feat: add logout endpoint for Dex

[CasLubbers]

Together with:

• feat: update Dex chart location and enable api sessions identities apl-core#3728
• feat: call logout endpoint for dex apl-console#852

[Copilot]

Copilot review overview

🟡 Changes recommended

Role-less Dex users cannot access logout, and the RPC can block indefinitely without a deadline.

Review effort: Balanced
Findings: 1 · 1 · 1

Open (3)

• Authenticated users without groups are denied logout · New
• Add a deadline to the Dex logout RPC · New
• Document that logout revokes all user sessions · New

What changed in this PR

Adds a Dex-aware logout endpoint that revokes user sessions while preserving client logout flow.

Changes:

• Adds authenticated POST /v2/user/logout.
• Integrates Dex session termination as best-effort behavior.
• Adds client, stack, and authorization tests.

File	Description
src/​otomi-stack.ts	Coordinates best-effort Dex logout.
src/​otomi-stack.test.ts	Tests provider-specific logout behavior.
src/​openapi/​user.yaml	Defines logout authorization schema.
src/​openapi/​api.yaml	Documents and registers the endpoint.
src/​clients/​dexClient.ts	Wraps the Dex termination RPC.
src/​clients/​dexClient.test.ts	Tests the RPC wrapper.
src/​api/​v2/​user/​logout.ts	Implements the HTTP handler.
src/​api-v2.authz.test.ts	Tests endpoint authorization.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Role-less Dex users cannot log out, the RPC can block indefinitely, and the API contract obscures all-session revocation.

Review effort: Balanced
Findings: 1 · 1 · 1

Open (3)

• Authenticated users without groups are denied logout
• Add a deadline to the Dex logout RPC
• Document that logout revokes all user sessions

Previously missed (1)

In code that hasn't changed since last review

No-group Dex users are denied access to logout

src/​openapi/​user.yaml:127

Authenticated Dex users with no platform/team assignment cannot call this endpoint. Such users receive __no_groups__, which getUser deliberately maps to roles: [] (src/middleware/jwt.ts:27-40), while authorization only creates rules from user.roles (src/authz.ts:163-167). Therefore this ACL returns 403 and never revokes their Dex session. Add an authenticated-user authorization path/role for logout and cover the no-groups token case.

[Copilot]

Copilot review overview

🟡 Changes recommended

Protobuf decoding can select the wrong field, and the API documentation understates the logout scope and best-effort behavior.

Review effort: Balanced
Findings: 2 · 1 · 3

Open (6)

• Decode protobuf user_id by field tag, not field order · New
• Authenticated users without groups are denied logout
• Add a deadline to the Dex logout RPC
• Document broad, best-effort logout session revocation · New
• Align permission description with all-session revocation behavior · New
• Document that logout revokes all user sessions