From 29b5987aac5faaa5ac3fff652e59c8717b1ffa7e Mon Sep 17 00:00:00 2001
From: Lars Gebhardt-Kusche <lars@kusche.berlin>
Date: Mon, 15 Jun 2026 23:45:59 +0200
Subject: [PATCH] adadsa

---
 public/auth/callback/index.php |  5 +++--
 public/auth/inactive/index.php |  2 +-
 public/auth/logout/index.php   |  9 +++++++--
 public/auth/pending/index.php  |  2 +-
 src/App/KeycloakAuth.php       | 18 +++++++++++++-----
 5 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/public/auth/callback/index.php b/public/auth/callback/index.php
index 8912081e..88ac18e2 100644
--- a/public/auth/callback/index.php
+++ b/public/auth/callback/index.php
@@ -56,11 +56,12 @@ if ($state === '' || $expectedState === '' || !hash_equals($expectedState, $stat
                 $accountCheck = $accountGate->checkUsername($username);
 
                 if (!($accountCheck['allowed'] ?? false)) {
-                    $auth->logout();
                     $target = (string) ($accountCheck['state'] ?? '') === 'pending'
                         ? '/auth/pending/?username=' . urlencode($username)
                         : '/auth/inactive/?message=' . urlencode((string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.'));
-                    header('Location: ' . $target, true, 302);
+                    $logoutUrl = $auth->logoutUrl($target, (string) ($tokenPayload['id_token'] ?? ''));
+                    $auth->logout();
+                    header('Location: ' . $logoutUrl, true, 302);
                     exit;
                 } else {
                     $auth->establishSession($tokenPayload, $userPayload);
diff --git a/public/auth/inactive/index.php b/public/auth/inactive/index.php
index 4c3c7a06..d225cb98 100644
--- a/public/auth/inactive/index.php
+++ b/public/auth/inactive/index.php
@@ -27,7 +27,7 @@ if ($message === '') {
             </div>
 
             <div class="login-actions">
-                <a class="login-button login-button-primary" href="/auth/logout">Zum Login</a>
+                <a class="login-button login-button-primary" href="/auth/logout?target=/auth/keycloak">Zum Login</a>
             </div>
         </section>
     </main>
diff --git a/public/auth/logout/index.php b/public/auth/logout/index.php
index fa8aef1d..992fb3a0 100644
--- a/public/auth/logout/index.php
+++ b/public/auth/logout/index.php
@@ -12,9 +12,14 @@ session_start();
 $projectRoot = dirname(__DIR__, 3);
 $auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak'));
 $logoutUrl = null;
+$target = trim((string) ($_GET['target'] ?? '/auth/keycloak'));
+
+if ($target === '' || !str_starts_with($target, '/')) {
+    $target = '/auth/keycloak';
+}
 
 if ($auth->isConfigured()) {
-    $logoutUrl = $auth->logoutUrl();
+    $logoutUrl = $auth->logoutUrl($target);
 }
 
 $auth->logout();
@@ -24,5 +29,5 @@ if ($logoutUrl !== null) {
     exit;
 }
 
-header('Location: /auth/keycloak', true, 302);
+header('Location: ' . $target, true, 302);
 exit;
diff --git a/public/auth/pending/index.php b/public/auth/pending/index.php
index 3dc88a27..65d26b72 100644
--- a/public/auth/pending/index.php
+++ b/public/auth/pending/index.php
@@ -64,7 +64,7 @@ $view = $statusMap[$status] ?? [
             </div>
 
             <div class="login-actions">
-                <a class="login-button login-button-primary" href="/auth/logout">Zum Login</a>
+                <a class="login-button login-button-primary" href="/auth/logout?target=/auth/keycloak">Zum Login</a>
             </div>
         </section>
     </main>
diff --git a/src/App/KeycloakAuth.php b/src/App/KeycloakAuth.php
index ff0a0cff..eae94d3d 100644
--- a/src/App/KeycloakAuth.php
+++ b/src/App/KeycloakAuth.php
@@ -186,14 +186,16 @@ final class KeycloakAuth
         ];
     }
 
-    public function logoutUrl(): string
+    public function logoutUrl(?string $redirectPath = null, ?string $idTokenHint = null): string
     {
         $params = [
             'client_id' => $this->clientId(),
-            'post_logout_redirect_uri' => $this->postLogoutRedirectUri(),
+            'post_logout_redirect_uri' => $this->postLogoutRedirectUri($redirectPath),
         ];
 
-        $idToken = (string) ($_SESSION['desktop_auth']['id_token'] ?? '');
+        $idToken = $idTokenHint !== null && $idTokenHint !== ''
+            ? $idTokenHint
+            : (string) ($_SESSION['desktop_auth']['id_token'] ?? '');
 
         if ($idToken !== '') {
             $params['id_token_hint'] = $idToken;
@@ -263,9 +265,15 @@ final class KeycloakAuth
             . '/protocol/openid-connect/userinfo';
     }
 
-    private function postLogoutRedirectUri(): string
+    private function postLogoutRedirectUri(?string $redirectPath = null): string
     {
-        return $this->requestOrigin() . '/';
+        $path = trim((string) $redirectPath);
+
+        if ($path === '' || !str_starts_with($path, '/')) {
+            $path = '/';
+        }
+
+        return $this->requestOrigin() . $path;
     }
 
     private function requestOrigin(): string