Skip to content

Implement session sign-out #3973

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
madurangasiriwardena merged 1 commit into from
Jul 16, 2026
Merged

Implement session sign-out #3973

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions backend/.mockery.private.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,15 @@ packages:
pkgname: par
filename: "{{.InterfaceName}}_mock_test.go"

github.com/thunder-id/thunderid/internal/oauth/oauth2/logout:
interfaces:
logoutRequestStoreInterface:
config:
dir: internal/oauth/oauth2/logout
structname: '{{.InterfaceName}}Mock'
pkgname: logout
filename: "{{.InterfaceName}}_mock_test.go"

github.com/thunder-id/thunderid/internal/oauth/oauth2/dpop:
config:
all: true
Expand Down Expand Up @@ -404,6 +413,12 @@ packages:
structname: ExecutorInterfaceMock
pkgname: core
filename: "ExecutorInterface_mock_test.go"
RuntimeStoreProvider:
config:
dir: internal/oauth/oauth2/logout
structname: '{{.InterfaceName}}Mock'
pkgname: logout
filename: "{{.InterfaceName}}_mock_test.go"

github.com/thunder-id/thunderid/internal/flow/graphbuilder:
interfaces:
Expand Down
3 changes: 2 additions & 1 deletion backend/cmd/server/servicemanager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -482,7 +482,8 @@ func registerServices(mux *http.ServeMux, cacheManager cache.CacheManagerInterfa
// Initialize OAuth services.
err = oauth.Initialize(mux, actorProvider, authnProvider, jwtService, jweService,
flowExecService, observabilitySvc, runtimeCryptoSvc, ouService, attributeCacheService, authZService,
resourceService, serverConfigService, i18nService, idpService, dpopVerifier, oauthCfg)
resourceService, serverConfigService, i18nService, idpService, dpopVerifier,
runtimeStoreProvider, oauthCfg)
if err != nil {
logger.Fatal(ctx, "Failed to initialize OAuth services", log.Error(err))
}
Expand Down
2 changes: 2 additions & 0 deletions backend/dbscripts/configdb/postgres.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,8 @@ CREATE TABLE "INBOUND_CLIENT" (
IS_REGISTRATION_FLOW_ENABLED CHAR(1) DEFAULT '1',
RECOVERY_FLOW_ID VARCHAR(100),
IS_RECOVERY_FLOW_ENABLED CHAR(1) DEFAULT '0',
SIGNOUT_FLOW_ID VARCHAR(100),
IS_SIGNOUT_FLOW_ENABLED CHAR(1) DEFAULT '0',
THEME_ID VARCHAR(36),
LAYOUT_ID VARCHAR(36),
PROPERTIES JSONB,
Expand Down
2 changes: 2 additions & 0 deletions backend/dbscripts/configdb/sqlite.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,8 @@ CREATE TABLE "INBOUND_CLIENT" (
IS_REGISTRATION_FLOW_ENABLED CHAR(1) DEFAULT '1',
RECOVERY_FLOW_ID VARCHAR(100),
IS_RECOVERY_FLOW_ENABLED CHAR(1) DEFAULT '0',
SIGNOUT_FLOW_ID VARCHAR(100),
IS_SIGNOUT_FLOW_ENABLED CHAR(1) DEFAULT '0',
THEME_ID VARCHAR(36),
LAYOUT_ID VARCHAR(36),
PROPERTIES TEXT,
Expand Down
1 change: 1 addition & 0 deletions backend/internal/actorprovider/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,7 @@ func toProviderOAuthClient(c *providers.OAuthClient) *providers.OAuthClient {
OUID: c.OUID,
ClientID: c.ClientID,
RedirectURIs: c.RedirectURIs,
PostLogoutRedirectURIs: c.PostLogoutRedirectURIs,
TokenEndpointAuthMethod: c.TokenEndpointAuthMethod,
PKCERequired: c.PKCERequired,
PublicClient: c.PublicClient,
Expand Down
9 changes: 6 additions & 3 deletions backend/internal/actorprovider/utils.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,9 +54,12 @@ func assembleApplication(
app := &providers.Application{
ID: client.ID,
InboundAuthProfile: providers.InboundAuthProfile{
Assertion: client.Assertion,
LoginConsent: client.LoginConsent,
AllowedUserTypes: client.AllowedUserTypes,
AuthFlowID: client.AuthFlowID,
SignOutFlowID: client.SignOutFlowID,
IsSignOutFlowEnabled: client.IsSignOutFlowEnabled,
Comment on lines +57 to +59

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift

🔴 Documentation Required
This PR introduces user-facing changes that are not covered by documentation updates under docs/. Please update the relevant documentation before merging.

