fix(auth): revoke JWT on logout and harden Google sign-in

Logout now increments sessionVersion so existing JWTs are rejected
server-side, deletes orphaned DB sessions, and uses redirectTo for signOut.
Google OAuth requests account selection each time; optional AUTH_GOOGLE_PROMPT=login
forces Google re-authentication on shared devices.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/components/admin-sidebar.tsx

@@ -1,7 +1,8 @@
 'use client'
 
 import { usePathname } from 'next/navigation'
-import { signOut, useSession } from 'next-auth/react'
+import { useSession } from 'next-auth/react'
+import { performSignOut } from '@/lib/auth-client'
 import {
   LayoutDashboard,
   Users,
@@ -113,7 +114,7 @@ export function AdminSidebar({ className }: { className?: string }) {
               <DropdownMenuSeparator />
               <DropdownMenuItem
                 className="cursor-pointer text-destructive focus:text-destructive"
-                onClick={() => signOut({ callbackUrl: '/login' })}
+                onClick={() => performSignOut('/login')}
               >
                 <LogOut className="mr-2 h-4 w-4" />
                 {t('auth.signOut')}

memento-note/components/legal/delete-account-dialog.tsx

@@ -1,7 +1,7 @@
 'use client'
 
 import { useState } from 'react'
-import { signOut } from 'next-auth/react'
+import { performSignOut } from '@/lib/auth-client'
 import { Loader2, ShieldAlert } from 'lucide-react'
 import { toast } from 'sonner'
 import { useLanguage } from '@/lib/i18n'
@@ -42,7 +42,7 @@ export function DeleteAccountDialog({ userEmail, open, onOpenChange }: DeleteAcc
       }
 
       toast.success(t('account.deleteAccount.successRedirect'))
-      await signOut({ callbackUrl: '/login?deleted=true' })
+      await performSignOut('/login?deleted=true')
     } catch {
       toast.error(t('account.deleteAccount.errorFailed'))
       setIsDeleting(false)

memento-note/components/login-form.tsx

@@ -44,12 +44,20 @@ function LoginButton() {
 export function LoginForm({
   allowRegister = true,
   googleAuthEnabled = false,
+  authError,
 }: {
   allowRegister?: boolean;
   googleAuthEnabled?: boolean;
+  authError?: string;
 }) {
   const [errorMessage, dispatch] = useActionState(authenticate, undefined);
   const { t } = useLanguage();
+  const oauthError =
+    authError === 'SessionRequired'
+      ? t('auth.sessionExpired')
+      : authError === 'OAuthAccountNotLinked'
+        ? t('auth.oauthAccountNotLinked')
+        : authError ?? null;
 
   return (
     <div className="bg-white dark:bg-[var(--background)]/50 border border-[var(--border)] p-8 md:p-10 rounded-[48px] shadow-2xl">
@@ -63,6 +71,12 @@ export function LoginForm({
           </p>
         </div>
 
+        {oauthError && (
+          <p className="text-sm text-red-500 text-center px-2" role="alert">
+            {oauthError}
+          </p>
+        )}
+
         {googleAuthEnabled && (
           <>
             <GoogleSignInButton label={t('auth.continueWithGoogle')} />

memento-note/components/sidebar.tsx

@@ -48,7 +48,7 @@ import {
   DropdownMenuSeparator,
   DropdownMenuTrigger,
 } from '@/components/ui/dropdown-menu'
-import { signOut } from 'next-auth/react'
+import { performSignOut } from '@/lib/auth-client'
 import { useNoteRefresh } from '@/context/NoteRefreshContext'
 import { useBrainstormSessions, useDeleteBrainstorm } from '@/hooks/use-brainstorm'
 import { UsageMeter } from './usage-meter'
@@ -849,7 +849,7 @@ export function Sidebar({ className, user }: { className?: string; user?: any })
                 <DropdownMenuSeparator />
                 <DropdownMenuItem
                   className="text-destructive focus:text-destructive"
-                  onClick={() => signOut({ callbackUrl: '/login' })}
+                  onClick={() => performSignOut('/login')}
                 >
                   <LogOut className="h-4 w-4 me-2" />
                   {t('sidebar.signOut')}