Implemented universal logout

tests/integration/test_universal_logout.py

@@ -0,0 +1,44 @@
+import unittest
+import glob
+import yaml
+
+class TestUniversalLogoutSetting(unittest.TestCase):
+    ROLES_PATH = "roles/web-app-*/config/main.yml"
+
+    def test_universal_logout_defined(self):
+        files = glob.glob(self.ROLES_PATH)
+        self.assertGreater(len(files), 0, f"No role config files found under {self.ROLES_PATH}")
+
+        errors = []
+
+        for file_path in files:
+            with open(file_path, "r", encoding="utf-8") as f:
+                try:
+                    data = yaml.safe_load(f)
+                except yaml.YAMLError as e:
+                    errors.append(f"YAML parse error in '{file_path}': {e}")
+                    continue
+
+            features = {}
+            if data is not None:
+                features = data.get("features", {})
+
+            if "universal_logout" not in features:
+                errors.append(
+                    f"Missing 'universal_logout' setting in features of '{file_path}'. "
+                    "You must explicitly set 'universal_logout' to true or false for this app."
+                )
+            else:
+                val = features["universal_logout"]
+                if not isinstance(val, bool):
+                    errors.append(
+                        f"The 'universal_logout' setting in '{file_path}' must be boolean true or false, "
+                        f"but found: {val} (type {type(val).__name__})"
+                    )
+
+        if errors:
+            self.fail("\n\n".join(errors))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/roles/web-svc-logout/filter_plugins/test_domain_filters.py

@@ -0,0 +1,99 @@
+# tests/unit/roles/web-svc-logout/filter_plugins/test_domain_filters.py
+
+import os
+import unittest
+import importlib.util
+
+# Directory of this test file: .../tests/unit/roles/web-svc-logout/filter_plugins
+THIS_DIR = os.path.dirname(__file__)
+
+# Compute the repo root by going up five levels: tests → unit → roles → web-svc-logout → filter_plugins → repo root
+REPO_ROOT = os.path.abspath(os.path.join(THIS_DIR, '../../../../..'))
+
+# Path to the actual plugin under roles/web-svc-logout/filter_plugins
+DOMAIN_FILTERS_PATH = os.path.join(
+    REPO_ROOT,
+    'roles',
+    'web-svc-logout',
+    'filter_plugins',
+    'domain_filters.py'
+)
+
+# Dynamically load the domain_filters module
+spec = importlib.util.spec_from_file_location('domain_filters', DOMAIN_FILTERS_PATH)
+domain_filters = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(domain_filters)
+FilterModule = domain_filters.FilterModule
+
+
+class TestLogoutDomainsFilter(unittest.TestCase):
+    def setUp(self):
+        self.filter_fn = FilterModule().filters()['logout_domains']
+
+    def test_flatten_and_feature_flag(self):
+        applications = {
+            "app1": {
+                "domains": {"canonical": "single.domain.com"},
+                "features": {"universal_logout": True},
+            },
+            "app2": {
+                "domains": {"canonical": ["list1.com", "list2.com"]},
+                "features": {"universal_logout": True},
+            },
+            "app3": {
+                "domains": {"canonical": {"k1": "dictA.com", "k2": "dictB.com"}},
+                "features": {"universal_logout": True},
+            },
+            "app4": {
+                "domains": {"canonical": "no-logout.com"},
+                "features": {"universal_logout": False},
+            },
+            "other": {
+                "domains": {"canonical": "ignored.com"},
+                "features": {"universal_logout": True},
+            },
+        }
+        group_names = ["app1", "app2", "app3", "app4"]
+        result = set(self.filter_fn(applications, group_names))
+        expected = {
+            "single.domain.com",
+            "list1.com",
+            "list2.com",
+            "dictA.com",
+            "dictB.com",
+        }
+        self.assertEqual(result, expected)
+
+    def test_missing_canonical_defaults_empty(self):
+        applications = {
+            "app1": {
+                "domains": {},  # no 'canonical' key
+                "features": {"universal_logout": True},
+            }
+        }
+        group_names = ["app1"]
+        self.assertEqual(self.filter_fn(applications, group_names), [])
+
+    def test_app_not_in_group(self):
+        applications = {
+            "app1": {
+                "domains": {"canonical": "domain.com"},
+                "features": {"universal_logout": True},
+            }
+        }
+        group_names = []
+        self.assertEqual(self.filter_fn(applications, group_names), [])
+
+    def test_invalid_domain_type(self):
+        applications = {
+            "app1": {
+                "domains": {"canonical": 123},
+                "features": {"universal_logout": True},
+            }
+        }
+        group_names = ["app1"]
+        self.assertEqual(self.filter_fn(applications, group_names), [123])
+
+
+if __name__ == '__main__':
+    unittest.main()