Missing documentation:

  • backend/internal/actorprovider/utils.go#L57-L59: Document the sign-out flows and post-logout redirect URIs configuration in docs/content/guides/ or related config pages.
  • backend/internal/oauth/oauth2/constants/constants.go#L69-L69: Document the OAuth2/OIDC /oauth2/logout endpoint, post_logout_redirect_uri parameter, and end_session_endpoint discovery in docs/content/apis.mdx.
  • backend/internal/flow/flowexec/service_test.go#L2240-L2254: Document the native logout through /flow/execute (sign-out flows) in docs/content/apis.mdx.
📍 Affects 3 files
  • backend/internal/actorprovider/utils.go#L57-L59 (this comment)
  • backend/internal/oauth/oauth2/constants/constants.go#L69-L69
  • backend/internal/flow/flowexec/service_test.go#L2240-L2254
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/internal/actorprovider/utils.go` around lines 57 - 59, Update the
documentation for all three affected sites: in docs/content/guides/ or the
relevant configuration pages, document the sign-out flow, sign-out enablement,
and post-logout redirect URI settings represented by actorprovider
configuration; in docs/content/apis.mdx, document the OAuth2/OIDC /oauth2/logout
endpoint, post_logout_redirect_uri parameter, and end_session_endpoint
discovery; and in the same API documentation, describe native logout through
/flow/execute using sign-out flows.

Source: Path instructions

Assertion: client.Assertion,
LoginConsent: client.LoginConsent,
AllowedUserTypes: client.AllowedUserTypes,
},
}

Expand Down
15 changes: 15 additions & 0 deletions backend/internal/actorprovider/utils_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,21 @@ func (s *UtilsTestSuite) TestAssembleApplication_NoClientID() {
s.Empty(app.InboundAuthConfig)
}

func (s *UtilsTestSuite) TestAssembleApplication_CarriesFlowIDs() {
client := &providers.InboundClient{
ID: "app-1",
AuthFlowID: "auth-flow",
SignOutFlowID: "signout-flow",
IsSignOutFlowEnabled: true,
}

app := assembleApplication(client, nil)

s.Equal("auth-flow", app.AuthFlowID)
s.Equal("signout-flow", app.SignOutFlowID)
s.True(app.IsSignOutFlowEnabled)
}

