fix: point d'entrée navigable de la déconnexion globale GET /sso/logout (BUG-122, fusion #141) — 2.86.0

backend/auth/router.py

@@ -375,12 +375,15 @@ async def refresh_token_endpoint(request: Request, response: Response):
     }
 
 
-@router.post("/logout")
-async def logout(
-    request: Request,
-    response: Response,
-):
-    """Logout: revoke refresh and access tokens, then delete cookies."""
+def apply_global_logout(request: Request, response: Response) -> None:
+    """Déconnexion globale (Fusion ACC-3.1, #216) appliquée à ``response``.
+
+    Révoque les jetons natifs (refresh + access, BUG-027), révoque le
+    ``jti`` du cookie partagé ``draco_session`` et efface les cookies.
+    Partagée entre ``POST /api/auth/logout`` (réponse JSON) et
+    ``GET /sso/logout`` (redirection, BUG-122) : les deux entrées
+    terminent exactement la même session, celle de la suite entière.
+    """
     refresh_tok = request.cookies.get("refresh_token")
     if refresh_tok:
         payload = decode_token(refresh_tok)
@@ -421,6 +424,15 @@ async def logout(
     response.delete_cookie("refresh_token", path="/api/auth/refresh")
     response.delete_cookie("access_token", path="/")
     response.delete_cookie("access_token", path="/api")  # just in case
+
+
+@router.post("/logout")
+async def logout(
+    request: Request,
+    response: Response,
+):
+    """Logout: revoke refresh and access tokens, then delete cookies."""
+    apply_global_logout(request, response)
     return {"message": "Deconnecte avec succes"}