49 lines
1.3 KiB
TypeScript
49 lines
1.3 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { getToken } from "next-auth/jwt";
|
|
|
|
type KeycloakToken = {
|
|
idToken?: string;
|
|
};
|
|
|
|
const sessionCookiePrefixes = [
|
|
"next-auth.session-token",
|
|
"__Secure-next-auth.session-token",
|
|
];
|
|
|
|
const isSessionCookie = (name: string) =>
|
|
sessionCookiePrefixes.some((prefix) => name.startsWith(prefix));
|
|
|
|
export const GET = async (request: NextRequest) => {
|
|
const localLoginUrl = new URL(
|
|
"/login",
|
|
process.env.NEXTAUTH_URL ?? request.nextUrl.origin,
|
|
);
|
|
const issuer = process.env.KEYCLOAK_ISSUER?.replace(/\/$/, "");
|
|
const clientId = process.env.KEYCLOAK_CLIENT_ID;
|
|
const token = (await getToken({
|
|
req: request,
|
|
secret: process.env.NEXTAUTH_SECRET,
|
|
})) as KeycloakToken | null;
|
|
const logoutUrl = issuer
|
|
? new URL(`${issuer}/protocol/openid-connect/logout`)
|
|
: localLoginUrl;
|
|
|
|
if (issuer) {
|
|
if (clientId) logoutUrl.searchParams.set("client_id", clientId);
|
|
if (token?.idToken) logoutUrl.searchParams.set("id_token_hint", token.idToken);
|
|
}
|
|
|
|
const response = NextResponse.redirect(logoutUrl);
|
|
for (const { name } of request.cookies.getAll()) {
|
|
if (isSessionCookie(name)) {
|
|
response.cookies.delete({
|
|
name,
|
|
path: "/",
|
|
secure: name.startsWith("__Secure-"),
|
|
});
|
|
}
|
|
}
|
|
|
|
return response;
|
|
};
|