[DoDiODev]

⚠️ Pre Checklist

Please complete ALL items in this checklist, and remove before submitting

• I have read through the Contributing Documentation.
• I have added relevant tests.
• I have added relevant documentation. (env.example)
• I will add labels to the PR, such as pr-type/bug-fix, pr-type/feature-development, etc.
  (I can't set labels myself; suggested: pr-type/feature-development, component/config-ui)

Summary

Two gaps in the OIDC login added in #8854:

1. Logout does not return to DevLake. With OIDC_LOGOUT_REDIRECT=true,
   /auth/logout returns the bare end_session_endpoint. Keycloak 18+ then
   shows "Do you want to log out?" and leaves the user on a Keycloak page.
2. Login errors show raw JSON. For example, a user whose email is not in
   OIDC_ALLOW_DOMAINS/OIDC_ALLOW_EMAILS gets 403 {"message":"user is not allowed"} in the browser. Their IdP session stays alive, so clicking
   "Sign in" again ends in the same error without a way out.

RP-initiated logout

• The logoutUrl now carries client_id, post_logout_redirect_uri and
  id_token_hint (OpenID Connect RP-Initiated Logout 1.0). Keycloak skips the
  confirmation prompt and sends the user back to DevLake.
• New optional OIDC_<NAME>_POST_LOGOUT_REDIRECT_URL. Default: origin of
  OIDC_<NAME>_REDIRECT_URL + /.
• The raw id_token is kept in a new auth_sessions.id_token column (migration
  20261107000001). It is only stored when OIDC_LOGOUT_REDIRECT=true,
  never exposed via JSON, and cleared when the session is revoked.

Login error page

• Browser-facing failures in /auth/login and /auth/callback now redirect
  to a new config-ui route /auth-error?code=<code> instead of returning
  JSON. Codes: forbidden, expired (state/cookie problems), idp_error
  (IdP returned an error, discovery/exchange/verification failed),
  server_error. Details only go to the server log; rejected logins are logged
  as a warning with sub and email.
• The page uses the existing TipLayout (same look as the other error pages).
• For forbidden:
  • Request access — shown only if the new optional OIDC_ACCESS_REQUEST_URL
    is set (exposed via /auth/methods as accessRequestUrl).
  • Sign in with a different account — calls the new public
    GET /auth/switch-account, which ends the IdP session and returns to
    DevLake. The id_token for the hint is passed in a short-lived (10 min),
    encrypted, HttpOnly cookie set during the rejected callback, since no
    DevLake session exists for that user.
• Other codes show Back to sign in.

Does this close any open issues?

N/A (follow-up to #8854)

Screenshots

Rejected user (forbidden, with OIDC_ACCESS_REQUEST_URL set):

Expired or tampered state (expired):

Other Information

Upgrade note: deployments that already run with OIDC_LOGOUT_REDIRECT=true
now send post_logout_redirect_uri by default. It must be registered at the
IdP (Keycloak: Valid post logout redirect URIs; Entra ID: add it as a
redirect URI of the app registration). Otherwise the IdP rejects the logout request.

Known limits

• After a successful login the discovery document is cached. If the IdP
  becomes unreachable later, /auth/login still redirects to it and the
  browser shows its own error; DevLake cannot catch that.
• The hint cookie for "Sign in with a different account" can exceed 4 KB for
  very large id_tokens (many group claims). The browser then drops it and the
  logout falls back to no id_token_hint, so the IdP shows its confirmation
  prompt.
• Redirect targets are root-relative (/auth-error, /), like the existing
  post-login redirect.

Testing

• Unit tests: go test ./server/api/... ./helpers/oidchelper/ ./core/models/migrationscripts/...
  (backend) and npx vitest run (config-ui, new auth-error.test.tsx) — passed.
  golangci-lint run on the changed packages and make migration-script-lint
  — passed.
• Manual test against Keycloak 26.8.1 (realm import, users with allowed and
  rejected domains), PostgreSQL 18.6, backend + Vite dev proxy: login,
  logout without prompt and return to DevLake, IdP session ended, forbidden
  page with both buttons, switch account, expired/idp_error/server_error
  pages, OIDC_LOGOUT_REDIRECT=false (no id_token stored) — all as expected.
• Fork CI on the same change (golangci-lint, unit-test, e2e on MySQL and
  PostgreSQL, config-ui, license header, Grafana check):
  https://github.com/DoDiODev/devlake/actions/runs/42589488952 (16/16 jobs green)

[klesh]

LGTM
Thanks for your contribution.