adasdsa

public/auth/callback/index.php

@@ -6,6 +6,7 @@ require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
 
 use App\ConfigLoader;
 use App\AccountGate;
+use App\AuthStatusRedirect;
 use App\KeycloakAuth;
 
 session_start();
@@ -59,7 +60,8 @@ if ($state === '' || $expectedState === '' || !hash_equals($expectedState, $stat
                     $target = (string) ($accountCheck['state'] ?? '') === 'pending'
                         ? '/auth/pending/?username=' . urlencode($username)
                         : '/auth/inactive/?message=' . urlencode((string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.'));
-                    $logoutUrl = $auth->logoutUrl($target, (string) ($tokenPayload['id_token'] ?? ''));
+                    AuthStatusRedirect::set($target);
+                    $logoutUrl = $auth->logoutUrl('/', (string) ($tokenPayload['id_token'] ?? ''));
                     $auth->logout();
                     header('Location: ' . $logoutUrl, true, 302);
                     exit;

public/auth/inactive/index.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
 
 $message = trim((string) ($_GET['message'] ?? ''));
+\App\AuthStatusRedirect::clear();
 
 if ($message === '') {
     $message = 'Dieses Konto ist noch nicht freigeschaltet.';
@@ -27,7 +28,7 @@ if ($message === '') {
             </div>
 
             <div class="login-actions">
-                <a class="login-button login-button-primary" href="/auth/logout?target=/auth/keycloak">Zum Login</a>
+                <a class="login-button login-button-primary" href="/auth/logout">Zum Login</a>
             </div>
         </section>
     </main>

public/auth/pending/index.php

@@ -8,6 +8,7 @@ use App\ConfigLoader;
 use App\RegistrationService;
 
 $projectRoot = dirname(__DIR__, 3);
+\App\AuthStatusRedirect::clear();
 $registration = new RegistrationService($projectRoot, ConfigLoader::load($projectRoot, 'registration'));
 $username = strtolower(trim((string) ($_GET['username'] ?? '')));
 $request = $registration->findLatestByUsername($username);
@@ -64,7 +65,7 @@ $view = $statusMap[$status] ?? [
             </div>
 
             <div class="login-actions">
-                <a class="login-button login-button-primary" href="/auth/logout?target=/auth/keycloak">Zum Login</a>
+                <a class="login-button login-button-primary" href="/auth/logout">Zum Login</a>
             </div>
         </section>
     </main>

public/index.php

@@ -6,6 +6,7 @@ require_once dirname(__DIR__) . '/src/App/bootstrap.php';
 
 use App\App;
 use App\AccountGate;
+use App\AuthStatusRedirect;
 use App\ConfigLoader;
 use App\KeycloakAuth;
 
@@ -17,6 +18,15 @@ $registrationConfig = ConfigLoader::load($projectRoot, 'registration');
 $auth = new KeycloakAuth($keycloakConfig);
 $accountGate = new AccountGate($registrationConfig);
 
+if (!$auth->isAuthenticated()) {
+    $statusRedirect = AuthStatusRedirect::consume();
+
+    if ($statusRedirect !== null) {
+        header('Location: ' . $statusRedirect, true, 302);
+        exit;
+    }
+}
+
 if ($auth->isAuthenticated()) {
     $currentUser = is_array($_SESSION['desktop_auth']['user'] ?? null) ? $_SESSION['desktop_auth']['user'] : [];
     $accountCheck = $accountGate->checkUsername((string) ($currentUser['username'] ?? ''));

src/App/AuthStatusRedirect.php

@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+final class AuthStatusRedirect
+{
+    private const COOKIE_NAME = 'desktop_auth_status_redirect';
+
+    public static function set(string $target): void
+    {
+        if ($target === '' || !str_starts_with($target, '/')) {
+            return;
+        }
+
+        setcookie(self::COOKIE_NAME, $target, [
+            'expires' => time() + 180,
+            'path' => '/',
+            'httponly' => true,
+            'samesite' => 'Lax',
+        ]);
+    }
+
+    public static function consume(): ?string
+    {
+        $target = trim((string) ($_COOKIE[self::COOKIE_NAME] ?? ''));
+
+        self::clear();
+
+        if ($target === '' || !str_starts_with($target, '/')) {
+            return null;
+        }
+
+        return $target;
+    }
+
+    public static function clear(): void
+    {
+        setcookie(self::COOKIE_NAME, '', [
+            'expires' => time() - 3600,
+            'path' => '/',
+            'httponly' => true,
+            'samesite' => 'Lax',
+        ]);
+        unset($_COOKIE[self::COOKIE_NAME]);
+    }
+}