diff --git a/src/app/handlers/logout.js b/src/app/handlers/logout.js index 13279d4..043629d 100644 --- a/src/app/handlers/logout.js +++ b/src/app/handlers/logout.js @@ -1,5 +1,4 @@ import { validateRedirectUrl } from "../utils/redirect.js"; -import { forwardCookies } from "../utils/cookies.js"; import { getAuthFromContext } from "../utils/auth.js"; /** @@ -13,14 +12,20 @@ export const logout = async (c) => { c.req.query("redirect_url"), "/?message=Bye!", ); - const status = await auth.api.signOut({ + const signOut = await auth.api.signOut({ headers: c.req.raw.headers, - returnHeaders: true, + asResponse: true, }); - // forward headers (cookies) - if (status.headers) { - forwardCookies(status.headers, c); + // asResponse makes better-auth return APIErrors instead of throwing them. + if (!signOut.ok) { + console.error(`Logout failed with status ${signOut.status}`); + return signOut; } - return c.redirect(callbackURL); + const response = c.redirect(callbackURL); + for (const cookie of signOut.headers.getSetCookie()) { + response.headers.append("Set-Cookie", cookie); + } + + return response; }; diff --git a/src/app/utils/cookies.js b/src/app/utils/cookies.js deleted file mode 100644 index 2f19b1c..0000000 --- a/src/app/utils/cookies.js +++ /dev/null @@ -1,7 +0,0 @@ -// Helper function to forward Set-Cookie headers from better-auth response -export const forwardCookies = (headers, c) => { - const setCookieHeaders = headers.getSetCookie?.() || []; - setCookieHeaders.forEach((cookie) => { - c.header("Set-Cookie", cookie, { append: true }); - }); -}; diff --git a/test/integration/cookie-attributes.test.js b/test/integration/cookie-attributes.test.js index b22d664..514a64e 100644 --- a/test/integration/cookie-attributes.test.js +++ b/test/integration/cookie-attributes.test.js @@ -156,3 +156,21 @@ test("logout clearing cookies keep their attributes", async (t) => { ); } }); + +test("logout surfaces a failed signOut instead of redirecting", async (t) => { + const auth = { + api: { + getSession: async () => null, + signOut: async () => + new Response(JSON.stringify({ message: "signOut failed" }), { + status: 500, + }), + }, + }; + const app = createApp(auth, null); + + const res = await app.request("/logout"); + + t.equal(res.status, 500, "propagates the signOut status"); + t.equal(res.headers.get("location"), null, "does not redirect"); +});