func (s *UtilsTestSuite) TestBuildApplication_NotFound() {
s.mockInbound.On("GetInboundClientByEntityID", mock.Anything, "missing").
Return((*inboundmodel.InboundClient)(nil), inboundclient.ErrInboundClientNotFound)
Expand Down
2 changes: 2 additions & 0 deletions backend/internal/agent/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1361,6 +1361,7 @@ func buildOAuthProfile(configs []providers.InboundAuthConfigWithSecret) *provide
}
return &providers.OAuthProfile{
RedirectURIs: cfg.RedirectURIs,
PostLogoutRedirectURIs: cfg.PostLogoutRedirectURIs,
GrantTypes: grantTypes,
ResponseTypes: sysutils.ConvertToStringSlice(cfg.ResponseTypes),
TokenEndpointAuthMethod: string(authMethod),
Expand All @@ -1386,6 +1387,7 @@ func oauthProfileToComplete(clientID string, p *providers.OAuthProfile) *provide
return &providers.OAuthConfigWithSecret{
ClientID: clientID,
RedirectURIs: p.RedirectURIs,
PostLogoutRedirectURIs: p.PostLogoutRedirectURIs,
GrantTypes: grants,
ResponseTypes: respTypes,
TokenEndpointAuthMethod: providers.TokenEndpointAuthMethod(p.TokenEndpointAuthMethod),
Expand Down
4 changes: 4 additions & 0 deletions backend/internal/application/declarative_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,9 @@ func parseToApplicationDTO(data []byte) (*model.ApplicationDTO, error) {
RecoveryFlowID: appRequest.RecoveryFlowID,
RecoveryFlowHandle: appRequest.RecoveryFlowHandle,
IsRecoveryFlowEnabled: appRequest.IsRecoveryFlowEnabled,
SignOutFlowID: appRequest.SignOutFlowID,
SignOutFlowHandle: appRequest.SignOutFlowHandle,
IsSignOutFlowEnabled: appRequest.IsSignOutFlowEnabled,
ThemeID: appRequest.ThemeID,
LayoutID: appRequest.LayoutID,
Assertion: appRequest.Assertion,
Expand Down Expand Up @@ -211,6 +214,7 @@ func parseToApplicationDTO(data []byte) (*model.ApplicationDTO, error) {
ClientID: config.OAuthConfig.ClientID,
ClientSecret: config.OAuthConfig.ClientSecret,
RedirectURIs: config.OAuthConfig.RedirectURIs,
PostLogoutRedirectURIs: config.OAuthConfig.PostLogoutRedirectURIs,
GrantTypes: config.OAuthConfig.GrantTypes,
ResponseTypes: config.OAuthConfig.ResponseTypes,
TokenEndpointAuthMethod: config.OAuthConfig.TokenEndpointAuthMethod,
Expand Down
13 changes: 13 additions & 0 deletions backend/internal/application/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,8 @@ func (ah *applicationHandler) HandleApplicationPostRequest(w http.ResponseWriter
IsRegistrationFlowEnabled: appRequest.IsRegistrationFlowEnabled,
RecoveryFlowID: appRequest.RecoveryFlowID,
IsRecoveryFlowEnabled: appRequest.IsRecoveryFlowEnabled,
SignOutFlowID: appRequest.SignOutFlowID,
IsSignOutFlowEnabled: appRequest.IsSignOutFlowEnabled,
ThemeID: appRequest.ThemeID,
LayoutID: appRequest.LayoutID,
Assertion: appRequest.Assertion,
Expand Down Expand Up @@ -112,6 +114,8 @@ func (ah *applicationHandler) HandleApplicationPostRequest(w http.ResponseWriter
IsRegistrationFlowEnabled: createdAppDTO.IsRegistrationFlowEnabled,
RecoveryFlowID: createdAppDTO.RecoveryFlowID,
IsRecoveryFlowEnabled: createdAppDTO.IsRecoveryFlowEnabled,
SignOutFlowID: createdAppDTO.SignOutFlowID,
IsSignOutFlowEnabled: createdAppDTO.IsSignOutFlowEnabled,
ThemeID: createdAppDTO.ThemeID,
LayoutID: createdAppDTO.LayoutID,
Assertion: createdAppDTO.Assertion,
Expand Down Expand Up @@ -191,6 +195,8 @@ func (ah *applicationHandler) HandleApplicationGetRequest(w http.ResponseWriter,
IsRegistrationFlowEnabled: appDTO.IsRegistrationFlowEnabled,
RecoveryFlowID: appDTO.RecoveryFlowID,
IsRecoveryFlowEnabled: appDTO.IsRecoveryFlowEnabled,
SignOutFlowID: appDTO.SignOutFlowID,
IsSignOutFlowEnabled: appDTO.IsSignOutFlowEnabled,
ThemeID: appDTO.ThemeID,
LayoutID: appDTO.LayoutID,
Assertion: appDTO.Assertion,
Expand Down Expand Up @@ -261,6 +267,7 @@ func (ah *applicationHandler) HandleApplicationGetRequest(w http.ResponseWriter,
oAuthAppConfig := inboundmodel.OAuthConfig{
ClientID: config.OAuthConfig.ClientID,
RedirectURIs: redirectURIs,
PostLogoutRedirectURIs: config.OAuthConfig.PostLogoutRedirectURIs,
GrantTypes: grantTypes,
