#842 fix: OIDC/SAML logout, empty-target queries/carves, carve bulk actions, envless login Pull request opened by alvarofraguas Summary • OIDC logout cookie path fix: the

osctrl_id_token

cookie was scoped to

/api/v1/oidc

— the logout handler at

/api/v1/logout

couldn't see it, so OIDC sessions fell through to the SAML logout path. Widened cookie path to

/

. • SAML IdP session termination: on logout, if the session was SAML-authenticated, the frontend now redirects to the IdP's logout URL (configurable via

SAML_LOGOUT_URL

) so the IdP session is killed too — prevents silent re-login. • Auth provider documentation: new

docs/auth-providers.md

covering Keycloak, Auth0, Okta, and Entra ID configuration gotchas for both OIDC and SAML. • Empty-target query/carve fix:

CreateQueryCarve()

returned an empty node list when no targeting criteria were specified, silently creating queries/carves that targeted zero nodes. Now defaults to all active nodes in the environment — matching the SPA's stated behavior. • Carve bulk actions: the carves list page now has select-all, per-row checkboxes, and a bulk action toolbar (delete/expire/complete), matching the existing queries list page. • Envless login:

POST /api/v1/login

now accepts credentials without requiring an environment UUID in the path. The SPA login page drops the environment selector — users just enter username and password. The old

POST /api/v1/login/{env}

path remains for backward compatibility. Test plan • SAML logout verified on Kali Docker stack against Auth0 — full flow: SAML login → logout → Auth0 session killed → OIDC requires re-auth • OIDC logout still works after cookie path change • Query with no targets: API returns 200, creates node_queries for all 3 active nodes (was 0 before) • Carve with no targets: API returns 201, creates node_queries for all 3 active nodes (was 0 before) • Query with specific UUID target: still targets only 1 node (no regression) • Carve delete via API: returns 200 with success message • Envless login

POST /api/v1/login

returns JWT — verified on Kali Docker via both direct API and HTTPS proxy • Old env-based login

POST /api/v1/login/{env}

still works (backward compat) • SPA login page loads with no environment selector • Frontend typecheck passes (

tsc --noEmit

) • Go builds clean (

go build ./cmd/api/ && go build ./cmd/admin/

) jmpsec/osctrl