🛂 Adds OIDC postLogoutRedirectUri option (#2261)

docs/authentication/oidc.md

@@ -28,6 +28,7 @@ appConfig:
       adminGroup: dashy-admins           # Members of this group are admins
       adminRole: dashy-admin             # Or grant admin by role instead
       enableSilentRenew: true            # Refresh the session in the background before it expires
+      # postLogoutRedirectUri: 'https://dashy.example.com' # Where to send users after logout (must be registered with the provider)
       # allowedIssuers: []               # Only for multi-tenant providers to override discovery document
       # disableServerSideCheck: false    # Leave as false / unset. Setting to true makes auth just client-side
 ```
@@ -107,3 +108,17 @@ Notes:
 - If a silent renewal fails for any reason (no refresh token issued, refresh token expired or revoked, the provider returns no fresh id_token, a provider error), Dashy falls back to the normal interactive sign-in. Renewal can save a round-trip, but the interactive flow always remains the safety net.
 - Renewal is driven by the access token's lifetime. If your provider issues an id_token with a much shorter lifetime than the access token, renewal may lag; keeping the two lifetimes equal (the common default) works best.
 - With multiple tabs open against a provider that rotates refresh tokens on use, tabs can briefly contend for the refresh token; the affected tab simply falls back to interactive sign-in. This is inherent to browser-based refresh tokens, not specific to Dashy.
+
+
+## Setting logout redirect URL
+
+When you log out, Dashy sends you to your provider's logout page, and by default that's where you stay. Set `postLogoutRedirectUri` if you'd like the provider to send you back to Dashy (or anywhere else) once it's done:
+
+```yaml
+    oidc:
+      clientId: dashy
+      endpoint: 'https://your-oidc-provider.example.com'
+      postLogoutRedirectUri: 'https://dashy.example.com'
+```
+
+The URL is sent to the provider as `post_logout_redirect_uri`, so it needs to be registered as a valid post-logout redirect URI in your client's settings - most providers have a field for this right next to the sign-in redirect URIs. If it's not registered, many providers will show an error instead of completing the logout, so give the logout button a quick test after setting it. Left unset, nothing changes and logout ends at the provider as before. See [#2261](https://github.com/lissy93/dashy/issues/2261) for info.

docs/configuring.md

@@ -213,6 +213,7 @@ For more info, see the **[Authentication Docs](/docs/authentication.md)**
 **`adminGroup`** | `string` | _Optional_ | The group that will be considered as admin.
 **`scope`** | `string` | Required | The scope(s) to request from the OIDC provider
 **`enableSilentRenew`** | `boolean` | _Optional_ | If set to `true`, your session is silently renewed in the background before it expires (only works for providers which support the `offline_access` scope)
+**`postLogoutRedirectUri`** | `string` | _Optional_ | URL to send users back to after logging out at the provider (sent as `post_logout_redirect_uri`). Must be registered as a valid post-logout redirect URI with your provider. If unset, no redirect is requested
 **`allowedIssuers`** | `array` | _Optional_ | List of issuer URLs to accept tokens from. Needed for multi-tenant providers (e.g. Microsoft Entra) where the token issuer differs from the configured `endpoint`. If unset, the issuer from the discovery document is used
 **`disableServerSideCheck`** | `boolean` | _Optional_ | If `true`, the server skips token verification and endpoint protection, so OIDC is client-side only. Not recommended. Defaults to `false`
 

src/utils/auth/OidcAuth.js

@@ -58,6 +58,7 @@ class OidcAuth {
       adminGroup,
       adminRole,
       enableSilentRenew,
+      postLogoutRedirectUri,
     } = auth.oidc;
     if (typeof clientId === 'number' && !Number.isSafeInteger(clientId)) {
       ErrorHandler(
@@ -76,6 +77,7 @@ class OidcAuth {
       authority: endpoint,
       client_id: String(clientId),
       redirect_uri: `${window.location.origin}`,
+      post_logout_redirect_uri: postLogoutRedirectUri,
       response_type: 'code',
       scope: requestedScope,
       response_mode: 'query',

src/utils/config/ConfigSchema.json

@@ -691,6 +691,11 @@
                   "default": false,
                   "description": "If set to true, Dashy automatically renews your session in the background before it expires. Requires your OIDC provider to issue refresh tokens"
                 },
+                "postLogoutRedirectUri": {
+                  "title": "Post-Logout Redirect URI",
+                  "type": "string",
+                  "description": "URL to send users back to after logging out at the OIDC provider. Must be registered as a valid post-logout redirect URI with your provider"
+                },
                 "allowedIssuers": {
                   "title": "Allowed Token Issuers",
                   "type": "array",