fix session logout

Author: drankou

src/core/server/proxy/classifier.ts

@@ -51,6 +51,10 @@ export function planNeedsAuthGate(plan: ProxyPlan): boolean {
   return plan.kind === 'auth-page' || plan.kind === 'dashboard-page'
 }
 
+export function isAuthEndpointRoute(pathname: string): boolean {
+  return matchesAnyPrefix(pathname, AUTH_ENDPOINT_PREFIXES)
+}
+
 export function isProxyAuthRoute(pathname: string): boolean {
   const normalizedPath = normalizePath(pathname)
   return (

src/core/server/proxy/runtime.ts

@@ -23,6 +23,7 @@ import { l, serializeErrorForLog } from '@/core/shared/clients/logger/logger'
 import { getAuthRouteRedirect } from './auth-routes'
 import {
   classifyProxyRequest,
+  isAuthEndpointRoute,
   type ProxyPlan,
   planNeedsAuthGate,
 } from './classifier'
@@ -64,11 +65,20 @@ export async function runDashboardProxy(
     return oryProxy(request)
   }
 
-  // Pattern B: refresh the e2b_session up front and propagate it to the same
+  const plan = classifyProxyRequest(request.nextUrl.pathname)
+
+  // refresh the e2b_session up front and propagate it to the same
   // request (request.cookies) so RSC/route handlers and the gate below read the
   // fresh token, then persist it on the outgoing response for the browser.
-  const session = await refreshSessionCookie(request)
-  const plan = classifyProxyRequest(request.nextUrl.pathname)
+  //
+  // Auth endpoints own their session lifecycle: sign-out reads the id_token from
+  // e2b_session before clearing it, the OAuth callback mints a fresh session. A
+  // dead refresh here would delete the cookie out of the propagated request
+  // before the handler reads it, breaking RP-initiated logout (Kratos/Hydra
+  // would never end the session), so skip the refresh for them.
+  const session = isAuthEndpointRoute(request.nextUrl.pathname)
+    ? skipRefresh
+    : await refreshSessionCookie(request)
 
   if (!planNeedsAuthGate(plan)) {
     return session.persist(await runProxyConcerns(request, plan))
@@ -96,6 +106,8 @@ type SessionRefresh = {
 
 const noPersist: SessionRefresh['persist'] = (response) => response
 
+const skipRefresh: SessionRefresh = { hasToken: false, persist: noPersist }
+
 async function refreshSessionCookie(
   request: NextRequest
 ): Promise<SessionRefresh> {

tests/integration/auth-ory-entrypoints.test.ts

@@ -187,6 +187,22 @@ describe('Ory auth entrypoints — middleware refresh (Pattern B)', () => {
     expect(sealOrySessionMock).not.toHaveBeenCalled()
     expect(response.cookies.get('e2b_session')).toBeUndefined()
   })
+
+  it('skips the refresh for auth endpoints so sign-out keeps its id_token', async () => {
+    // A dead refresh would otherwise delete e2b_session out of the propagated
+    // request before the sign-out handler reads the id_token from it, dropping
+    // RP-initiated logout so Kratos/Hydra never end the session.
+    refreshOrySessionMock.mockResolvedValue({ status: 'dead' })
+
+    const response = await proxy(
+      request('/api/auth/sign-out'),
+      {} as NextFetchEvent
+    )
+
+    expect(openOrySessionMock).not.toHaveBeenCalled()
+    expect(refreshOrySessionMock).not.toHaveBeenCalled()
+    expect(response.cookies.get('e2b_session')).toBeUndefined()
+  })
 })
 
 describe('Ory OAuth start route', () => {

tests/unit/proxy-plan.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import {
   classifyProxyRequest,
+  isAuthEndpointRoute,
   planNeedsAuthGate,
 } from '@/core/server/proxy/classifier'
 
@@ -23,3 +24,16 @@ describe('classifyProxyRequest', () => {
     expect(planNeedsAuthGate(plan)).toBe(needsAuthGate)
   })
 })
+
+describe('isAuthEndpointRoute', () => {
+  it.each([
+    ['/api/auth/sign-out', true],
+    ['/api/auth/oauth/start', true],
+    ['/api/auth', true],
+    ['/api/health', false],
+    ['/api/trpc/user.update', false],
+    ['/dashboard/team/sandboxes', false],
+  ])('%s -> %s', (pathname, expected) => {
+    expect(isAuthEndpointRoute(pathname)).toBe(expected)
+  })
+})