@mundogamernetwork/shared-ui 1.16.4 → 1.16.5

package/composables/useLogout.ts

@@ -1,41 +1,56 @@
-import { default as AuthService } from "../services/authService";
-
 export function useLogout() {
 	const authStore = useAuthStore();
 	const runtimeConfig = useRuntimeConfig();
 	const accountsBaseUrl = runtimeConfig.public.mgSharedUi?.accountsBaseUrl || runtimeConfig.public.accountsBaseUrl;
+	// Same host login uses (see MgLoginRegisterMenu's goLogin) — the platform's
+	// own API, not accountsBaseUrl. That's where OAuthLogoutController's real
+	// /logout route lives.
+	const apiBase = (
+		(runtimeConfig.public.mgSharedUi?.apiBaseURL as string) ||
+		(runtimeConfig.public.apiBaseURL as string) ||
+		(import.meta.env.VITE_API_BASE_URL as string) ||
+		""
+	).replace(/\/api\/v1\/?$/, "");
 
 	const performLogout = async (redirectTo?: string) => {
-		try {
-			await AuthService.logout();
-		} catch {
-			// continue with cleanup even if server call fails
-		}
-
-		// Clear auth state
+		// Clear client-visible auth state immediately so the UI doesn't sit in
+		// a signed-in state while the real server-side logout below completes.
 		authStore.clearUser();
 		authStore.$reset();
-
-		// Clear cookies client-side
-		if (typeof document !== "undefined") {
-			const cookiesToClear = ["oauth_token", "browser_id", "mundo_gamer_network_session", "XSRF-TOKEN"];
-			cookiesToClear.forEach((name) => {
-				document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;`;
-				document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; domain=${window.location.hostname};`;
-				document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; domain=.${window.location.hostname};`;
-			});
-		}
-
-		// Clear localStorage auth data
 		if (typeof localStorage !== "undefined") {
 			["accessToken", "userData", "userAbility"].forEach((key) => {
 				localStorage.removeItem(key);
 			});
 		}
 
-		// Redirect
 		const target = redirectTo || `${accountsBaseUrl}/login`;
-		window.location.href = target;
+
+		if (typeof document === "undefined" || !apiBase) {
+			if (typeof window !== "undefined") window.location.href = target;
+			return;
+		}
+
+		// The real session is an httpOnly `oauth_token` cookie set by the
+		// platform's own API — document.cookie can never read or clear an
+		// httpOnly cookie, on any domain. Only a real server response can clear
+		// it (a Set-Cookie header the browser actually honors), which means a
+		// genuine top-level POST navigation to that API's own /logout route,
+		// not an axios/fetch call whose response body a script merely inspects.
+		// POST is required (the route isn't registered for GET) and CSRF is
+		// already exempted server-side for exactly this cross-origin case.
+		const form = document.createElement("form");
+		form.method = "POST";
+		form.action = `${apiBase}/logout`;
+		form.style.display = "none";
+
+		const redirectField = document.createElement("input");
+		redirectField.type = "hidden";
+		redirectField.name = "redirect_to";
+		redirectField.value = target;
+		form.appendChild(redirectField);
+
+		document.body.appendChild(form);
+		form.submit();
 	};
 
 	return { performLogout };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mundogamernetwork/shared-ui",
-  "version": "1.16.4",
+  "version": "1.16.5",
   "description": "Mundo Gamer Network - Shared UI Layer (Nuxt 3)",
   "type": "module",
   "main": "./nuxt.config.ts",