adadsa

src/App/KeycloakAuth.php

@@ -186,14 +186,16 @@ final class KeycloakAuth
         ];
     }
 
-    public function logoutUrl(): string
+    public function logoutUrl(?string $redirectPath = null, ?string $idTokenHint = null): string
     {
         $params = [
             'client_id' => $this->clientId(),
-            'post_logout_redirect_uri' => $this->postLogoutRedirectUri(),
+            'post_logout_redirect_uri' => $this->postLogoutRedirectUri($redirectPath),
         ];
 
-        $idToken = (string) ($_SESSION['desktop_auth']['id_token'] ?? '');
+        $idToken = $idTokenHint !== null && $idTokenHint !== ''
+            ? $idTokenHint
+            : (string) ($_SESSION['desktop_auth']['id_token'] ?? '');
 
         if ($idToken !== '') {
             $params['id_token_hint'] = $idToken;
@@ -263,9 +265,15 @@ final class KeycloakAuth
             . '/protocol/openid-connect/userinfo';
     }
 
-    private function postLogoutRedirectUri(): string
+    private function postLogoutRedirectUri(?string $redirectPath = null): string
     {
-        return $this->requestOrigin() . '/';
+        $path = trim((string) $redirectPath);
+
+        if ($path === '' || !str_starts_with($path, '/')) {
+            $path = '/';
+        }
+
+        return $this->requestOrigin() . $path;
     }
 
     private function requestOrigin(): string