From 7fb5457a5b2c8727c1776f1c64b06d1963b87e18 Mon Sep 17 00:00:00 2001
From: Ruben Verborgh <ruben@verborgh.org>
Date: Sat, 6 Oct 2018 18:39:20 -0400
Subject: [PATCH] Logout using OIDC credentials instead of cookies.

Closes #69.
---
 flow-typed/lib-defs.js   |  2 +-
 src/session.js           |  7 +++----
 src/solid-auth-client.js |  2 +-
 src/webid-oidc.js        | 14 +++++++++++---
 4 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/flow-typed/lib-defs.js b/flow-typed/lib-defs.js
index 0deac9e..073cf0b 100644
--- a/flow-typed/lib-defs.js
+++ b/flow-typed/lib-defs.js
@@ -14,6 +14,6 @@ declare module '@solid/oidc-rp' {
     createRequest(options: Object, storage: Object): Promise<string>,
     serialize(): string,
     validateResponse(response: string, session: Object): Promise<Object>,
-    logout(): Promise<void>
+    logoutRequest(options?: Object): Promise<void>
   }
 }
diff --git a/src/session.js b/src/session.js
index 4849c8c..c9c5589 100644
--- a/src/session.js
+++ b/src/session.js
@@ -6,10 +6,9 @@ import { getData, updateStorage } from './storage'
 export type webIdOidcSession = {
   idp: string,
   webId: string,
-  accessToken: string,
-  idToken: string,
-  clientId: string,
-  sessionKey: string
+  authorization: {
+    id_token: string
+  }
 }
 
 export type Session = webIdOidcSession
diff --git a/src/solid-auth-client.js b/src/solid-auth-client.js
index d40defc..8f0dc6a 100644
--- a/src/solid-auth-client.js
+++ b/src/solid-auth-client.js
@@ -80,7 +80,7 @@ export default class SolidAuthClient extends EventEmitter {
     const session = await getSession(storage)
     if (session) {
       try {
-        await WebIdOidc.logout(storage)
+        await WebIdOidc.logout(storage, globalFetch)
         this.emit('logout')
         this.emit('session', null)
       } catch (err) {
diff --git a/src/webid-oidc.js b/src/webid-oidc.js
index 80c3b50..a23403d 100644
--- a/src/webid-oidc.js
+++ b/src/webid-oidc.js
@@ -7,6 +7,7 @@ import PoPToken from '@solid/oidc-rp/lib/PoPToken'
 import type { loginOptions } from './solid-auth-client'
 import { currentUrl, navigateTo, toUrlString } from './url-util'
 import type { webIdOidcSession } from './session'
+import { getSession } from './session'
 import type { AsyncStorage } from './storage'
 import { defaultStorage, getData, updateStorage } from './storage'
 
@@ -55,11 +56,18 @@ export async function currentSession(
   }
 }
 
-export async function logout(storage: AsyncStorage): Promise<void> {
+export async function logout(
+  storage: AsyncStorage,
+  fetch: Function
+): Promise<void> {
   const rp = await getStoredRp(storage)
-  if (rp) {
+  const session = await getSession(storage)
+  if (rp && session) {
     try {
-      rp.logout()
+      const url = rp.logoutRequest({
+        id_token_hint: session.authorization.id_token
+      })
+      await fetch(url, { method: 'POST' })
     } catch (err) {
       console.warn('Error logging out of the WebID-OIDC session')
       console.error(err)