[knittingcode]

Summary

When signing out fails, the SPA now keeps the user signed in, stays on the current page and shows an alert (role="alert"): "Signing out did not complete. You may still be signed in, so try again." Before, every failed sign-out still switched to signed out and went to the login page without a message.

Motivation

ADR-019: logout ends the session on the server. If the logout request does not succeed, the session and its HttpOnly cookie can still be valid. On main, AuthProvider.logout reset the state to anonymous in a finally, and AppShell.signOut navigated to /login in a finally. The user was told nothing; a reload, or the next person at the same browser, was signed in again through GET /api/v1/auth/session.

Cases that reach this on main:

• No answer: connection lost, timeout.
• An edge 502/504.
• A 500 with the database unavailable. Observed on a disposable production-like stack: POST /api/v1/auth/logout → 500 internal-error with the database stopped.
• A CSRF token refused again after the client re-read the session.

The UI must not claim an outcome it does not have. Found in the read-only frontend audit (AUTO3-028, FE-1).

Implementation

• frontend/src/auth/AuthProvider.tsx:
  • logout changes the state to anonymous only after a successful answer, or after a 401.
  • Any other failure is rethrown and the state stays signed in.
  • Why a 401 counts as signed out: it means the session had already ended. The backend answers a logout without a valid session with 204 ("logout without a session is a no-op", AuthenticationTest::testLogoutEndsTheSessionOnTheServer; openapi.yaml: "204 also without a session"), so a 401 is not expected from it. The client handles it anyway, as the end of the session.
• frontend/src/pages/AppShell.tsx: signOut navigates to /login only when logout resolved. Otherwise it re-enables the button and shows the alert. The previously unhandled rejection of void signOut() is gone.
• frontend/src/index.css: .shell-alert spacing; the alert reuses the existing form-error style.
• Wording: "may still be signed in", because after a lost answer the server may in fact have ended the session. Signing out again is safe either way: logout without a session is 204.

Testing performed

The dev web image ran with this worktree's sources (read-only mounts), via scratchpad/check-fe.sh with the worktree path.

• Red first, on main's code with the new tests: src/App.test.tsx gave 16 tests | 4 failed. The failures were when the connection fails, when the API answers 500, when the edge answers 502 and when the CSRF token is refused again after reading the session, plus Vitest caught 5 unhandled errors (the rejected signOut).
  • The 401 test passed on main as well: main treated every failure, including a 401, as signed out. That test guards the new code path.
• With the fix:
  • npx tsc --build: TSC-OK
  • npx eslint --max-warnings=0 .: ESLINT-OK
  • npx vitest run: Test Files 4 passed (4), Tests 41 passed (41), no unhandled errors
  • npx vite build: built
• Merged with feat(frontend): member administration page (FND-010C, stacked on #19) #20 (git merge-tree against origin/feat/fcrm-fnd-010c-membership-ui f5f31b8: clean, no conflicts). The merged frontend gives TSC-OK, ESLINT-OK, Test Files 6 passed (6), Tests 93 passed (93).
• Not run: Playwright. It needs a full stack under the shared heavy lock. The failure path is covered by the App tests with a faked API; the success path stays covered by e2e/auth.spec.ts ("logout ends the session").

Security considerations

• The user is no longer misled into believing a session has ended when it may not have. That matters on shared computers.
• No change to what is sent: the CSRF token, the single retry after csrf-invalid and same-origin credentials are unchanged.
• The CSRF token stays in memory while the session may still be valid. It is cleared only once the session has ended, as before for the success path.

Known limitations

• feat(frontend): member administration page (FND-010C, stacked on #19) #20 overlap: feat(frontend): member administration page (FND-010C, stacked on #19) #20 does not touch AppShell.tsx, AuthProvider.tsx or App.test.tsx. It appends to index.css at the end, while this change inserts after .shell-main, so the textual merge is clean (verified with git merge-tree).
• No auto-retry, no forced sign-out: after a failure the user must press "Sign out" again. Clearing the cookie client-side is impossible (HttpOnly) and would not end the server session.
• Wording is fixed: the alert does not distinguish the failure kinds (network, server, CSRF). The single text is accurate for all of them.