Merge branch 'main' of https://gitlab.epicnabbo.nl/remco/EpicNext-Cms into codex/housekeeping-complete

src/actions/sessions.ts

@@ -9,7 +9,8 @@ import { logger } from "@/lib/logger";
 
 /**
  * Invalidate every CMS JWT for the signed-in user by bumping website_jwt_version,
- * revoke personal access tokens, then end the current browser session too.
+ * revoke personal access tokens, revoke the game SSO ticket, then end the
+ * current browser session too.
  */
 export async function signOutEverywhere(): Promise<void> {
 	const session = await auth();
@@ -24,6 +25,7 @@ export async function signOutEverywhere(): Promise<void> {
 			.update(User)
 			.set({
 				websiteJwtVersion: sql`${User.websiteJwtVersion} + 1`,
+				authTicket: "",
 			})
 			.where(eq(User.id, userId));
 		await invalidateJwtVersionCache(userId);
@@ -57,3 +59,26 @@ export async function signOutEverywhere(): Promise<void> {
 
 	await signOut({ redirectTo: "/login?signedOutAll=1" });
 }
+
+/**
+ * Log the current user out of the website AND revoke their game SSO ticket.
+ *
+ * Without revoking it, a ticket leaked via logs/history/referrers stays valid
+ * for the emulator after logout. Clearing the ticket makes any future client
+ * connection with it invalid.
+ */
+export async function signOutAndRevokeTicket(): Promise<void> {
+	const session = await auth();
+	const userId = Number(session?.user?.id);
+	if (Number.isInteger(userId) && userId > 0) {
+		try {
+			await db.update(User).set({ authTicket: "" }).where(eq(User.id, userId));
+		} catch (err) {
+			logger.warn("Failed to revoke SSO ticket during sign out", {
+				userId,
+				error: err instanceof Error ? err.message : "Unknown",
+			});
+		}
+	}
+	await signOut({ redirectTo: "/" });
+}