feat: implement logout hook and add a new plugin api method to perform logout

lib/plugin-sandbox/consent.ts

@@ -83,6 +83,7 @@ const PERMISSION_LABELS: Record<string, { title: string; body: string }> = {
   'settings:write':   { title: 'Modify your settings',           body: 'Change non-secret user preferences.' },
   'security:read':    { title: 'Read account security state',    body: 'See whether TOTP / encryption are enabled (no secrets exposed).' },
   'auth:observe':     { title: 'Observe login events',           body: 'See when you log in, log out, or switch accounts.' },
+  'auth:emit':        { title: 'Emit login events',              body: 'Emit auth events such as logout.' },
   'http:post':        { title: 'Call same-origin APIs',          body: 'Make authenticated requests to the webmail backend on your behalf.' },
   'http:fetch':       { title: 'Talk to external services',      body: 'Make uncredentialled requests to the third-party origins listed in the manifest.' },
   'admin:config':     { title: 'Read/write admin config',        body: 'Access this plugin\'s admin-supplied configuration values.' },

lib/plugin-sandbox/host-api.ts

@@ -67,6 +67,7 @@ const PERM_PER_METHOD: Record<string, Permission | null> = {
   // user
   'user.getAccounts': 'account:read',
   'user.getIdentities': 'identity:read',
+  'user.logout': 'auth:emit',
   // admin
   'admin.getConfig': 'admin:config',
   'admin.getAllConfig': 'admin:config',
@@ -177,7 +178,7 @@ interface AccountResponse {
 function doUserGetAccounts(): AccountResponse[] {
   const state = useAccountStore.getState();
 
-  // ws remove sensitive fields from the account entries before returning to the plugin
+  // we remove sensitive fields from the account entries before returning to the plugin
   const accounts = state.accounts.map((account) => ({
     id: account.id,
     label: account.label,
@@ -197,6 +198,10 @@ function doUserGetIdentities(): Identity[] {
   return useIdentityStore.getState().identities;
 }
 
+async function doUserLogout(): Promise<void>{
+  return useAuthStore.getState().logout();
+}
+
 // ─── http.post (same-origin /api/*) ───────────────────────────
 
 /**
@@ -787,6 +792,7 @@ export async function dispatchApiCall(
 
     case 'user.getAccounts':   return doUserGetAccounts();
     case 'user.getIdentities': return doUserGetIdentities();
+    case 'user.logout' : return doUserLogout();
 
     case 'admin.getConfig':    return adminGet(plugin.id, args[0] as string);
     case 'admin.getAllConfig': return adminGetAll(plugin.id);

lib/plugin-sandbox/runtime.tsx

@@ -178,6 +178,7 @@ function buildPluginApi(manifest: PluginManifest) {
     user: {
       getAccounts: () => callApi('user.getAccounts', []),
       getIdentities: () => callApi('user.getIdentities', []),
+      logout: () => callApi('user.logout', []),
     },
     http: {
       post: (path: string, body: Record<string, unknown>) => callApi('http.post', [path, body]),

lib/plugin-types.ts

@@ -1035,6 +1035,7 @@ export const ALL_PERMISSIONS = [
   'settings:read', 'settings:write',
   'security:read',
   'auth:observe',
+  'auth:emit',
   'account:read',
   'http:post', 'http:fetch',
   'ui:observe', 'ui:toolbar', 'ui:app-top-banner', 'ui:email-banner', 'ui:email-footer',