app/api/auth/logout/route.ts: always returns success regardless of upstream logout response

[dorisadams]

Problem

app/api/auth/logout/route.ts makes a logout request to the upstream auth server (http://localhost:3001/auth/logout) and never inspects the response. The route unconditionally returns { success: true } and clears the local refresh_token cookie regardless of whether the upstream auth server confirmed the logout.

As a result, a client of this endpoint will always believe the logout succeeded — even if the auth server returned 5xx or rejected the request.

Reproduction (conceptual)

1. Take the auth server offline (or make it return 500 for POST /auth/logout).
2. Call POST /api/auth/logout from a logged-in client with a valid refresh_token.
3. Expected: 502 Bad Gateway (or similar failure signal).
4. Actual: 200 OK with { success: true } and a cleared cookie. The client believes the logout succeeded; the session on the auth server may still be valid.

Suggested fix

Bind the upstream response and check ok before constructing the local response:

const upstreamRes = await fetch("http://localhost:3001/auth/logout", { ... })
if (!upstreamRes.ok) {
  return NextResponse.json({ success: false }, { status: 502 })
}

This propagates a 502 Bad Gateway when the upstream logout fails, preserving the local cookie-clearing behaviour only on success.

Discovered during

Code review on feat/ci-virtualization-network-policies (PR #470, commits ddf4512, b8883ad, 614517e). The lint cleanup removed the unused apiRes binding, which made the missing response inspection more obvious.

The bug is pre-existing — it predates PR #470 and was deliberately deferred from those lint-cleanup commits because it is a contract bug, not a lint issue.

Acceptance criteria

• app/api/auth/logout/route.ts returns a non-2xx response when the upstream auth server returns a non-2xx response.
• Tests cover both the success path (upstream 2xx → local 200) and the failure path (upstream 4xx/5xx → local 502).
• Local cookie is cleared only when the upstream logout succeeds (or: document the intentional fire-and-forget decision and drop the await).

[nelly439]

I’ll fix app/api/auth/logout/route.ts to check upstreamRes.ok before returning success, return 502 on upstream failure, only clear the refresh_token cookie on the success path, and add tests for both the 2xx and 4xx/5xx cases. Will open a PR against the bug (separate from #470) once done.

[Lspnjr1]

Hello maintainers,
I’m Lspnjr1
I would like to be assigned to this issue. After reviewing the requirements, I’m confident that I understand the scope of the task and the project’s contribution criteria. I believe I can deliver a clean, maintainable implementation that aligns with the project’s standards.

[EmmanuelAdah]

I’d like to claim this issue. I will update app/api/auth/logout/route.ts to inspect the upstream response and return a 502 Bad Gateway if the upstream call fails, ensuring the local refresh_token cookie is cleared only on a successful upstream logout. I will also add test coverage for both success (2xx -> 200) and failure (4xx/5xx -> 502) paths. Please assign this to me, and I’ll open a PR shortly.