Christophe Vila
502e61e7b4
Four bugs slipped through per-task review since each task only saw its own diff: - Logout was a plain <a href> GET against a POST-only backend route, so it 405'd and never cleared the session cookie or hit Keycloak's end-session redirect. Now a <form method="post"> with a submit button styled to match the old link (still a real full-page navigation, not a fetch, so the Keycloak redirect chain still works). - Login/logout used origin-relative paths, unreachable from the Vite dev server (:5173) against the backend (:8080) with no proxy configured. Both now build their URL from client.ts's now-exported BASE_URL. - handleSessionCallback's four failure paths redirected to /?auth_error=failed with no logging, making a real OIDC failure undiagnosable in production. Added log.Printf on each failure site. - handleSessionLogout passed a bare "/" to EndSessionURL; Keycloak requires post_logout_redirect_uri to be an absolute, registered URL. Added SessionConfig.PublicBaseURL, wired from cfg.PublicBaseURL in main.go, and used to build an absolute redirect. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>