fix: fix logout 2

[Germey]

Important

1. Make sure you have read our contribution guidelines
2. Ensure there is an associated issue and you have been assigned to it
3. Use the correct syntax to link this PR: Fixes #<issue number>.

Summary

Screenshots

Before	After
...	...

Checklist

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• I ran dev/reformat(backend) and cd web && npx lint-staged(frontend) to appease the lint gods

[Copilot]

Pull request overview

This PR attempts to fix logout functionality by simplifying the logout flow and removing AceDataCloud OAuth-specific restrictions. However, the changes introduce several critical race conditions and bugs that could cause redirect loops and incorrect authentication state management.

Key Changes:

• Simplified logout mutation by removing query cache management
• Modified error handling in login status check to return logged_in: true for non-401 errors
• Changed CSRF token cookie handling to use hardcoded cookie names instead of the configuration function
• Removed AceDataCloud OAuth-specific logout cookie and login restrictions on backend

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
web/service/use-common.ts	Simplified logout mutation (removed cache management) and modified error handling in useIsLogin to treat all non-401 errors as logged in
web/service/fetch.ts	Replaced CSRF_COOKIE_NAME() function call with hardcoded cookie name logic, duplicating configuration logic
web/app/signin/normal-form.tsx	Removed isFetching checks and modified redirect logic to skip default /apps redirect
web/app/components/header/account-dropdown/index.tsx	Changed logout from mutateAsync (awaited) to mutate (fire-and-forget), creating race conditions
api/controllers/console/auth/login.py	Removed no_acedatacloud_oauth cookie setting and OAuth login checks from email code login endpoints

Comments suppressed due to low confidence (2)

web/app/components/header/account-dropdown/index.tsx:67

• This file uses mutateAsync and awaits the logout call before navigation, which is the correct pattern to avoid race conditions. The change in web/app/components/header/account-dropdown/index.tsx to use mutate without waiting creates an inconsistency in how logout is handled across the codebase. See web/app/account/(commonLayout)/avatar.tsx:27-36, web/app/account/(commonLayout)/account-page/email-change-modal.tsx:171-179, and other files for the consistent pattern.

  const { mutate: logout } = useLogout()
  const handleLogout = () => {
    logout()
    resetUser()
    localStorage.removeItem('setup_status')
    // Tokens are now stored in cookies and cleared by backend

    // To avoid use other account's education notice info
    localStorage.removeItem('education-reverify-prev-expire-at')
    localStorage.removeItem('education-reverify-has-noticed')
    localStorage.removeItem('education-expired-has-noticed')

    router.push('/signin')
  }

web/app/components/header/account-dropdown/index.tsx:67

• Using mutate instead of mutateAsync means the logout API call is fired asynchronously but the code doesn't wait for it to complete before calling resetUser(), clearing localStorage, and navigating to /signin. This can cause a race condition where the user is redirected to the signin page while still having cached "logged in" state in React Query, potentially causing immediate redirect loops. Consider using mutateAsync and awaiting the logout, or adding an onSuccess callback to handle the cleanup and navigation.

  const { mutate: logout } = useLogout()
  const handleLogout = () => {
    logout()
    resetUser()
    localStorage.removeItem('setup_status')
    // Tokens are now stored in cookies and cleared by backend

    // To avoid use other account's education notice info
    localStorage.removeItem('education-reverify-prev-expire-at')
    localStorage.removeItem('education-reverify-has-noticed')
    localStorage.removeItem('education-expired-has-noticed')

    router.push('/signin')
  }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Germey]

@copilot 帮修复actions报错

[Copilot]

@Germey I've opened a new pull request, #32, to work on those changes. Once the pull request is ready, I'll request review from you.