fix(auth): skip Flutter OIDC on web, rely on NPM forward auth

On web, NPM forward auth handles authentication at the proxy level.
By the time the Flutter app loads, the user is already authenticated.
Skip the redundant Flutter OIDC flow that was causing Riverpod
"Ref disposed" errors from conflicting auth state updates.

Mobile still uses Flutter's OIDC flow as before.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.2] - 2026-01-04
+
+### Changed
+- **Web auth simplified**: Skip Flutter OIDC on web - NPM forward auth handles it
+  - NPM authenticates at proxy level before app loads
+  - No more redundant OIDC redirect after NPM auth completes
+  - Fixes "Cannot use Ref after disposed" error from conflicting auth flows
+  - Mobile still uses Flutter OIDC flow
+
+### Added
+- Logout now redirects to Authentik to end SSO session
+  - Clears local tokens AND invalidates Authentik session
+  - Uses OIDC end_session_endpoint from discovery document
+  - Redirects back to app after Authentik logout completes
+
+## [1.1.0] - 2026-01-04
+
+### Changed
+- **Dockerfile rebuild fix**: Added `flutter clean` before build to prevent stale cached artifacts
+  - VERSION build arg added for explicit cache busting
+  - Reordered build steps: clean → pub get → build_runner → health.json → flutter build
+  - Ensures deployed app always matches the version in health.json
+
+### Fixed
+- Replaced deprecated `dart:html` with `package:web` in iframe_view_web.dart
+  - Uses `web.HTMLIFrameElement` instead of `html.IFrameElement`
+  - Fixes deprecation warnings for Flutter 3.x web builds
+
 ## [1.0.12] - 2026-01-04
 
 ### Changed

Dockerfile

@@ -3,16 +3,24 @@ FROM ghcr.io/cirruslabs/flutter:stable AS builder
 
 WORKDIR /app
 
-# Copy dependency files first for better caching
-COPY pubspec.yaml ./
+# VERSION arg busts cache when version changes in pubspec.yaml
+# Extract version: docker build --build-arg VERSION=$(grep '^version:' pubspec.yaml | cut -d' ' -f2) .
+ARG VERSION=0.0.0
+RUN echo "Building version: $VERSION"
 
-# Get dependencies (generates pubspec.lock)
+# Copy dependency files first for better caching
+COPY pubspec.yaml pubspec.lock* ./
+
+# Get dependencies
 RUN flutter pub get
 
 # Copy the rest of the application
 COPY . .
 
-# Generate code with build_runner
+# Clean any cached build artifacts to ensure fresh build
+RUN flutter clean && flutter pub get
+
+# Generate code with build_runner (after clean for fresh generation)
 RUN dart run build_runner build --delete-conflicting-outputs
 
 # Generate health.json with version info

lib/core/auth/auth_provider.dart

@@ -341,10 +341,27 @@ class AuthNotifier extends _$AuthNotifier {
   }
 
   /// Sign out and clear stored credentials.
+  ///
+  /// On web, also redirects to Authentik's logout endpoint to end the SSO session.
   Future<void> signOut() async {
+    // Clear local storage first
     await _clearStoredAuth();
     state = const AsyncData(AuthState());
-    developer.log('Signed out', name: 'auth');
+    developer.log('Signed out locally', name: 'auth');
+
+    // On web, redirect to Authentik logout to end SSO session
+    if (kIsWeb && AppConfig.requiresAuth) {
+      try {
+        final oidcService = OidcServiceWeb();
+        final logoutUrl = await oidcService.getLogoutUrl();
+        developer.log('Redirecting to Authentik logout', name: 'auth');
+        web_utils.redirectTo(logoutUrl);
+      } catch (e) {
+        developer.log('Failed to get logout URL: $e', name: 'auth');
+        // Local logout already done, just reload to trigger re-auth
+        web_utils.redirectTo('/');
+      }
+    }
   }
 
   /// Update user preferences.

