From a42ae69880319ccb7778534531a12b9b33fc96d1 Mon Sep 17 00:00:00 2001
From: Azan Ali <azan.ali@arbisoft.com>
Date: Tue, 5 May 2026 18:43:07 +0500
Subject: [PATCH 1/2] fix: strip first subdomain for portal redirect on signout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace hardcoded "moneta." prefix with an empty string so the regex
strips just the leading subdomain (e.g. app.moneta.askii.ai →
moneta.askii.ai) regardless of the deployment domain.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 surfsense_web/lib/auth-utils.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/surfsense_web/lib/auth-utils.ts b/surfsense_web/lib/auth-utils.ts
index aadc550d09..6585e13987 100644
--- a/surfsense_web/lib/auth-utils.ts
+++ b/surfsense_web/lib/auth-utils.ts
@@ -239,9 +239,9 @@ export async function logout(): Promise<boolean> {
 	clearAllTokens();
 
 	if (typeof window !== "undefined") {
-		// Rewrite "foss-<app>.<domain>" → "foss.<domain>" so we land on the portal
-		// (outside ForwardAuth) instead of SurfSense's own root, which would silently re-auth.
-		const portalHost = window.location.hostname.replace(/^[^.]*\./, "moneta.");
+		// Strip the first subdomain so we land on the portal (outside ForwardAuth)
+		// instead of SurfSense's own root, which would silently re-auth.
+		const portalHost = window.location.hostname.replace(/^[^.]*\./, "");
 		window.location.href = `${window.location.protocol}//${portalHost}`;
 		return true;
 	}

From 5c0cf38be5632653002132c40bd0f0a0cf1a745a Mon Sep 17 00:00:00 2001
From: Azan Ali <azan.ali@arbisoft.com>
Date: Tue, 5 May 2026 18:50:27 +0500
Subject: [PATCH 2/2] fix: use lookahead regex to safely strip leading
 subdomain

Switch to /^[^.]+\.(?=[^.]*\.[^.]*\.)/ so the subdomain is only
stripped when at least two dot-separated parts remain, preventing
over-stripping on bare domains.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 surfsense_web/lib/auth-utils.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/surfsense_web/lib/auth-utils.ts b/surfsense_web/lib/auth-utils.ts
index 6585e13987..10bd31bdf2 100644
--- a/surfsense_web/lib/auth-utils.ts
+++ b/surfsense_web/lib/auth-utils.ts
@@ -241,7 +241,7 @@ export async function logout(): Promise<boolean> {
 	if (typeof window !== "undefined") {
 		// Strip the first subdomain so we land on the portal (outside ForwardAuth)
 		// instead of SurfSense's own root, which would silently re-auth.
-		const portalHost = window.location.hostname.replace(/^[^.]*\./, "");
+		const portalHost = window.location.hostname.replace(/^[^.]+\.(?=[^.]*\.[^.]*\.)/, "");
 		window.location.href = `${window.location.protocol}//${portalHost}`;
 		return true;
 	}