feat(server,web): add SSO logout tracking with response header by soneda-yuya · Pull Request #2142 · reearth/reearth-visualizer

soneda-yuya · 2026-04-01T04:19:59Z

What I've done

Server

Update reearth-accounts dependency to include logout tracking (feat(server): add server-side logout tracking for cross-service SSO reearth-accounts#212)
Add logout GraphQL mutation proxied to accounts API
Add Me.latestLogoutAt field to GraphQL schema
Add X-Latest-Logout-At response header middleware
Configure CORS ExposeHeaders for X-Latest-Logout-At
Adapt to breaking API changes in accounts workspace client types

Web

Read X-Latest-Logout-At header from API responses and store in Jotai atom
Compare latestLogoutAt with JWT iat in getAccessToken — if logout is newer, re-fetch token with cacheMode: "off" to bypass cache. In the same browser, this causes the re-fetch to fail (SSO session is already gone), resulting in the user being redirected to login.
Call logout mutation before Auth0 SDK logout() to record timestamp in accounts API

What I haven't done

Design documentation (separated into docs: add SSO logout design doc and design doc template #2141)

How I tested

Server: go build ./... and go test ./internal/adapter/gql/... ./internal/app/... pass
Web: yarn type and yarn build pass

Which point I want you to review particularly

Server middleware and CORS configuration for X-Latest-Logout-At header
Frontend logout detection flow: response header capture → JWT iat comparison → cacheMode: "off" re-fetch → logout
Logout mutation call timing (before Auth0 SDK logout)

Memo

Design doc PR: docs: add SSO logout design doc and design doc template #2141
Depends on: feat(server): add server-side logout tracking for cross-service SSO reearth-accounts#212
Implements Option 1 from the SSO logout design doc

Checklist

Verified backward compatibility related to feature modifications
Confirmed backward compatibility for migrations
Verified that no personally identifiable information (PII) is included

🤖 Generated with Claude Code

…ut tracking Incorporate reearth/reearth-accounts#212 which adds latest_logout_at field, logout mutation, and X-Latest-Logout-At response header for cross-service SSO logout detection. Adapt to breaking API changes in workspace client types. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add logout mutation, Me.latestLogoutAt field, and X-Latest-Logout-At response header middleware to enable cross-service SSO logout detection by proxying to reearth-accounts API. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Compare JWT iat with X-Latest-Logout-At response header timestamp. When a newer logout is detected, re-fetch access token with cacheMode: "off" to ensure the session reflects the latest auth state. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Send logout GraphQL mutation to record latestLogoutAt timestamp in accounts API before clearing the Auth0 SSO session. This enables other services to detect the logout via X-Latest-Logout-At header. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds server-side logout timestamp tracking and propagates it to the web client to detect SSO logout across sessions, refreshing tokens when the server indicates a newer logout.

Changes:

Server: add logout GraphQL mutation proxy + expose Me.latestLogoutAt and return X-Latest-Logout-At response header (with CORS exposure).
Web: capture X-Latest-Logout-At from GraphQL responses, compare against JWT iat, and force-refresh access tokens when server logout is newer.
Web: best-effort logout mutation call before invoking the Auth0 SDK logout.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
web/src/services/gql/provider/links/uploadLink.ts	Captures `X-Latest-Logout-At` from GraphQL responses and updates in-memory logout timestamp.
web/src/services/auth/logoutTimestamp.ts	Adds in-memory storage/getter/updater for latest logout timestamp.
web/src/services/auth/auth0Auth.ts	Adds JWT `iat` extraction + conditional token refresh, and sends logout mutation before Auth0 logout.
server/internal/app/auth_client.go	Maps `LatestLogoutAt` from accounts user model into domain user builder.
server/internal/app/app.go	Exposes `X-Latest-Logout-At` via CORS and adds middleware to attach header to private API responses.
server/internal/adapter/gql/resolver_mutation_workspace.go	Adapts workspace client input types to accounts API breaking changes.
server/internal/adapter/gql/resolver_mutation_user.go	Adds `logout` mutation and maps `LatestLogoutAt` from accounts user model.
server/internal/adapter/gql/gqlmodel/models_gen.go	Adds `latestLogoutAt` field to `Me` GraphQL model.
server/internal/adapter/gql/gqlmodel/convert_user.go	Populates `Me.latestLogoutAt` when available.
server/internal/adapter/gql/generated.go	Regenerates gqlgen outputs for new schema fields/mutation.
server/gql/user.graphql	Adds `Me.latestLogoutAt` and `Mutation.logout`.
server/go.mod / server/go.sum	Bumps `reearth-accounts` dependency to version including logout tracking.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

web/src/services/auth/auth0Auth.ts

server/internal/app/app.go

github-actions · 2026-04-01T04:27:26Z

🚀 Cloud Run Preview Deployed

🔗 Click here to open the preview in a new tab

Replace direct fetch call in auth0Auth.ts with Apollo Client mutation via useMeMutations. Each logout call site (Dashboard, Navbar, GlobalModal) now calls logoutFromAccount() before auth.logout(). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replace module-level let variable with Jotai atom to align with existing state management patterns. The GqlProvider passes the setter to uploadLink as a callback, and auth0Auth reads via useLatestLogoutAt. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Address Copilot review feedback: - Fix JWT iat parsing to handle base64url encoding (- / _ and padding) - Extract JWT utils to jwtUtils.ts for testability - Add unit tests for base64UrlDecode and getJwtIat - Add server test for X-Latest-Logout-At header middleware Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/src/services/auth/jwtUtils.ts

Add missing useLatestLogoutAt to @reearth/services/state mock in test utils to fix CI test failures. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/internal/adapter/gql/resolver_mutation_workspace.go

