fix(auth): re-check auth status after logout; clear NextAuth session after sync
1) Sidebar logout flow:
- After AuthReset, also dispatch AuthStatusCheckSubmitted so the auth
machine re-verifies storage (not just resets to initialState). This
makes sure the redirect to /chat reflects the actual storage state,
not just the forcibly-cleared context.
2) OAuthSessionSync:
- After dispatching AuthGoogleSyncSubmitted / AuthFacebookSyncSubmitted,
call signOut({ redirect: false }) to drop the NextAuth session.
The OAuth idToken / accessToken has already been handed to the
backend; clearing the browser-side session prevents lingering OAuth
credential exposure. Fire-and-forget — once status flips to
"unauthenticated", the useEffect early-returns so no re-entry.
Note: auth-machine.ts lost a 3-line stale comment block about XState v5
type inference for inline assign; bundled with this commit.
This commit is contained in:
@@ -32,9 +32,6 @@ export type { AuthEvent } from "./auth-events";
|
||||
// splash / auth screen 看到 `pendingRedirect && loginStatus !== "notLoggedIn"` 跳 /chat
|
||||
// 跳完派 `AuthClearPendingRedirect` 置 false
|
||||
// checkingAuthStatus 不设 flag —— 被动查 token 不算"用户意图"。
|
||||
//
|
||||
// 注:onDone 用了内联assign(不是 helper function)—— XState v5 的 TypeScript
|
||||
// 推断对 helper return type 不友好;内联能保留 `state.matches("loadingXxx")` 的类型。
|
||||
// ============================================================
|
||||
export const authMachine = setup({
|
||||
types: {
|
||||
|
||||
Reference in New Issue
Block a user