From 54ffed6e572e10ea7332851008a200233842a27e Mon Sep 17 00:00:00 2001
From: Denozordec <shatskiy.blog@gmail.com>
Date: Sat, 18 Jul 2026 18:37:05 +0700
Subject: [PATCH] =?UTF-8?q?fix(auth):=20=D0=B2=D1=8B=D1=85=D0=BE=D0=B4?=
 =?UTF-8?q?=D0=B8=D1=82=D1=8C=20=D1=87=D0=B5=D1=80=D0=B5=D0=B7=20=D0=BF?=
 =?UTF-8?q?=D0=BE=D1=80=D1=82=D0=B0=D0=BB=20/logout=20=D0=B2=D0=BC=D0=B5?=
 =?UTF-8?q?=D1=81=D1=82=D0=BE=20SSO=20return=5Fto?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Иначе живая сессия портала сразу возвращала JWT в приложение.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 apps/web/src/components/layout/nav-user.tsx | 4 ++--
 apps/web/src/lib/auth.ts                    | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/apps/web/src/components/layout/nav-user.tsx b/apps/web/src/components/layout/nav-user.tsx
index c0d9f22..9548e67 100644
--- a/apps/web/src/components/layout/nav-user.tsx
+++ b/apps/web/src/components/layout/nav-user.tsx
@@ -39,7 +39,7 @@ import {
   clearToken,
   getClaims,
   isAuthEnabled,
-  redirectToPortalLogin,
+  redirectToPortalLogout,
   resetPortalHandoff,
 } from '@/lib/auth'
 
@@ -130,7 +130,7 @@ export function NavUser() {
   function handleSignOut() {
     clearToken()
     resetPortalHandoff()
-    redirectToPortalLogin()
+    redirectToPortalLogout()
   }
 
   return (
diff --git a/apps/web/src/lib/auth.ts b/apps/web/src/lib/auth.ts
index 5e75b71..2b65228 100644
--- a/apps/web/src/lib/auth.ts
+++ b/apps/web/src/lib/auth.ts
@@ -146,6 +146,14 @@ export function redirectToPortalLogin(returnTo?: string): boolean {
   return true
 }
 
+/** End portal SSO session (refresh cookie + portal token). Do not pass return_to. */
+export function redirectToPortalLogout(): void {
+  clearToken()
+  resetPortalHandoff()
+  const url = `${authPortalUrl()}/logout`
+  window.location.assign(url)
+}
+
 export function parseHashToken(hash: string): {
   accessToken: string | null
   expiresAt: string | null