<script setup lang="ts">
// Sign-out landing. /api/auth/sign-out cleared the local session and bounced
// through Authentik's end-session endpoint, which ended the IdP session.
// At this point the user has no portal session and no Authentik session —
// visiting / will prompt for fresh credentials. (The hidden iframe trick is
// no longer needed; full redirect through Authentik handles everything.)

definePageMeta({ layout: 'blank', auth: false, oidcAuth: { enabled: false } })

function signInAgain() {
  // External navigation so the OIDC handler runs on the server and issues
  // the meta-refresh into Authentik's authorize URL. router.push('/') would
  // bounce through /auth/login first, adding an extra hop.
  return navigateTo('/auth/oidc/login', { external: true })
}
</script>

<template>
  <AuthShell>
    <div class="badge">
      <UiIcon name="check" :size="28" />
    </div>
    <AuthHeading
      eyebrow="See you soon"
      title="You're signed out"
      body="Your session has been ended. Sign in again whenever you're ready — your work is right where you left it."
    />

    <AuthButton variant="primary" @click="signInAgain">Sign in again</AuthButton>

    <AuthFooterLink>
      Closing the tab? Your data stays put on
      <span class="mono">app.dezky.local</span>.
    </AuthFooterLink>
  </AuthShell>
</template>

<style scoped>
.badge {
  width: 56px;
  height: 56px;
  border-radius: 14px;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  margin: 0 0 18px 0;
  background: rgba(31, 138, 91, 0.1);
  color: var(--ok);
}

.mono {
  font-family: var(--font-mono);
  font-size: 11px;
  color: var(--text-dim);
}

</style>