lib/core/auth/oidc_service_web.dart

@@ -209,4 +209,31 @@ class OidcServiceWeb implements OidcService {
     return List.generate(length, (_) => chars[random.nextInt(chars.length)])
         .join();
   }
+
+  /// Get the logout URL to redirect the browser to for SSO logout.
+  ///
+  /// [idToken] is optional but recommended for logout verification.
+  /// After logout, Authentik redirects back to [postLogoutRedirectUri].
+  Future<String> getLogoutUrl({String? idToken}) async {
+    final discovery = await _fetchDiscovery();
+    final endSessionEndpoint = discovery['end_session_endpoint'] as String?;
+
+    if (endSessionEndpoint == null) {
+      // Fallback: just redirect to home, local state already cleared
+      developer.log('No end_session_endpoint in discovery', name: 'oidc_web');
+      return AppConfig.webBaseUrl;
+    }
+
+    final params = <String, String>{
+      'post_logout_redirect_uri': AppConfig.webBaseUrl,
+    };
+
+    if (idToken != null) {
+      params['id_token_hint'] = idToken;
+    }
+
+    final uri = Uri.parse(endSessionEndpoint).replace(queryParameters: params);
+    developer.log('Logout URL: $uri', name: 'oidc_web');
+    return uri.toString();
+  }
 }

lib/features/front_hall/presentation/widgets/iframe_view_web.dart

@@ -1,8 +1,8 @@
-import 'dart:html' as html;
 import 'dart:ui_web' as ui_web;
 
 import 'package:flutter/material.dart';
 import 'package:url_launcher/url_launcher.dart';
+import 'package:web/web.dart' as web;
 
 /// Embedded iframe view for displaying external content (web only).
 ///
@@ -31,7 +31,7 @@ class IframeView extends StatefulWidget {
 
 class _IframeViewState extends State<IframeView> {
   late final String _viewType;
-  late html.IFrameElement _iframe;
+  late web.HTMLIFrameElement _iframe;
   bool _isLoading = true;
 
   @override
@@ -42,17 +42,18 @@ class _IframeViewState extends State<IframeView> {
   }
 
   void _createIframe() {
-    _iframe = html.IFrameElement()
+    _iframe = web.document.createElement('iframe') as web.HTMLIFrameElement
       ..src = widget.url
       ..style.border = 'none'
       ..style.width = '100%'
       ..style.height = '100%'
-      ..allow = 'fullscreen'
-      ..onLoad.listen((_) {
-        if (mounted) {
-          setState(() => _isLoading = false);
-        }
-      });
+      ..allow = 'fullscreen';
+
+    _iframe.onLoad.listen((_) {
+      if (mounted) {
+        setState(() => _isLoading = false);
+      }
+    });
 
     // Register the view factory
     ui_web.platformViewRegistry.registerViewFactory(

lib/routing/app_router.dart

@@ -132,6 +132,9 @@ class _OidcCallbackPageState extends ConsumerState<_OidcCallbackPage> {
   }
 
   Future<void> _processCallback() async {
+    // Check mounted before any async work
+    if (!mounted) return;
+
     // Check for error from Authentik
     if (widget.error != null) {
       setState(() {
@@ -150,12 +153,15 @@ class _OidcCallbackPageState extends ConsumerState<_OidcCallbackPage> {
       return;
     }
 
+    // Get notifier reference before async gap to avoid disposed ref errors
+    final authNotifier = ref.read(authProvider.notifier);
+
     // Exchange code for tokens
     try {
-      await ref.read(authProvider.notifier).handleOidcCallback(
-            widget.code!,
-            widget.callbackState!,
-          );
+      await authNotifier.handleOidcCallback(
+        widget.code!,
+        widget.callbackState!,
+      );
 
       // Navigate to home on success
       if (mounted) {

lib/shared/layouts/app_scaffold.dart

@@ -1,3 +1,4 @@
+import 'package:flutter/foundation.dart' show kIsWeb;
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:go_router/go_router.dart';
@@ -45,6 +46,14 @@ class _AppScaffoldState extends ConsumerState<AppScaffold> {
       return _buildScaffold(context);
     }
 
+    // On web, NPM forward auth handles authentication at the proxy level.
+    // If we reach this point, the user is already authenticated by NPM.
+    // No need for Flutter's OIDC flow - just show the app.
+    if (kIsWeb) {
+      return _buildScaffold(context);
+    }
+
+    // Mobile: Use Flutter's OIDC flow
     final authAsync = ref.watch(authProvider);
 
     return authAsync.when(

pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.0.12+1
+version: 1.1.2+1
 
 environment:
   sdk: ^3.10.4

tool/generate_health_json.dart

@@ -2,6 +2,8 @@
 // Generates web/health.json from pubspec.yaml
 // Run: dart run tool/generate_health_json.dart
 
+// ignore_for_file: avoid_print
+
 import 'dart:convert';
 import 'dart:io';