session api

[akshaydeo]

Summary

The logout flow now calls both the password-based session logout endpoint and the OAuth logout endpoint, ensuring users are fully signed out regardless of which authentication method they used. Previously, only the password session was terminated on logout.

Changes

• Replaced the single /session/logout POST call with a queryFn that sequentially calls both /session/logout and /scim/oauth/logout, returning an error only if both fail
• Added dispatch(baseApi.util.resetApiState()) in the onQueryStarted finalizer to clear all cached RTK Query state after logout, preventing stale data from persisting across sessions

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

1. Log in using OAuth (SCIM/OAuth provider)
2. Click logout
3. Verify the user is redirected to the login page and the OAuth session is also invalidated (no silent re-authentication)
4. Repeat with a password-based login and confirm logout still works as expected

cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build

Screenshots/Recordings

N/A

Breaking changes

• Yes
• No

Related issues

N/A

Security considerations

Ensures OAuth sessions are explicitly terminated on logout, reducing the risk of session persistence after a user signs out. The API state reset also prevents cached sensitive data (keys, budgets, teams, etc.) from being accessible after logout.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Warning

Rate limit exceeded

@akshaydeo has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 14 minutes before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 312731bb-f042-4a73-aebb-a59199f07b42

📥 Commits

Reviewing files that changed from the base of the PR and between 7d9e881 and cf63e9d.

📒 Files selected for processing (1)

• ui/lib/store/apis/sessionApi.ts

📝 Walkthrough

Walkthrough

The PR updates the session logout mutation to coordinate logout across two endpoints (/session/logout and /scim/oauth/logout) and clears the RTK Query cache state afterward.

Changes

Session Logout Flow

Layer / File(s)	Summary
Logout Mutation with Dual Endpoints and Cache Clearing ui/lib/store/apis/sessionApi.ts	Logout mutation uses custom queryFn to perform two sequential POST requests to session and OAuth logout endpoints with combined error handling, and extends onQueryStarted to dispatch baseApi.util.resetApiState() for clearing RTK Query cached state after the request lifecycle completes.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested reviewers

• danpiths

Poem

🐰 A logout flows both ways,
Two endpoints cleared in graceful days,
Cache wiped clean, state reset,
Sessions gone—no data left!
Bifrost logout, done just right! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (1 warning, 2 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The code changes in the PR address OAuth logout and API state management for sessions, but the linked issue #123 is about Files API support for providers, which is entirely unrelated to logout functionality.	Either link the relevant issues related to session logout improvements, or remove issue #123 if it was linked in error. Ensure the PR's linked issues match its actual objectives.
Title check	❓ Inconclusive	The title "session api" is vague and generic, using non-descriptive terms that don't convey meaningful information about the specific changes made.	Revise the title to be more specific and descriptive, such as 'Add OAuth logout and reset API state on session logout' or 'Improve logout flow with OAuth termination and state cleanup'.
Out of Scope Changes check	❓ Inconclusive	The PR modifies only the session logout mutation and API state reset, which are in-scope changes. However, the linked issue #123 concerns Files API support, making the PR's scope unclear relative to its linked issues.	Clarify the PR's scope by linking to issues that actually relate to session logout improvements, or document why issue #123 is referenced if it is indeed related to this change.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description check	✅ Passed	The PR description is mostly complete, covering summary, changes, type, affected areas, testing steps, security considerations, and breaking changes, though some checklist items are unchecked.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-22-session_api

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[akshaydeo]

• session api #3698 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[akshaydeo]

Merge activity

• May 22, 3:02 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 22, 3:03 PM UTC: @akshaydeo merged this pull request with Graphite.

[greptile-apps]

Confidence Score: 4/5

Safe to merge; logout cleanup is correct and the OAuth session is now explicitly terminated on sign-out

The core logic — clearing auth storage and resetting RTK Query state on logout — is sound. Both issues are about efficiency and redundancy: sequential vs. parallel API calls, and invalidatesTags coexisting with resetApiState(). Neither prevents correct logout behavior.

ui/lib/store/apis/sessionApi.ts — specifically the invalidatesTags list and the sequential logout calls

Important Files Changed

Filename	Overview
ui/lib/store/apis/sessionApi.ts	Logout mutation expanded to cover both password and OAuth sessions; two minor issues: sequential instead of parallel calls, and redundant invalidatesTags alongside resetApiState()

_{Reviews (1): Last reviewed commit: "session api" | Re-trigger Greptile}

[greptile-apps]

The two logout requests are issued sequentially — /scim/oauth/logout only starts after /session/logout completes. If the password-logout endpoint is slow or temporarily unresponsive, the OAuth session stays active longer than needed, and the user's perceived logout time doubles. Running them in parallel is safe here because neither result depends on the other.

Suggested change

	async queryFn(_arg, _api, _extraOptions, baseQuery) {
	const passwordLogout = await baseQuery({
	url: "/session/logout",
	method: "POST",
	});
	const oauthLogout = await baseQuery({
	url: "/scim/oauth/logout",
	method: "POST",
	});
	if (passwordLogout.error && oauthLogout.error) {
	return { error: oauthLogout.error };
	}
	return { data: { message: "Logout successful" } };
	},
	async queryFn(_arg, _api, _extraOptions, baseQuery) {
	const [passwordLogout, oauthLogout] = await Promise.all([
	baseQuery({ url: "/session/logout", method: "POST" }),
	baseQuery({ url: "/scim/oauth/logout", method: "POST" }),
	]);
	if (passwordLogout.error && oauthLogout.error) {
	return { error: oauthLogout.error };
	}
	return { data: { message: "Logout successful" } };
	},

[greptile-apps]

invalidatesTags is redundant here. dispatch(baseApi.util.resetApiState()) already wipes the entire RTK Query cache — a strict superset of what tag invalidation does. Having both means RTK Query will first try to trigger refetches for every subscribed query matching these tags (potentially sending unauthenticated requests since clearAuthStorage() runs in the same finally block), and then resetApiState() immediately cancels and clears them. Removing invalidatesTags eliminates that brief window of spurious requests.

Suggested change

	invalidatesTags: ["Sessions", "Config", "Providers", "Logs", "VirtualKeys", "Teams", "Customers", "Budgets", "RateLimits"],
	// invalidatesTags removed: resetApiState() in onQueryStarted already clears the full cache