From 2a4d954d6a39d0c7a0745a1059b97783a72a5b3e Mon Sep 17 00:00:00 2001
From: Alexanderamiri <alexanderamiri@hotmail.com>
Date: Fri, 23 Oct 2026 23:48:27 +0200
Subject: [PATCH 1/2] fix(auth): log out via Cognito /logout with client_id and
 logout_uri

signoutRedirect() sent no logout_uri, which Cognito's logout endpoint
requires. Clear the local user, then redirect to
https://<COGNITO_DOMAIN>/logout?client_id=...&logout_uri=<origin>/ so the
redirect matches the logout_urls declared in app.yaml. The domain comes
from runtimeConfig.public.oidcLogoutDomain, wired from COGNITO_DOMAIN.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 app.yaml                   |  1 +
 app/composables/useAuth.ts | 10 +++++++++-
 nuxt.config.ts             |  1 +
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/app.yaml b/app.yaml
index 8e5ab9b..4fedb28 100644
--- a/app.yaml
+++ b/app.yaml
@@ -26,6 +26,7 @@ auth:
   env:
     COGNITO_CLIENT_ID: NUXT_PUBLIC_OIDC_CLIENT_ID
     COGNITO_ISSUER_URL: NUXT_PUBLIC_OIDC_AUTHORITY
+    COGNITO_DOMAIN: NUXT_PUBLIC_OIDC_LOGOUT_DOMAIN
 
 environment:
   CUPCAKE_BACKEND: https://cupcake-backend.javazone.no
diff --git a/app/composables/useAuth.ts b/app/composables/useAuth.ts
index 91bc639..99998de 100644
--- a/app/composables/useAuth.ts
+++ b/app/composables/useAuth.ts
@@ -76,7 +76,15 @@ export async function completeLoginCallback(): Promise<string> {
 export async function logout(): Promise<void> {
   currentUser = null
   await getUserManager().removeUser()
-  await getUserManager().signoutRedirect()
+
+  // Cognito's /logout ignores post_logout_redirect_uri; it needs client_id and
+  // a logout_uri that exactly matches one of the client's logout URLs.
+  const { oidcClientId, oidcLogoutDomain } = useRuntimeConfig().public
+  const params = new URLSearchParams({
+    client_id: oidcClientId,
+    logout_uri: `${window.location.origin}/`,
+  })
+  window.location.assign(`https://${oidcLogoutDomain}/logout?${params}`)
 }
 
 let tokenEndpointPromise: Promise<string> | null = null
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 88aa7eb..a4c320d 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -16,6 +16,7 @@ export default defineNuxtConfig({
       oidcAuthority:
         "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_Icikv3dtD",
       oidcClientId: "",
+      oidcLogoutDomain: "javabin-internal.auth.eu-central-1.amazoncognito.com",
     },
   },
 

From b98c1692c4017e4add938217bd8b490f1cb4080b Mon Sep 17 00:00:00 2001
From: "javabin-platform[bot]" <platform@javazone.no>
Date: Fri, 23 Oct 2026 22:38:04 +0000
Subject: [PATCH 2/2] chore(terraform): update generated Terraform from
 app.yaml [skip ci]

---
 terraform/main.tf | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/terraform/main.tf b/terraform/main.tf
index c97d05b..4d50f84 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -76,13 +76,14 @@ module "service" {
   readonly_root_filesystem = true
   target_group_arn         = module.routing.target_group_arn
   environment = {
-    CUPCAKE_BACKEND            = "https://cupcake-backend.javazone.no"
-    COGNITO_USER_POOL_ID       = module.auth.user_pool_id
-    COGNITO_DOMAIN             = module.auth.user_pool_domain
-    COGNITO_ISSUER_URL         = module.auth.issuer_url
-    COGNITO_WELL_KNOWN_URL     = module.auth.well_known_url
-    COGNITO_GROUPS             = "helter"
-    NUXT_PUBLIC_OIDC_AUTHORITY = module.auth.issuer_url
+    CUPCAKE_BACKEND                = "https://cupcake-backend.javazone.no"
+    COGNITO_USER_POOL_ID           = module.auth.user_pool_id
+    COGNITO_DOMAIN                 = module.auth.user_pool_domain
+    COGNITO_ISSUER_URL             = module.auth.issuer_url
+    COGNITO_WELL_KNOWN_URL         = module.auth.well_known_url
+    COGNITO_GROUPS                 = "helter"
+    NUXT_PUBLIC_OIDC_AUTHORITY     = module.auth.issuer_url
+    NUXT_PUBLIC_OIDC_LOGOUT_DOMAIN = module.auth.user_pool_domain
   }
   secrets = {
     COGNITO_CLIENT_ID          = module.auth.client_id_arn