Copilot

Pull request overview

Copilot reviewed 26 out of 27 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

web/src/services/auth/jwtUtils.test.ts

web/src/services/state/index.ts

web/src/app/features/Navbar/hooks.ts

web/src/app/features/GlobalModal/index.tsx

web/src/app/features/Dashboard/hooks.ts

server/internal/adapter/gql/resolver_mutation_workspace.go

- Rename auth0Auth.test.ts to jwtUtils.test.ts to match tested module - Add comment clarifying latestLogoutAt uses Unix seconds (matches JWT iat) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 26 out of 27 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/src/services/state/index.ts

soneda-yuya and others added 4 commits April 1, 2026 13:18

soneda-yuya requested review from airslice, mkumbobeaty and pyshx as code owners April 1, 2026 04:20

Copilot AI review requested due to automatic review settings April 1, 2026 04:20

soneda-yuya temporarily deployed to dev April 1, 2026 04:20 — with GitHub Actions Inactive

soneda-yuya had a problem deploying to dev April 1, 2026 04:20 — with GitHub Actions Failure

github-actions bot added server web labels Apr 1, 2026

github-actions bot assigned soneda-yuya Apr 1, 2026

Copilot started reviewing on behalf of soneda-yuya April 1, 2026 04:20 View session

soneda-yuya mentioned this pull request Apr 1, 2026

feat(server): add server-side logout tracking for cross-service SSO reearth/reearth-accounts#212

Merged

5 tasks

soneda-yuya changed the title ~~feat(server,web): add server-side SSO logout tracking~~ feat(server,web): add SSO logout tracking with response header Apr 1, 2026

Copilot AI reviewed Apr 1, 2026

View reviewed changes

web/src/services/auth/auth0Auth.ts Outdated Show resolved Hide resolved

web/src/services/auth/auth0Auth.ts Outdated Show resolved Hide resolved

server/internal/app/app.go Show resolved Hide resolved

soneda-yuya had a problem deploying to dev April 1, 2026 04:27 — with GitHub Actions Failure

soneda-yuya had a problem deploying to dev April 1, 2026 09:28 — with GitHub Actions Failure

soneda-yuya temporarily deployed to dev April 1, 2026 09:28 — with GitHub Actions Inactive

soneda-yuya had a problem deploying to dev April 1, 2026 09:35 — with GitHub Actions Failure

soneda-yuya temporarily deployed to dev April 2, 2026 01:38 — with GitHub Actions Inactive

soneda-yuya had a problem deploying to dev April 2, 2026 01:51 — with GitHub Actions Error

soneda-yuya temporarily deployed to dev April 2, 2026 01:51 — with GitHub Actions Inactive

soneda-yuya commented Apr 2, 2026

View reviewed changes

web/src/services/auth/jwtUtils.ts Show resolved Hide resolved

fix(web): add useLatestLogoutAt to test mocks

ba6dc22

Add missing useLatestLogoutAt to @reearth/services/state mock in test utils to fix CI test failures. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

soneda-yuya temporarily deployed to dev April 2, 2026 01:58 — with GitHub Actions Inactive

soneda-yuya requested a review from Copilot April 2, 2026 01:59

Copilot started reviewing on behalf of soneda-yuya April 2, 2026 02:00 View session

soneda-yuya temporarily deployed to dev April 2, 2026 02:04 — with GitHub Actions Inactive

soneda-yuya commented Apr 2, 2026

View reviewed changes

server/internal/adapter/gql/resolver_mutation_workspace.go Show resolved Hide resolved

Copilot AI reviewed Apr 2, 2026

View reviewed changes

soneda-yuya commented Apr 2, 2026

View reviewed changes

server/internal/adapter/gql/resolver_mutation_workspace.go Show resolved Hide resolved

refactor(web): rename test file and clarify timestamp unit

7468185

- Rename auth0Auth.test.ts to jwtUtils.test.ts to match tested module - Add comment clarifying latestLogoutAt uses Unix seconds (matches JWT iat) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

soneda-yuya temporarily deployed to dev April 2, 2026 02:20 — with GitHub Actions Inactive

soneda-yuya had a problem deploying to dev April 2, 2026 02:20 — with GitHub Actions Failure

soneda-yuya requested a review from Copilot April 2, 2026 02:23

Copilot started reviewing on behalf of soneda-yuya April 2, 2026 02:24 View session

soneda-yuya temporarily deployed to dev April 2, 2026 02:26 — with GitHub Actions Inactive

Copilot AI reviewed Apr 2, 2026

View reviewed changes

chore(server): update reearth-accounts to main after PR #212 merge

f64591a

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

soneda-yuya temporarily deployed to dev April 2, 2026 08:02 — with GitHub Actions Inactive

soneda-yuya had a problem deploying to dev April 2, 2026 08:07 — with GitHub Actions Failure

airslice reviewed Apr 2, 2026

View reviewed changes

web/src/services/state/index.ts Show resolved Hide resolved

airslice approved these changes Apr 2, 2026

View reviewed changes

Merge branch 'main' into feat/sso-logout-tracking

f2469c8

soneda-yuya temporarily deployed to dev April 3, 2026 00:49 — with GitHub Actions Inactive

soneda-yuya temporarily deployed to dev April 3, 2026 00:54 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(server,web): add SSO logout tracking with response header#2142

feat(server,web): add SSO logout tracking with response header#2142
soneda-yuya wants to merge 11 commits intomainfrom
feat/sso-logout-tracking

soneda-yuya commented Apr 1, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

soneda-yuya commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What I've done

Server

Web

What I haven't done

How I tested

Which point I want you to review particularly

Memo

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

soneda-yuya commented Apr 1, 2026 •

edited

Loading

github-actions bot commented Apr 1, 2026 •

edited

Loading