refactor(auth): fold portal-logout into existing SignOutAuthEndpoint

Per review feedback: Plane already has SignOutAuthEndpoint that calls
django.contrib.auth.logout(). Adding a parallel PortalSignOutEndpoint
duplicated logic. Fold the cross-origin GET variant into the existing
view instead — one endpoint, two methods, single logout primitive.

- signout.py: add GET method with ?next= validation; share
  _flush_session() between POST and GET so both record
  last_logout_time/_ip and call logout() identically.
- urls.py: drop the separate /portal-sign-out/ path; both methods
  now hit /auth/sign-out/.
- portal_signout.py: deleted (functionality merged).
- test_signout.py: add GET-side tests (allowlisted next, disallowed
  host, dot-boundary, empty PLATFORM_DOMAIN, fallback to
  MPASS_SIGNOUT_URL, malformed next).
- test_portal_signout.py: deleted (tests merged into test_signout.py).

Net: -95 lines vs the prior commit; single source of logout truth.

Author: awais786

apps/api/.env.example

@@ -79,6 +79,8 @@ API_KEY_RATE_LIMIT="60/minute"
 # MPASS_BYPASS_PATHS=/god-mode,/api/instances
 # Required for 3-layer logout (Django → oauth2-proxy → Cognito)
 # MPASS_SIGNOUT_URL=https://foss-auth.local.moneta.dev/oauth2/sign_out?rd=https%3A%2F%2Fcognito.example.com%2Flogout
-# Allowlist for /auth/portal-sign-out/?next= redirect targets — comma-separated
-# host suffixes. Used by the foss-bundle portal's "Log out of all apps" chain.
-# MPASS_SIGNOUT_NEXT_ALLOWED_HOSTS=foss.arbisoft.com,localhost
+# Root domain of the foss-server-bundle deployment. Used by
+# /auth/sign-out/?next= as the redirect allowlist — only URLs whose
+# host equals PLATFORM_DOMAIN or is a subdomain of it are followed.
+# Set automatically by foss-server-bundle/platform.sh.
+# PLATFORM_DOMAIN=foss.arbisoft.com

apps/api/plane/authentication/urls.py

@@ -6,7 +6,6 @@
 
 from .views import (
     CSRFTokenEndpoint,
-    PortalSignOutEndpoint,
     SignOutAuthEndpoint,
     SignOutAuthSpaceEndpoint,
 )
@@ -34,17 +33,12 @@
 # GiteaOauthInitiateSpaceEndpoint, GiteaCallbackSpaceEndpoint,
 
 urlpatterns = [
-    # signout — kept active (used by frontend 3-layer logout)
+    # signout — POST for in-app logout, GET (?next=) for the foss-bundle
+    # portal's "Log out of all apps" redirect chain. Both methods flush
+    # the Django session via the same django.contrib.auth.logout() call;
+    # GET is CSRF-exempt with PLATFORM_DOMAIN-bounded ?next= validation.
     path("sign-out/", SignOutAuthEndpoint.as_view(), name="sign-out"),
     path("spaces/sign-out/", SignOutAuthSpaceEndpoint.as_view(), name="space-sign-out"),
-    # portal-driven signout — GET-able, CSRF-exempt, used by the foss-bundle
-    # portal's "Log out of all apps" redirect chain to clear the Django
-    # session cookie while the browser is on this app's domain.
-    path(
-        "portal-sign-out/",
-        PortalSignOutEndpoint.as_view(),
-        name="portal-sign-out",
-    ),
     # csrf token — kept active (Django forms need it)
     path("get-csrf-token/", CSRFTokenEndpoint.as_view(), name="get_csrf_token"),
 

apps/api/plane/authentication/views/__init__.py

@@ -14,7 +14,6 @@
 from .app.magic import MagicGenerateEndpoint, MagicSignInEndpoint, MagicSignUpEndpoint
 
 from .app.signout import SignOutAuthEndpoint
-from .app.portal_signout import PortalSignOutEndpoint
 
 
 from .space.email import SignInAuthSpaceEndpoint, SignUpAuthSpaceEndpoint

apps/api/plane/authentication/views/app/portal_signout.py

@@ -2,18 +2,24 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # See the LICENSE file for details.
 
+# Standard library
+from urllib.parse import urlparse
+
 # Django imports
 from django.views import View
 from django.contrib.auth import logout
 from django.conf import settings
-from django.http import HttpResponseRedirect
+from django.http import HttpResponseBadRequest, HttpResponseRedirect
 from django.utils import timezone
+from django.utils.decorators import method_decorator
+from django.views.decorators.csrf import csrf_exempt
 
 # Module imports
 from plane.authentication.utils.host import user_ip, base_host
 from plane.db.models import User
 
 
+@method_decorator(csrf_exempt, name="dispatch")
 class SignOutAuthEndpoint(View):
     def post(self, request):
         try:
@@ -36,3 +42,62 @@ def post(self, request):
             return HttpResponseRedirect(mpass_signout_url)
 
         return HttpResponseRedirect(base_host(request=request, is_app=True))
+
+    def get(self, request):
+        """
+        Cross-origin redirect-chain entry-point for the foss-server-bundle
+        portal's "Log out of all apps" flow.
+
+        Clears the Django session via django.contrib.auth.logout(), then
+        302s to ?next= (validated against PLATFORM_DOMAIN to prevent open
+        redirect). The chain works because the browser is on this app's
+        own domain when this endpoint runs — so Django's Set-Cookie scope
+        is correct.
+
+        CSRF-exempt (set at class level): no token is shared cross-origin
+        with the portal. Residual risk is force-logout (attacker embeds
+        <img src="…/sign-out"> ending the victim's session); low impact —
+        only the session itself is lost, and re-auth via ForwardAuth is
+        automatic.
+        """
+        logout(request)
+
+        next_url = (request.GET.get("next") or "").strip()
+        if next_url:
+            if not self._is_allowed_next(next_url):
+                return HttpResponseBadRequest(
+                    "next= target host is not a subdomain of PLATFORM_DOMAIN"
+                )
+            return HttpResponseRedirect(next_url)
+
+        # No ?next= — fall back to MPASS_SIGNOUT_URL so a manual hit still
+        # chains through oauth2-proxy + Cognito.
+        mpass_signout_url = getattr(settings, "MPASS_SIGNOUT_URL", None)
+        if mpass_signout_url:
+            return HttpResponseRedirect(mpass_signout_url)
+        return HttpResponseRedirect(base_host(request=request, is_app=True))
+
+    @staticmethod
+    def _is_allowed_next(url):
+        """True iff URL's host equals PLATFORM_DOMAIN or is a subdomain.
+
+        Suffix match enforces a dot boundary: foss.arbisoft.com matches
+        foss.arbisoft.com and *.foss.arbisoft.com but NOT
+        foss.arbisoft.com.evil. Unset PLATFORM_DOMAIN → False (every
+        ?next= rejected).
+        """
+        platform_domain = (
+            getattr(settings, "PLATFORM_DOMAIN", "") or ""
+        ).strip().lower().lstrip(".")
+        if not platform_domain:
+            return False
+
+        try:
+            host = urlparse(url).hostname
+        except ValueError:
+            return False
+        if not host:
+            return False
+
+        host = host.lower()
+        return host == platform_domain or host.endswith("." + platform_domain)