Fix OIDC single sign-out breaking due to SameSite cookie changes in Moodle core

[Lai Wei (weilai-irl)]

No description provided.

[Copilot]

Pull request overview

This PR updates the OIDC single sign-out implementation to avoid relying on the user’s MoodleSession cookie (which may be absent due to SameSite behavior), by persisting the Moodle session id at login time and terminating that session directly during IdP-initiated logout. It also adjusts SID mapping cleanup to be based on whether the Moodle session still exists, rather than a fixed age threshold.

Changes:

• Store the active Moodle session id alongside the IdP sid mapping at login, and destroy that session during SSO logout.
• Add sessionid to the auth_oidc_sid schema (install + upgrade) and update privacy metadata + language strings.
• Update the cleanup scheduled task and its unit test to retain mappings while the corresponding Moodle session exists.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
auth/oidc/version.php	Bumps plugin version to include this change set.
auth/oidc/classes/loginflow/authcode.php	Persists the current Moodle session id into auth_oidc_sid at login.
auth/oidc/logout.php	Uses stored session id to terminate the correct session during IdP-initiated logout.
auth/oidc/classes/task/cleanup_oidc_sid.php	Changes cleanup criteria from “older than 1 day” to “session no longer exists”.
auth/oidc/tests/task/cleanup_oidc_sid_test.php	Updates unit test to match the new cleanup behavior and session-existence logic.
auth/oidc/db/install.xml	Adds sessionid column to auth_oidc_sid for new installs.
auth/oidc/db/upgrade.php	Adds upgrade step to introduce sessionid to existing installs.
auth/oidc/classes/privacy/provider.php	Includes sessionid in declared privacy metadata.
auth/oidc/lang/en/auth_oidc.php	Adds the privacy metadata string for sessionid.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.