adadsa

public/auth/callback/index.php

@@ -56,11 +56,12 @@ if ($state === '' || $expectedState === '' || !hash_equals($expectedState, $stat
                 $accountCheck = $accountGate->checkUsername($username);
 
                 if (!($accountCheck['allowed'] ?? false)) {
-                    $auth->logout();
                     $target = (string) ($accountCheck['state'] ?? '') === 'pending'
                         ? '/auth/pending/?username=' . urlencode($username)
                         : '/auth/inactive/?message=' . urlencode((string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.'));
-                    header('Location: ' . $target, true, 302);
+                    $logoutUrl = $auth->logoutUrl($target, (string) ($tokenPayload['id_token'] ?? ''));
+                    $auth->logout();
+                    header('Location: ' . $logoutUrl, true, 302);
                     exit;
                 } else {
                     $auth->establishSession($tokenPayload, $userPayload);

public/auth/inactive/index.php

@@ -27,7 +27,7 @@ if ($message === '') {
             </div>
 
             <div class="login-actions">
-                <a class="login-button login-button-primary" href="/auth/logout">Zum Login</a>
+                <a class="login-button login-button-primary" href="/auth/logout?target=/auth/keycloak">Zum Login</a>
             </div>
         </section>
     </main>

public/auth/logout/index.php

@@ -12,9 +12,14 @@ session_start();
 $projectRoot = dirname(__DIR__, 3);
 $auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak'));
 $logoutUrl = null;
+$target = trim((string) ($_GET['target'] ?? '/auth/keycloak'));
+
+if ($target === '' || !str_starts_with($target, '/')) {
+    $target = '/auth/keycloak';
+}
 
 if ($auth->isConfigured()) {
-    $logoutUrl = $auth->logoutUrl();
+    $logoutUrl = $auth->logoutUrl($target);
 }
 
 $auth->logout();
@@ -24,5 +29,5 @@ if ($logoutUrl !== null) {
     exit;
 }
 
-header('Location: /auth/keycloak', true, 302);
+header('Location: ' . $target, true, 302);
 exit;

public/auth/pending/index.php

@@ -64,7 +64,7 @@ $view = $statusMap[$status] ?? [
             </div>
 
             <div class="login-actions">
-                <a class="login-button login-button-primary" href="/auth/logout">Zum Login</a>
+                <a class="login-button login-button-primary" href="/auth/logout?target=/auth/keycloak">Zum Login</a>
             </div>
         </section>
     </main>