mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
75047ef459
The injected logout built `?redirect_uri=<web_protocol>://<DOMAIN_PRIMARY>` and appended it to the end-session endpoint. Keycloak 26.7.1 (roles/web-app-keycloak/meta/services.yml:49-50) does not accept redirect_uri there - it takes post_logout_redirect_uri plus id_token_hint or client_id - so the parameter was dropped on arrival. Run 32284541284 job 96178507650 shows the proof: Keycloak answered with its logout-confirm interstitial carrying client_id=account, i.e. it resolved no client from the request at all. The value was wrong as well as inert. DOMAIN_PRIMARY is claimed only by roles/svc-prx-openresty, which declares no sso block, so it is never a registered redirect URI - the parameter would have been rejected on clearnet too the moment it became effective. Under tor it also glued the app's own scheme to the portal's host. Removing rather than correcting is what keeps this safe: every way this could break requires a redirect target to be validated, and after the diff there is no target. The emitted request is a strict prefix of today's. The same three lines were duplicated verbatim in four web-app roles; they collapse to the bare endpoint the shared role already passed. The caller graph is closed - initLogoutPatch appears exactly three times (definition, export, call site) - so the arity change leaves no orphan. Fixes nothing that was failing; no CI job was red because of this. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
49 lines
2.8 KiB
Markdown
49 lines
2.8 KiB
Markdown
# sys-front-inj-logout
|
||
|
||
This role injects a catcher that intercepts all logout elements in HTML pages served by NGINX and redirects them to a centralized logout endpoint via JavaScript.
|
||
|
||
## Description
|
||
|
||
The `sys-front-inj-logout` Ansible role automatically embeds a lightweight JavaScript snippet into your web application's HTML responses. This script identifies logout links, buttons, forms, and other elements, overrides their target URLs, and ensures users are redirected to a central OIDC logout endpoint, providing a consistent single sign‑out experience.
|
||
|
||
## Overview
|
||
|
||
- **Detection**: Scans the DOM for anchors (`<a>`), buttons, inputs, forms, `use` elements and any attributes indicating logout functionality.
|
||
- **Override**: Rewrites logout URLs to point at your OIDC provider’s logout endpoint.
|
||
- **Dynamic content support**: Uses a `MutationObserver` to handle AJAX‑loaded or dynamically injected logout elements.
|
||
- **CSP integration**: Automatically appends the required script hash into your CSP policy via the role’s CSP helper.
|
||
|
||
## Cosmos
|
||
|
||
The diagram places sys-front-inj-logout in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).
|
||
|
||
```mermaid
|
||
flowchart LR
|
||
subgraph role [sys-front-inj-logout 💻]
|
||
svc_logout["logout"]
|
||
end
|
||
```
|
||
|
||
Solid `1:1` edges are fixed relationships; dashed `0..1` edges are conditional (enabled only in matching deployments); red `0..0` edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in `meta/main.yml`.
|
||
|
||
## Features
|
||
|
||
- Seamless injection via NGINX `sub_filter` on `</head>`.
|
||
- Automatic detection of various logout mechanisms (links, buttons, forms).
|
||
- Centralized logout redirection for a unified user experience.
|
||
- No changes required in application code.
|
||
- Compatible with SPAs and dynamically generated content.
|
||
- CSP‑friendly: manages script hash for you.
|
||
|
||
## Further Resources
|
||
|
||
- [OpenID Connect RP-Initiated Logout](https://openid.net/specs/openid-connect-session-1_0.html#RPLogout)
|
||
- [NGINX `sub_filter` Module](http://NGINX.org/en/docs/http/ngx_http_sub_module.html)
|
||
- [Ansible Role Directory Structure](https://docs.ansible.com/ansible/latest/user_guide/playbooks_roles.html#role-directory-structure)
|
||
|
||
## Credits
|
||
|
||
Implemented by **[Kevin Veen-Birkenbach](https://www.veen.world)**.
|
||
Part of the [Infinito.Nexus Project](https://s.infinito.nexus/code) and maintained by [Kevin Veen-Birkenbach](https://www.veen.world).
|
||
Licensed under the [Infinito.Nexus Community License (Non-Commercial)](https://s.infinito.nexus/license).
|