Fix sign-out not ending the Keycloak SSO session

next-auth's signOut only cleared the local JWT cookie, leaving Keycloak's
SSO session intact. Signing back in would silently re-authenticate the
same user without prompting for credentials.

Store the ID token in the JWT and session on initial sign-in, then use it
as id_token_hint when redirecting to Keycloak's end-session endpoint so
the Keycloak session is properly terminated.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: dcl10

frontend/app/actions.ts

@@ -1,6 +1,8 @@
 "use server";
 
-import { signIn, signOut } from "@/auth";
+import { redirect } from "next/navigation";
+
+import { auth, signIn, signOut } from "@/auth";
 
 /**
  * Initiates the Keycloak OAuth flow via a server action.
@@ -21,7 +23,25 @@ export async function signUpWithKeycloak() {
   await signIn("keycloak", { redirectTo: "/dashboard" }, { prompt: "create" });
 }
 
-/** Signs the user out and redirects to the landing page. */
+/**
+ * Signs the user out locally and ends the Keycloak SSO session.
+ * next-auth's signOut only clears the local cookie; without also calling
+ * Keycloak's end-session endpoint the SSO session stays alive and the user
+ * is silently re-authenticated on the next sign-in attempt.
+ */
 export async function signOutFromKeycloak() {
-  await signOut({ redirectTo: "/" });
+  const session = await auth();
+  const idToken = session?.idToken;
+
+  await signOut({ redirect: false });
+
+  const params = new URLSearchParams({
+    post_logout_redirect_uri: `${process.env.AUTH_URL ?? "http://localhost:3000"}/`,
+    client_id: process.env.AUTH_KEYCLOAK_ID!,
+    ...(idToken ? { id_token_hint: idToken } : {}),
+  });
+
+  redirect(
+    `${process.env.AUTH_KEYCLOAK_ISSUER}/protocol/openid-connect/logout?${params}`,
+  );
 }

frontend/auth.ts

@@ -5,13 +5,15 @@ import Keycloak from "next-auth/providers/keycloak";
 declare module "next-auth" {
   interface Session {
     accessToken?: string;
+    idToken?: string;
     error?: "RefreshAccessTokenError";
   }
 }
 
 declare module "@auth/core/jwt" {
   interface JWT {
     accessToken?: string;
+    idToken?: string;
     refreshToken?: string;
     accessTokenExpires?: number;
     error?: "RefreshAccessTokenError";
@@ -57,6 +59,7 @@ export const { auth, handlers, signIn, signOut } = NextAuth({
         return {
           ...token,
           accessToken: account.access_token,
+          idToken: account.id_token,
           refreshToken: account.refresh_token,
           accessTokenExpires: account.expires_at
             ? account.expires_at * 1000
@@ -79,6 +82,7 @@ export const { auth, handlers, signIn, signOut } = NextAuth({
 
     async session({ session, token }) {
       session.accessToken = token.accessToken;
+      session.idToken = token.idToken;
       session.error = token.error;
       return session;
     },