ResponseTypes: responseTypes,
TokenEndpointAuthMethod: config.OAuthConfig.TokenEndpointAuthMethod,
Expand Down Expand Up @@ -331,6 +338,8 @@ func (ah *applicationHandler) HandleApplicationPutRequest(w http.ResponseWriter,
IsRegistrationFlowEnabled: appRequest.IsRegistrationFlowEnabled,
RecoveryFlowID: appRequest.RecoveryFlowID,
IsRecoveryFlowEnabled: appRequest.IsRecoveryFlowEnabled,
SignOutFlowID: appRequest.SignOutFlowID,
IsSignOutFlowEnabled: appRequest.IsSignOutFlowEnabled,
ThemeID: appRequest.ThemeID,
LayoutID: appRequest.LayoutID,
Assertion: appRequest.Assertion,
Expand Down Expand Up @@ -367,6 +376,8 @@ func (ah *applicationHandler) HandleApplicationPutRequest(w http.ResponseWriter,
IsRegistrationFlowEnabled: updatedAppDTO.IsRegistrationFlowEnabled,
RecoveryFlowID: updatedAppDTO.RecoveryFlowID,
IsRecoveryFlowEnabled: updatedAppDTO.IsRecoveryFlowEnabled,
SignOutFlowID: updatedAppDTO.SignOutFlowID,
IsSignOutFlowEnabled: updatedAppDTO.IsSignOutFlowEnabled,
ThemeID: updatedAppDTO.ThemeID,
LayoutID: updatedAppDTO.LayoutID,
Assertion: updatedAppDTO.Assertion,
Expand Down Expand Up @@ -462,6 +473,7 @@ func (ah *applicationHandler) processInboundAuthConfig(
ClientID: config.OAuthConfig.ClientID,
ClientSecret: config.OAuthConfig.ClientSecret,
RedirectURIs: redirectURIs,
PostLogoutRedirectURIs: config.OAuthConfig.PostLogoutRedirectURIs,
GrantTypes: grantTypes,
ResponseTypes: responseTypes,
TokenEndpointAuthMethod: config.OAuthConfig.TokenEndpointAuthMethod,
Expand Down Expand Up @@ -540,6 +552,7 @@ func (ah *applicationHandler) processInboundAuthConfigFromRequest(
ClientID: config.OAuthConfig.ClientID,
ClientSecret: config.OAuthConfig.ClientSecret,
RedirectURIs: config.OAuthConfig.RedirectURIs,
PostLogoutRedirectURIs: config.OAuthConfig.PostLogoutRedirectURIs,
GrantTypes: config.OAuthConfig.GrantTypes,
ResponseTypes: config.OAuthConfig.ResponseTypes,
TokenEndpointAuthMethod: config.OAuthConfig.TokenEndpointAuthMethod,
Expand Down
4 changes: 4 additions & 0 deletions backend/internal/application/model/application.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,8 @@ type BasicApplicationDTO struct {
IsRegistrationFlowEnabled bool
RecoveryFlowID string
IsRecoveryFlowEnabled bool
SignOutFlowID string
IsSignOutFlowEnabled bool
ThemeID string
LayoutID string
Template string
Expand Down Expand Up @@ -175,6 +177,8 @@ type BasicApplicationResponse struct {
IsRegistrationFlowEnabled bool `json:"isRegistrationFlowEnabled" jsonschema:"Registration enabled status."`
RecoveryFlowID string `json:"recoveryFlowId,omitempty" jsonschema:"Recovery Flow ID."`
IsRecoveryFlowEnabled bool `json:"isRecoveryFlowEnabled" jsonschema:"Recovery enabled status."`
SignOutFlowID string `json:"signOutFlowId,omitempty" jsonschema:"Sign-out flow ID."`
IsSignOutFlowEnabled bool `json:"isSignOutFlowEnabled" jsonschema:"Sign-out enabled status."`
ThemeID string `json:"themeId,omitempty" jsonschema:"Theme ID."`
LayoutID string `json:"layoutId,omitempty" jsonschema:"Layout ID."`
Template string `json:"template,omitempty" jsonschema:"Application Template."`
Expand Down
19 changes: 19 additions & 0 deletions backend/internal/application/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,7 @@ func (as *applicationService) CreateApplication(ctx context.Context, app *model.
appForReturn.AuthFlowID = inboundClient.AuthFlowID
appForReturn.RegistrationFlowID = inboundClient.RegistrationFlowID
appForReturn.RecoveryFlowID = inboundClient.RecoveryFlowID
appForReturn.SignOutFlowID = inboundClient.SignOutFlowID
var oauthToken *providers.OAuthTokenConfig
var userInfo *providers.UserInfoConfig
var scopeClaims map[string][]string
Expand Down Expand Up @@ -271,6 +272,7 @@ func (as *applicationService) ValidateApplication(ctx context.Context, app *mode
processedDTO.AuthFlowID = inboundClient.AuthFlowID
processedDTO.RegistrationFlowID = inboundClient.RegistrationFlowID
processedDTO.RecoveryFlowID = inboundClient.RecoveryFlowID
processedDTO.SignOutFlowID = inboundClient.SignOutFlowID

