anbaric-cloud-hosting 1.23.0 → 1.23.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.23.0",
+  "version": "1.23.1",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.23.0",
-    "anbaric-plugins": "^1.23.0",
-    "anbaric-tsapi": "^1.23.0",
-    "anbaric-web": "^1.23.0",
+    "anbaric-data-store": "^1.23.1",
+    "anbaric-plugins": "^1.23.1",
+    "anbaric-tsapi": "^1.23.1",
+    "anbaric-web": "^1.23.1",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.23.0",
-    "anbaric-state-machine": "^1.23.0",
+    "anbaric-impl-cloud": "^1.23.1",
+    "anbaric-state-machine": "^1.23.1",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auth/Authenticator.ts

@@ -21,6 +21,13 @@ abstract class Authenticator {
         return false;
     }
 
+    // Where to send someone once their platform session has been cleared. An
+    // identity provider that keeps a session of its own should return its
+    // logout URL, or signing out would silently sign them straight back in.
+    logoutUrl() : string | undefined {
+        return undefined;
+    }
+
 }
 
 export { Authenticator, SESSION_COOKIE }

package/src/auth/SessionSigner.ts

@@ -79,6 +79,13 @@ class SessionSigner {
         else response.setHeader("Set-Cookie", Array.isArray(existing) ? [...existing, cookie] : [String(existing), cookie]);
     }
 
+    // Expires the session cookie; the attributes must match issue() or the
+    // browser keeps the original cookie alongside this one.
+    static clear(response : ServerResponse) : void {
+        response.setHeader("Set-Cookie",
+            `${SESSION_COOKIE}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
+    }
+
     private sign(payload : string) : string {
         return createHmac("sha256", this.secret).update(payload).digest("base64url");
     }

package/src/hosting/HostingServer.ts

@@ -18,6 +18,7 @@ import {ConsumersHandler} from "./handlers/ConsumersHandler";
 import {DocumentsHandler} from "./handlers/DocumentsHandler";
 import {JobsHandler} from "./handlers/JobsHandler";
 import {FaviconHandler} from "./handlers/FaviconHandler";
+import {LogoutHandler} from "./handlers/LogoutHandler";
 import {PagesHandler} from "./handlers/PagesHandler";
 import {PingHandler} from "./handlers/PingHandler";
 import {QueueHandler} from "./handlers/QueueHandler";
@@ -69,6 +70,7 @@ class HostingServer {
         publicRouter.registerRoot(pages);
         publicRouter.register("ping", ping);
         publicRouter.register("favicon.ico", new FaviconHandler());
+        publicRouter.register("logout", new LogoutHandler(authenticator));
         if (plugins.length > 0) publicRouter.registerApi("plugins", new PluginsHandler(plugins));
         publicRouter.registerApi("whoami", new WhoamiHandler());
         publicRouter.registerApi("sessions", sessions);

package/src/hosting/handlers/LogoutHandler.ts

@@ -0,0 +1,21 @@
+import {Authenticator} from "../../auth/Authenticator";
+import {SessionSigner} from "../../auth/SessionSigner";
+import {Request} from "../Request";
+import {RequestHandler} from "../RequestHandler";
+
+/* Ends the platform session. The cookie is cleared here; where the browser
+   goes next is the authenticator's business, because an identity provider
+   holding its own session has to be signed out of as well - otherwise the
+   redirect home just signs the person straight back in. */
+class LogoutHandler implements RequestHandler {
+
+    constructor(private authenticator? : Authenticator) {}
+
+    async handle(request : Request) : Promise<void> {
+        SessionSigner.clear(request.rawResponse);
+        request.redirect(this.authenticator?.logoutUrl() ?? "/");
+    }
+
+}
+
+export { LogoutHandler }