fix: logout redirect uses OIDC_REDIRECT_URI instead of request headers (open redirect fix)

src/app/api/auth/logout/route.ts

@@ -1,14 +1,18 @@
 // GET + POST /api/auth/logout — 退出登录（清除 cookie + 302 跳转 /login）
-import { NextResponse, type NextRequest } from 'next/server'
+import { NextResponse } from 'next/server'
 
 const cookieDomain = process.env.COOKIE_DOMAIN || '.tlyq.ai'
 
+/** 从 OIDC_REDIRECT_URI 提取 site URL（不可信请求头，见 LESSONS-LEARNED #51） */
+function getSiteUrl(): string {
+  const redirectUri = process.env.OIDC_REDIRECT_URI || ''
+  try { const u = new URL(redirectUri); return `${u.protocol}//${u.host}` } catch { /* fallthrough */ }
+  return process.env.NEXT_PUBLIC_SITE_URL || 'https://assets.tlyq.ai'
+}
+
 /** 清除 tlyq_session + session cookie → 302 跳转 /login */
-function logoutResponse(request: NextRequest): NextResponse {
+function logoutResponse(): NextResponse {
-  const host = request.headers.get('x-forwarded-host') || request.headers.get('host') || 'localhost'
+  const response = NextResponse.redirect(new URL('/login', getSiteUrl()))
-  const proto = request.headers.get('x-forwarded-proto') || 'https'
-  const baseUrl = `${proto}://${host}`
-  const response = NextResponse.redirect(new URL('/login', baseUrl))
   response.cookies.set('tlyq_session', '', {
     httpOnly: true, secure: process.env.NODE_ENV === 'production',
     sameSite: 'lax', domain: cookieDomain, path: '/', maxAge: 0,
@@ -17,5 +21,5 @@ function logoutResponse(request: NextRequest): NextResponse {
   return response
 }
 
-export async function GET(request: NextRequest) { return logoutResponse(request) }
+export async function GET() { return logoutResponse() }
-export async function POST(request: NextRequest) { return logoutResponse(request) }
+export async function POST() { return logoutResponse() }