api

Unified WorkOS callback — WorkOS is the source of truth.

Expected payload: { "code": "<authorization_code>" }

Three cases:

1. User exists in both WorkOS and Django → login.
2. User exists in WorkOS but not Django → provision immediately.
3. User does not exist in WorkOS → code exchange fails, error returned.

Log the current user out.

Two things make logout effective in this architecture:

1. The webapp proxy clears the tofu-web cookie via its outbound policy, so the browser can no longer present the access token.
2. The frontend redirects through workos_logout_url (when present) to terminate the WorkOS-side session — otherwise AuthKit would silently re-authenticate on the next /signin.

We deliberately do NOT iterate OutstandingToken and call .blacklist() on each one. The proxy strips refresh tokens from auth responses before they ever reach the client (see set-auth-cookie-outbound), so those rows are orphans — no device holds them, no one can present them to /api/token/refresh/. Blacklisting defends against a threat that doesn't exist here. If we ever start delivering refresh tokens to clients, revisit.

Response: { "message": "Successfully logged out", "workos_logout_url": "https://api.workos.com/.../logout?..." | null, "redirect_to": "/signin" }