fix(auth): sign-out ends the identity-provider session; sign-in sends max_age=0 #18

2026-11-09T20:42:47Z

james.maes commented

2026-11-09 20:42:47 +00:00

Finding: companion Sign out (and the CLI) called only POST /qqq/v1/logout and cleared local state; nothing ended the Authentik browser session, and sign-in sent prompt=login without max_age. Fix: provider RP-initiated logout via the server's nativeSessionLogout contract (same as qqq-android 1.0.4), validated against the advertised issuer and the provider's discovery, opened by the companion with state-matched return; max_age=0 added to every browser sign-in. CLI sign-out cannot open the companion's callback inbox, so it still ends only the QQQ session and prints a note.

Tests (tests/Qqq.PrintAgent.Cli.Tests/ProviderSignOutTests.cs, 15 cases): fail before (max_age case verified failing with the line removed; the sign-out cases did not compile before), pass after. Full Cli.Tests: 377 passed. NativeCI build with -warnaserror green. Core.Tests not run locally (Defender quarantine, per CLAUDE.md); hosted CI is the evidence for it. No tag, publish or signing performed.

Release step: build and Authenticode-sign a new MSI manually (Build-Installer.ps1 on the permitted host); server side needs Forge to advertise nativeSessionLogout (gg-forge PR) and Authentik to use default-invalidation-flow (greater-goods-authentik-cd PR 26).

Finding: companion Sign out (and the CLI) called only POST /qqq/v1/logout and cleared local state; nothing ended the Authentik browser session, and sign-in sent prompt=login without max_age. Fix: provider RP-initiated logout via the server's nativeSessionLogout contract (same as qqq-android 1.0.4), validated against the advertised issuer and the provider's discovery, opened by the companion with state-matched return; max_age=0 added to every browser sign-in. CLI sign-out cannot open the companion's callback inbox, so it still ends only the QQQ session and prints a note. Tests (tests/Qqq.PrintAgent.Cli.Tests/ProviderSignOutTests.cs, 15 cases): fail before (max_age case verified failing with the line removed; the sign-out cases did not compile before), pass after. Full Cli.Tests: 377 passed. NativeCI build with -warnaserror green. Core.Tests not run locally (Defender quarantine, per CLAUDE.md); hosted CI is the evidence for it. No tag, publish or signing performed. Release step: build and Authenticode-sign a new MSI manually (Build-Installer.ps1 on the permitted host); server side needs Forge to advertise nativeSessionLogout (gg-forge PR) and Authentik to use default-invalidation-flow (greater-goods-authentik-cd PR 26).

james.maes added 1 commit 2026-11-09 20:42:47 +00:00

fix(auth): sign-out ends the identity-provider session; sign-in sends max_age=0 5d4b7f43ce

Sign out only ended the QQQ session, so a retained provider session silently
signed the next person in. The companion now asks the service to log out with
the registered callback; the server's provider end-session data is checked
against the advertised issuer and the provider's own discovery, then opened in
the browser. Browser sign-in also sends max_age=0 beside prompt=login. The
command line still ends only the QQQ session and says so.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes merged commit a695996091 into main

2026-11-09 20:46:23 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-print-agent#18