fix(auth): resolve OIDC logout URL before clearing auth state

contexts/auth-context.tsx

@@ -137,16 +137,23 @@ export function AuthProvider({ children }: { children: ReactNode }) {
 
   const logoutWithOidcRedirect = useCallback(async () => {
     const oidcSession = isValidOidcLogoutSession(oidcSessionStore) ? oidcSessionStore : undefined
-    logout()
 
-    if (!oidcSession) return false
+    if (!oidcSession) {
+      logout()
+      return false
+    }
 
     try {
+      // Build the URL before logout(), or DashboardAuthGuard redirects to login before this navigation runs.
       const { configManager } = await import("@/lib/config")
       const config = await configManager.loadConfig()
-      window.location.href = buildOidcLogoutUrl(config.serverHost, oidcSession.logoutToken)
+      const logoutUrl = buildOidcLogoutUrl(config.serverHost, oidcSession.logoutToken)
+
+      logout()
+      window.location.href = logoutUrl
       return true
     } catch {
+      logout()
       return false
     }
   }, [oidcSessionStore, logout])

tests/lib/oidc-logout-source.test.js

@@ -0,0 +1,16 @@
+import test from "node:test"
+import assert from "node:assert/strict"
+import fs from "node:fs"
+
+const source = fs.readFileSync("contexts/auth-context.tsx", "utf8")
+
+test("OIDC federated logout builds its destination before clearing auth state", () => {
+  assert.match(
+    source,
+    /const logoutUrl = buildOidcLogoutUrl\(config\.serverHost, oidcSession\.logoutToken\)\s*\n\s*logout\(\)\s*\n\s*window\.location\.href = logoutUrl/,
+  )
+})
+
+test("OIDC federated logout does not clear auth state before awaiting config", () => {
+  assert.doesNotMatch(source, /logout\(\)\s*\n\s*if \(!oidcSession\) return false/)
+})