return processedDTO, inboundAuthConfig, nil
}
Expand Down Expand Up @@ -435,6 +437,7 @@ func (as *applicationService) UpdateApplication(ctx context.Context, appID strin
appForReturn.AuthFlowID = inboundClient.AuthFlowID
appForReturn.RegistrationFlowID = inboundClient.RegistrationFlowID
appForReturn.RecoveryFlowID = inboundClient.RecoveryFlowID
appForReturn.SignOutFlowID = inboundClient.SignOutFlowID
var oauthToken *providers.OAuthTokenConfig
var userInfo *providers.UserInfoConfig
var scopeClaims map[string][]string
Expand Down Expand Up @@ -770,6 +773,8 @@ func toInboundClient(dto *model.ApplicationProcessedDTO) inboundmodel.InboundCli
IsRegistrationFlowEnabled: dto.IsRegistrationFlowEnabled,
RecoveryFlowID: dto.RecoveryFlowID,
IsRecoveryFlowEnabled: dto.IsRecoveryFlowEnabled,
SignOutFlowID: dto.SignOutFlowID,
IsSignOutFlowEnabled: dto.IsSignOutFlowEnabled,
ThemeID: dto.ThemeID,
LayoutID: dto.LayoutID,
Assertion: dto.Assertion,
Expand Down Expand Up @@ -821,6 +826,8 @@ func toProcessedDTO(
IsRegistrationFlowEnabled: dao.IsRegistrationFlowEnabled,
RecoveryFlowID: dao.RecoveryFlowID,
IsRecoveryFlowEnabled: dao.IsRecoveryFlowEnabled,
SignOutFlowID: dao.SignOutFlowID,
IsSignOutFlowEnabled: dao.IsSignOutFlowEnabled,
ThemeID: dao.ThemeID,
LayoutID: dao.LayoutID,
Assertion: dao.Assertion,
Expand Down Expand Up @@ -927,6 +934,7 @@ func buildOAuthProfileFromProcessed(inboundAuth inboundmodel.InboundAuthConfigPr
oa := inboundAuth.OAuthConfig
return &providers.OAuthProfile{
RedirectURIs: oa.RedirectURIs,
PostLogoutRedirectURIs: oa.PostLogoutRedirectURIs,
GrantTypes: sysutils.ConvertToStringSlice(oa.GrantTypes),
ResponseTypes: sysutils.ConvertToStringSlice(oa.ResponseTypes),
TokenEndpointAuthMethod: string(oa.TokenEndpointAuthMethod),
Expand Down Expand Up @@ -1723,6 +1731,8 @@ func buildApplicationResponse(dto *model.ApplicationProcessedDTO) *providers.App
IsRegistrationFlowEnabled: dto.IsRegistrationFlowEnabled,
RecoveryFlowID: dto.RecoveryFlowID,
IsRecoveryFlowEnabled: dto.IsRecoveryFlowEnabled,
SignOutFlowID: dto.SignOutFlowID,
IsSignOutFlowEnabled: dto.IsSignOutFlowEnabled,
ThemeID: dto.ThemeID,
LayoutID: dto.LayoutID,
Assertion: dto.Assertion,
Expand All @@ -1747,6 +1757,7 @@ func buildApplicationResponse(dto *model.ApplicationProcessedDTO) *providers.App
OAuthConfig: &providers.OAuthConfigWithSecret{
ClientID: oauthAppConfig.ClientID,
RedirectURIs: oauthAppConfig.RedirectURIs,
PostLogoutRedirectURIs: oauthAppConfig.PostLogoutRedirectURIs,
GrantTypes: oauthAppConfig.GrantTypes,
ResponseTypes: oauthAppConfig.ResponseTypes,
TokenEndpointAuthMethod: oauthAppConfig.TokenEndpointAuthMethod,
Expand Down Expand Up @@ -1779,6 +1790,8 @@ func buildBasicApplicationResponse(
IsRegistrationFlowEnabled: cfg.IsRegistrationFlowEnabled,
RecoveryFlowID: cfg.RecoveryFlowID,
IsRecoveryFlowEnabled: cfg.IsRecoveryFlowEnabled,
SignOutFlowID: cfg.SignOutFlowID,
IsSignOutFlowEnabled: cfg.IsSignOutFlowEnabled,
ThemeID: cfg.ThemeID,
LayoutID: cfg.LayoutID,
IsReadOnly: cfg.IsReadOnly,
