[snyaggarwal]

Fixes the TermBrowser v3 part of OpenConceptLab/ocl_online#535. This is the same fix as OpenConceptLab/oclmap#109.

Why

TBv3's forced sign-out (a 401 from the API) built post_logout_redirect_uri=<origin>/#/signin?returnTo=…, unencoded. The browser never sends the #… part, so Keycloak receives a bare origin with a trailing slash, rejects it, and the user ends on "We are sorry… Invalid redirect uri" instead of the sign-in page.

What changes

• Renew before signing out. On a 401, the app first gets a new token from Keycloak with prompt=none and reloads. It tries this at most once every 10 minutes. The forced sign-out runs only if renewal fails.
• A logout address Keycloak accepts. Every sign-out returns to LOGIN_REDIRECT_URL, encoded. On a forced sign-out, the page to come back to waits in sessionStorage (forced_sign_out), and the next load goes straight to sign-in and back to that page.
• Hardening:
  • logoutUser runs once even when several requests are turned down together.
  • A second forced sign-out within 10 minutes stays signed out instead of looping.
  • The sign-in callback is never redirected away.
  • Old records expire.
  • Storage errors can't stop the app from rendering.
• Cleanup: the unused session_expired sessionStorage flag is removed. The auth.session_expired locale string was already unused and is left as is.
• Tests: adds an npm test script (node --test, as in oclmap) and src/common/__tests__/ssoSession.test.js. These are the first tests for ssoSession.js here; the file's original part is identical to oclmap's.

Verification

• npm test: 20 pass. ESLint, including the spellcheck rule, is clean on the changed files.
• Ran the app against a local mock API that answers 401 and 302s on logout:
  • Four parallel 401s on /orgs/CIEL/?x=1 produced exactly one logout, with post_logout_redirect_uri=http%3A%2F%2Flocalhost%3A4011, then sign-in, with /orgs/CIEL/?x=1 saved as the page to return to.
  • A second rejected token within the window produced one logout, then the user stayed signed out on / with no reload loop.
• Not tested: the reload after a successful silent renewal, and a real Keycloak logout.

Before deploying

Confirm in the Keycloak admin console that the oclv3 client accepts https://app.v3.openconceptlab.org as a post-logout redirect URI.

Companion PRs (deployable in any order): OpenConceptLab/oclmap#109 and OpenConceptLab/oclapi2#946 (encodes the URLs it passes to Keycloak).

🤖 Generated with Claude Code

[snyaggarwal]

Verdict: Approve

Issue complete: yes. This applies the same safe forced-sign-out flow as the Mapper: the registered base URL is used for logout, the current page is retained in same-tab storage, and callback/loop/storage failure cases are guarded. Normal sign-out remains unchanged.

Security blockers: none. The return target originates from the current same-origin location and continues through the existing same-site return handling.

Verification: all 20 local tests passed, including the new forced logout and resume coverage. GitHub ESLint and Snyk checks pass.

(snyaggarwal • ReviewAutomation/GPT-5)