /**
-     * AUTHENTICATION TEST: Verifies that sign-out returns the sign-in url with returnTo
-     */
-    it('should return sign-in page url with returnTo parameter', async () => {
-      // Setup: Mock Supabase client to return successful sign-out
-      mockSupabaseClient.auth.signOut.mockResolvedValue({
-        error: null,
-      })
+      const response = await callSignOutRoute()
 
-      // Execute and Verify: the mutation returns the URL for the client to hard-navigate to
-      const caller = await getCaller()
-      await expect(caller.signOut({ returnTo: '/dashboard' })).resolves.toEqual(
-        {
-          url: `${AUTH_URLS.SIGN_IN}?returnTo=${encodeURIComponent('/dashboard')}`,
-        }
+      expect(mockSupabaseClient.auth.signOut).toHaveBeenCalled()
+      expect(response.headers.get('location')).toBe(
+        `https://app.e2b.dev${AUTH_URLS.SIGN_IN}`
       )
     })
   })