fix(auth): proper logout with domain cookie and Authelia end-session

src/main.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -122,16 +123,20 @@ func main() {
 	mux.HandleFunc("GET /auth/callback", oidcHandler.Callback)
 	mux.HandleFunc("POST /auth/callback", oidcHandler.Callback)
 	mux.HandleFunc("GET /auth/logout", func(w http.ResponseWriter, r *http.Request) {
-		// Clear session cookie
+		// Clear session cookie (with domain to match)
 		http.SetCookie(w, &http.Cookie{
 			Name:     "nextwks_session",
 			Value:    "",
 			Path:     "/",
+			Domain:   cfg.OIDC.Domain,
 			MaxAge:   -1,
 			HttpOnly: true,
 			SameSite: http.SameSiteStrictMode,
 		})
-		http.Redirect(w, r, "/auth/login", http.StatusFound)
+		// Redirect to Authelia's end session to also clear the Authelia session
+		logoutURL := fmt.Sprintf("%s/api/oidc/end-session?client_id=%s&post_logout_redirect_uri=%s",
+			cfg.OIDC.IssuerURL, cfg.OIDC.ClientID, url.QueryEscape(cfg.OIDC.RedirectURL))
+		http.Redirect(w, r, logoutURL, http.StatusFound)
 	})
 
 	// --- Workspace launcher (public, but OIDC-protected) ---