From e7d919d4387c6147c089d8bfb413f9b8ca001cd8 Mon Sep 17 00:00:00 2001
From: awais786 <awais.qureshi@arbisoft.com>
Date: Wed, 6 May 2026 21:06:34 +0500
Subject: [PATCH] fix(logout): use NEXT_PUBLIC_LOGOUT_REDIRECT_URL, drop
 hostname regex
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The logout redirect was deriving the portal host from
window.location.hostname via regex. Three different regexes have shipped
across branches, and none cover both deployment shapes:

  foss-research.arbisoft.com    → foss.arbisoft.com   (prod, "<app>-<smb>.<domain>")
  research.foss.arbisoft.com    → foss.arbisoft.com   (sandbox, "<app>.<smb>.<domain>")

Recent regex `/^[^.]+\.(?=[^.]*\.[^.]*\.)/` works for sandbox but
silently no-ops on prod (3-label hostname) → user stays on the app
host → ForwardAuth re-auth loop.
Older regex `/^[^.]*\./, "foss."` works for prod but produces
`foss.foss.arbisoft.com` on sandbox.

The build/deploy pipeline already passes the right URL via
`NEXT_PUBLIC_LOGOUT_REDIRECT_URL` (see
foss-server-bundle-devstack Makefile dev.build.surfsense.web —
`--build-arg NEXT_PUBLIC_LOGOUT_REDIRECT_URL="https://$SMB_NAME.$PLATFORM_DOMAIN"`).
Read it directly. Hostname inspection is no longer involved, so the
same image works for any layout the deployer configures.

If the env var is unset, log and bail out instead of redirecting to a
broken URL — surfaces misconfig immediately.
---
 surfsense_web/lib/auth-utils.ts | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/surfsense_web/lib/auth-utils.ts b/surfsense_web/lib/auth-utils.ts
index 10bd31bdf2..abea6b19da 100644
--- a/surfsense_web/lib/auth-utils.ts
+++ b/surfsense_web/lib/auth-utils.ts
@@ -239,10 +239,19 @@ export async function logout(): Promise<boolean> {
 	clearAllTokens();
 
 	if (typeof window !== "undefined") {
-		// Strip the first subdomain so we land on the portal (outside ForwardAuth)
-		// instead of SurfSense's own root, which would silently re-auth.
-		const portalHost = window.location.hostname.replace(/^[^.]+\.(?=[^.]*\.[^.]*\.)/, "");
-		window.location.href = `${window.location.protocol}//${portalHost}`;
+		// Land on the portal (outside ForwardAuth) instead of SurfSense's own
+		// root, which would silently re-auth. The portal URL is provided by
+		// the build/deploy pipeline (NEXT_PUBLIC_LOGOUT_REDIRECT_URL), so the
+		// same image works across hostname shapes — `<app>-<smb>.<domain>`,
+		// `<app>.<smb>.<domain>`, etc. — without regex acrobatics.
+		const redirectUrl = process.env.NEXT_PUBLIC_LOGOUT_REDIRECT_URL;
+		if (!redirectUrl) {
+			console.error(
+				"NEXT_PUBLIC_LOGOUT_REDIRECT_URL is not set; cannot redirect to portal after logout"
+			);
+			return false;
+		}
+		window.location.href = redirectUrl;
 		return true;
 	}