[snyaggarwal]

Fixes the Mapper part of OpenConceptLab/ocl_online#535.

Why

When a user's session expired, the first API call got a 401 and the forced sign-out sent them to Keycloak with post_logout_redirect_uri=https://map.openconceptlab.org/#/signin?returnTo=…, unencoded. The browser kept everything from # onwards as a fragment and never sent it, so Keycloak only received https://map.openconceptlab.org/. It rejected that and showed "We are sorry… Invalid redirect uri". This broke in 6ab7f9f, which changed /signin to /#/signin.

What changes

• Renew before signing out. On a 401, the app first gets a new token from Keycloak with prompt=none, then reloads so every request goes out again with it. It tries this at most once every 10 minutes. The forced sign-out runs only if renewal fails, so an expired Mapper token no longer signs the user out of the other OCL apps while their Keycloak session is still alive.
• A logout address Keycloak accepts. Every sign-out now returns to LOGIN_REDIRECT_URL, encoded (buildSSOLogoutURL). On a forced sign-out, the page to come back to waits in sessionStorage (forced_sign_out). On the next load the app goes straight to sign-in without rendering, and the normal return-page handling brings the user back to that page.
• Hardening:
  • logoutUser runs once even when several requests are turned down together.
  • A second forced sign-out within 10 minutes stays signed out instead of looping.
  • The sign-in callback (/oidc/login, ?code=) is never redirected away.
  • Old records expire.
  • Storage errors can't stop the app from rendering.
• Cleanup: the unused session_expired flag is removed. The new record covers it.

Verification

• npm test: 542 pass, including 9 new tests in src/common/__tests__/ssoSession.test.js. They cover the forced and normal logout URLs, resuming only once, expiry, the loop guard, the callback skip, blocked storage and the renewal limit. ESLint is clean on the changed files.
• Ran the app against a local mock API that answers 401 and 302s on logout:
  • Five parallel 401s produced exactly one logout, with post_logout_redirect_uri=http%3A%2F%2Flocalhost%3A4005, then sign-in, with /map-projects/?x=1 saved as the page to return to.
  • A second rejected token within the window produced one logout, then the user stayed signed out on / with no reload loop.
  • A sign-in callback load wasn't redirected.
• Not tested: the reload after a successful silent renewal, and a real Keycloak logout.

Before deploying

Confirm in the Keycloak admin console that the oclmap client accepts https://map.openconceptlab.org as a post-logout redirect URI. That's + (same as the redirect URIs) or an explicit entry.

Companion PRs (deployable in any order): OpenConceptLab/oclweb3#67 (same fix) and OpenConceptLab/oclapi2#946 (encodes the URLs it passes to Keycloak).

🤖 Generated with Claude Code

[snyaggarwal]

Verdict: Approve

Issue complete: yes. The forced 401 path now avoids the fragment-bearing logout redirect, preserves the same-tab return location, prevents concurrent/repeated recovery loops, and leaves normal sign-out using LOGIN_REDIRECT_URL. The callback guard and storage-failure handling cover the important failure modes.

Security blockers: none. The stored return target is derived from the current same-origin location and is passed through the existing same-site return handling.

Verification: all 542 local tests passed, including the new logout URL, resume, callback, storage, and renewal-window cases. GitHub lint/test and Snyk checks pass.

(snyaggarwal • ReviewAutomation/GPT-5)