Expand Down Expand Up @@ -1827,6 +1840,8 @@ func buildBaseApplicationProcessedDTO(appID string, app *model.ApplicationDTO,
IsRegistrationFlowEnabled: app.IsRegistrationFlowEnabled,
RecoveryFlowID: app.RecoveryFlowID,
IsRecoveryFlowEnabled: app.IsRecoveryFlowEnabled,
SignOutFlowID: app.SignOutFlowID,
IsSignOutFlowEnabled: app.IsSignOutFlowEnabled,
ThemeID: app.ThemeID,
LayoutID: app.LayoutID,
Assertion: assertion,
Expand Down Expand Up @@ -1873,6 +1888,7 @@ func buildOAuthInboundAuthConfigProcessedDTO(
ID: appID,
ClientID: inboundAuthConfig.OAuthConfig.ClientID,
RedirectURIs: inboundAuthConfig.OAuthConfig.RedirectURIs,
PostLogoutRedirectURIs: inboundAuthConfig.OAuthConfig.PostLogoutRedirectURIs,
GrantTypes: inboundAuthConfig.OAuthConfig.GrantTypes,
ResponseTypes: inboundAuthConfig.OAuthConfig.ResponseTypes,
TokenEndpointAuthMethod: inboundAuthConfig.OAuthConfig.TokenEndpointAuthMethod,
Expand Down Expand Up @@ -1908,6 +1924,8 @@ func buildReturnApplicationDTO(
IsRegistrationFlowEnabled: app.IsRegistrationFlowEnabled,
RecoveryFlowID: app.RecoveryFlowID,
IsRecoveryFlowEnabled: app.IsRecoveryFlowEnabled,
SignOutFlowID: app.SignOutFlowID,
IsSignOutFlowEnabled: app.IsSignOutFlowEnabled,
ThemeID: app.ThemeID,
LayoutID: app.LayoutID,
Assertion: assertion,
Expand All @@ -1934,6 +1952,7 @@ func buildReturnApplicationDTO(
ClientID: inboundAuthConfig.OAuthConfig.ClientID,
ClientSecret: inboundAuthConfig.OAuthConfig.ClientSecret,
RedirectURIs: inboundAuthConfig.OAuthConfig.RedirectURIs,
PostLogoutRedirectURIs: inboundAuthConfig.OAuthConfig.PostLogoutRedirectURIs,
GrantTypes: inboundAuthConfig.OAuthConfig.GrantTypes,
ResponseTypes: inboundAuthConfig.OAuthConfig.ResponseTypes,
TokenEndpointAuthMethod: inboundAuthConfig.OAuthConfig.TokenEndpointAuthMethod,
Expand Down
5 changes: 5 additions & 0 deletions backend/internal/flow/common/constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,11 @@ const (
// to the transport layer for the per-flow cookie. Using the generic EngineData channel keeps SSO
// concepts out of the reusable engine contract.
RuntimeKeySSOSessionHandle = "ssoSessionHandle"
// RuntimeKeySSOSessionCleared is the ExecutorResponse EngineData signal the session sign-out node
// raises once it has terminated the session, telling the transport layer to clear the per-flow
// cookie. Like RuntimeKeySSOSessionHandle it rides the engine-only EngineData channel, keeping SSO
// concepts off the reusable engine contract.
RuntimeKeySSOSessionCleared = "ssoSessionCleared"
)

// SSOCheckpointKey scopes a per-checkpoint SSO control key (RuntimeKeySSOSessionPresent,
Expand Down
1 change: 1 addition & 0 deletions backend/internal/flow/executor/constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ const (
ExecutorNameFederatedAuthResolver = "FederatedAuthResolverExecutor"
ExecutorNameSSOCheck = "SSOCheckExecutor"
ExecutorNameSession = "SessionExecutor"
ExecutorNameSessionSignOut = "SessionSignOutExecutor"
ExecutorNameOTPExecutor = "OTPExecutor"
)

Expand Down
Loading
Loading