fix(logout): match legacy redirect target and 302 status

The legacy Ruby logout redirects via redirect_continue(continue || "/"),
issuing a 302 to the continue target when safe, to "/" when no continue
is given, and to the authority logout_url only as the cross-domain
fallback. auth.cr issued a 303 and defaulted to the authority logout_url
even with no continue. Align the target selection and use 302 so logout
behaves as a drop-in for existing clients.

Author: chillfox

spec/controllers/sessions_spec.cr

@@ -109,7 +109,10 @@ module PlaceOS::Auth
     end
 
     describe "GET /auth/logout" do
-      it "clears the session, stamps logged_out_at, and redirects" do
+      # The legacy Ruby service redirects logout via `redirect_continue`,
+      # which issues a 302 (Rails default) to `continue || "/"`, using the
+      # authority's logout_url only as the cross-domain fallback.
+      it "clears the session, stamps logged_out_at, and 302-redirects to /" do
         password = "ok-password-1234"
         user = create_user.call(password)
         cookie = Spec.signin!(client, user, password)
@@ -119,7 +122,8 @@ module PlaceOS::Auth
           "Host"   => "localhost",
           "Cookie" => cookie,
         })
-        result.status_code.should eq 303
+        result.status_code.should eq 302
+        result.headers["Location"].should eq "/"
 
         reloaded = ::PlaceOS::Model::User.find!(user.id.as(String))
         reloaded.logged_out_at.should_not be_nil
@@ -128,9 +132,29 @@ module PlaceOS::Auth
         user.try &.destroy
       end
 
-      it "redirects safely even without a session" do
+      it "302-redirects to / even without a session" do
         result = client.get("/auth/logout", headers: HTTP::Headers{"Host" => "localhost"})
-        result.status_code.should eq 303
+        result.status_code.should eq 302
+        result.headers["Location"].should eq "/"
+      end
+
+      it "redirects to a safe same-site `continue` target" do
+        result = client.get("/auth/logout?continue=%2Fbye", headers: HTTP::Headers{"Host" => "localhost"})
+        result.status_code.should eq 302
+        result.headers["Location"].should eq "/bye"
+      end
+
+      it "falls back to the authority logout_url for a cross-domain `continue`" do
+        authority = ::PlaceOS::Model::Authority.find_by_domain("localhost").not_nil!
+        authority.logout_url = "/signed-out"
+        authority.save!
+
+        result = client.get(
+          "/auth/logout?continue=https%3A%2F%2Fevil.example%2Fx",
+          headers: HTTP::Headers{"Host" => "localhost"},
+        )
+        result.status_code.should eq 302
+        result.headers["Location"].should eq "/signed-out"
       end
     end
 

src/placeos-auth/controllers/sessions.cr

@@ -113,12 +113,18 @@ module PlaceOS::Auth
         end
       end
 
-      target = if continue && (safe = sanitize_continue(continue))
+      # Mirror the legacy `redirect_continue(continue || "/")`: default to
+      # "/", honour a safe same-site continue, and only fall back to the
+      # authority's logout_url when continue points at another domain.
+      # Rails' `redirect_to` defaults to 302, so match that status too.
+      target = if continue.nil?
+                 "/"
+               elsif (safe = sanitize_continue(continue))
                  safe
                else
                  authority_logout_target(authority)
                end
-      redirect_to target.gsub(' ', "%20"), :see_other
+      redirect_to target.gsub(' ', "%20"), :found
     end
 
     # ---------- GET /auth/login ------------------------------------------