fix: web login (#14378)

#### PR Dependency Tree


* **PR #14378** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a deprecated GET sign-out endpoint for backward compatibility
with legacy clients.

* **Improvements**
* Updated magic-link and OAuth flows to always generate and manage
client nonces; native clients use a nonce, web preserves cross-device
behavior.

* **Tests**
* Added tests covering the deprecated sign-out flow and OAuth preflight
client_nonce handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/__tests__/auth/controller.spec.ts

@@ -264,6 +264,23 @@ test('should be able to sign out when duplicated csrf cookies exist', async t =>
   t.falsy(sessionRes.body.user);
 });
 
+test('should be able to sign out via GET /api/auth/sign-out (deprecated)', async t => {
+  const { app } = t.context;
+
+  const u1 = await app.createUser('u1@affine.pro');
+
+  await app
+    .POST('/api/auth/sign-in')
+    .send({ email: u1.email, password: u1.password })
+    .expect(200);
+
+  const res = await app.GET('/api/auth/sign-out').expect(200);
+  t.is(res.headers.deprecation, 'true');
+
+  const session = await currentUser(app);
+  t.falsy(session);
+});
+
 test('should reject sign out when csrf token mismatched', async t => {
   const { app } = t.context;
 

packages/backend/server/src/core/auth/controller.ts

@@ -228,6 +228,30 @@ export class AuthController {
     });
   }
 
+  @Public()
+  /**
+   * @deprecated Kept for 0.25 clients that still call GET `/api/auth/sign-out`.
+   * Use POST `/api/auth/sign-out` instead.
+   */
+  @Get('/sign-out')
+  async signOutDeprecated(
+    @Res() res: Response,
+    @Session() session: Session | undefined,
+    @Query('user_id') userId: string | undefined
+  ) {
+    res.setHeader('Deprecation', 'true');
+
+    if (!session) {
+      res.status(HttpStatus.OK).send({});
+      return;
+    }
+
+    await this.auth.signOut(session.sessionId, userId);
+    await this.auth.refreshCookies(res, session.sessionId);
+
+    res.status(HttpStatus.OK).send({});
+  }
+
   @Public()
   @Post('/sign-out')
   async signOut(