diff --git a/infra/authentik/custom-templates/base/header_js.html b/infra/authentik/custom-templates/base/header_js.html index 0dd9259..f34e333 100644 --- a/infra/authentik/custom-templates/base/header_js.html +++ b/infra/authentik/custom-templates/base/header_js.html @@ -262,6 +262,66 @@ } } + function isOidcLogoutFlow() { + const path = window.location.pathname; + const params = new URLSearchParams(window.location.search); + + return ( + path.includes("/end-session/") || + path.includes("/if/flow/default-invalidation-flow") || + params.has("post_logout_redirect_uri") + ); + } + + function getSafePostLogoutRedirect() { + const rawUrl = new URLSearchParams(window.location.search).get("post_logout_redirect_uri"); + if (!rawUrl) return null; + + try { + const url = new URL(rawUrl); + const allowedHosts = new Set([ + "launcher.local.nodedc", + "launcher.local.notdc", + "launcher.notdc.ru", + "platform.notdc.ru", + "notdc.ru", + ]); + + if (!["http:", "https:"].includes(url.protocol)) return null; + if (!allowedHosts.has(url.hostname)) return null; + if (!url.pathname.startsWith("/auth/logged-out")) return null; + + return url.toString(); + } catch { + return null; + } + } + + function redirectCompletedLogout(root) { + if (!isOidcLogoutFlow() || document.body?.dataset.nodedcLogoutRedirected === "true") return; + + const redirectUrl = getSafePostLogoutRedirect(); + if (!redirectUrl) return; + + const text = root.textContent || ""; + const logoutComplete = [ + "Logout successful", + "You've logged out", + "You have been logged out", + "Logged out", + "Вы вышли", + "Выход выполнен", + ].some((message) => text.includes(message)); + + if (!logoutComplete) return; + + document.body.dataset.nodedcLogoutRedirected = "true"; + document.body.classList.add("nodedc-auth-submitting"); + window.setTimeout(() => { + window.location.replace(redirectUrl); + }, 150); + } + let scheduled = false; function enhanceAuthFields() { @@ -273,6 +333,7 @@ enhanceSubmitHandoff(root); translateAuthText(root); restoreCardOnErrors(root); + redirectCompletedLogout(root); }); }