Skip to content

use SMB_DASHBOARD_URL for logout redirect #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
aznszn wants to merge 2 commits into from
Closed

use SMB_DASHBOARD_URL for logout redirect #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e1e6319
use SMB_DASHBOARD_URL for logout redirect
aznszn May 4, 2026
3afd44f
drop unused logout urls
aznszn May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion surfsense_web/.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
NEXT_PUBLIC_FASTAPI_BACKEND_URL=http://localhost:8000
NEXT_PUBLIC_SIGNOUT_URL=https://<dashboard-domain>
NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE=LOCAL or GOOGLE

# mPass proxy auth — set when deployed behind oauth2-proxy + Traefik ForwardAuth
NEXT_PUBLIC_OIDC_LOGOUT_URL=https://<cognito-domain>/logout
NEXT_PUBLIC_OIDC_CLIENT_ID=<cognito-app-client-id>
NEXT_PUBLIC_OAUTH2_PROXY_URL=https://<subdomain-prefix>auth.<platform-domain>
NEXT_PUBLIC_ETL_SERVICE=UNSTRUCTURED or LLAMACLOUD or DOCLING
Expand Down
6 changes: 2 additions & 4 deletions surfsense_web/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,19 +41,17 @@ ARG NEXT_PUBLIC_OAUTH2_PROXY_URL=__NEXT_PUBLIC_OAUTH2_PROXY_URL__
# These are baked at build time (not placeholder-substituted). Next.js inlines
# them as literal strings and terser dead-code-eliminates branches based on
# truthiness; placeholder tokens look truthy and defeat that optimization.
ARG NEXT_PUBLIC_LOGOUT_REDIRECT_URL=
ARG NEXT_PUBLIC_OIDC_LOGOUT_URL=
ARG NEXT_PUBLIC_OIDC_CLIENT_ID=
ARG NEXT_PUBLIC_SIGNOUT_URL=

ENV NEXT_PUBLIC_FASTAPI_BACKEND_URL=$NEXT_PUBLIC_FASTAPI_BACKEND_URL
ENV NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE=$NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE
ENV NEXT_PUBLIC_ETL_SERVICE=$NEXT_PUBLIC_ETL_SERVICE
ENV NEXT_PUBLIC_ZERO_CACHE_URL=$NEXT_PUBLIC_ZERO_CACHE_URL
ENV NEXT_PUBLIC_DEPLOYMENT_MODE=$NEXT_PUBLIC_DEPLOYMENT_MODE
ENV NEXT_PUBLIC_OAUTH2_PROXY_URL=$NEXT_PUBLIC_OAUTH2_PROXY_URL
ENV NEXT_PUBLIC_LOGOUT_REDIRECT_URL=$NEXT_PUBLIC_LOGOUT_REDIRECT_URL
ENV NEXT_PUBLIC_OIDC_LOGOUT_URL=$NEXT_PUBLIC_OIDC_LOGOUT_URL
ENV NEXT_PUBLIC_OIDC_CLIENT_ID=$NEXT_PUBLIC_OIDC_CLIENT_ID
ENV NEXT_PUBLIC_SIGNOUT_URL=$NEXT_PUBLIC_SIGNOUT_URL

COPY --from=deps /app/node_modules ./node_modules
COPY . .
Expand Down
5 changes: 1 addition & 4 deletions surfsense_web/lib/auth-utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,10 +239,7 @@ export async function logout(): Promise<boolean> {
clearAllTokens();

if (typeof window !== "undefined") {
// Rewrite "foss-<app>.<domain>" → "foss.<domain>" so we land on the portal
// (outside ForwardAuth) instead of SurfSense's own root, which would silently re-auth.
const portalHost = window.location.hostname.replace(/^[^.]*\./, "moneta.");
window.location.href = `${window.location.protocol}//${portalHost}`;
window.location.href = process.env.NEXT_PUBLIC_SIGNOUT_URL!;
return true;
}

Expand Down
8 changes: 8 additions & 0 deletions surfsense_web/next.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,14 @@ import createNextIntlPlugin from "next-intl/plugin";
// Create the next-intl plugin
const withNextIntl = createNextIntlPlugin("./i18n/request.ts");

// Compulsory build-time env vars
const REQUIRED_ENV_VARS = ["NEXT_PUBLIC_SIGNOUT_URL"] as const;
for (const key of REQUIRED_ENV_VARS) {
if (!process.env[key]) {
throw new Error(`Missing required environment variable: ${key}`);
Comment on lines +9 to +13
}
}

// TODO: Separate app routes (/login, /dashboard) from marketing routes
// (landing page, /contact, /pricing, /docs) so the desktop build only
// ships what desktop users actually need.
Expand Down
Loading