Retry logout event delivery briefly for racing client connections

When a user has multiple tabs open and one triggers logout while another
is still establishing its SSE connection, the previous SendMessageBlocking
would silently drop the event because no messenger was registered yet.

Add SendMessageBlockingWithRetry which polls up to a deadline for a
messenger to appear, and use it from SignOut with a 500ms budget.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>

Author: silverwind

modules/eventsource/manager.go

@@ -5,6 +5,7 @@ package eventsource
 
 import (
 	"sync"
+	"time"
 )
 
 // Manager manages the eventsource Messengers
@@ -87,3 +88,23 @@ func (m *Manager) SendMessageBlocking(uid int64, message *Event) {
 		messenger.SendMessageBlocking(message)
 	}
 }
+
+// SendMessageBlockingWithRetry sends a message, retrying for up to retry duration
+// if no messenger is registered yet. Useful for events like logout where a client
+// tab may still be establishing its SSE connection when another tab triggers the event.
+func (m *Manager) SendMessageBlockingWithRetry(uid int64, message *Event, retry time.Duration) {
+	deadline := time.Now().Add(retry)
+	for {
+		m.mutex.Lock()
+		messenger, ok := m.messengers[uid]
+		m.mutex.Unlock()
+		if ok {
+			messenger.SendMessageBlocking(message)
+			return
+		}
+		if time.Now().After(deadline) {
+			return
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+}

routers/web/auth/auth.go

@@ -11,6 +11,7 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+	"time"
 
 	"code.gitea.io/gitea/models/auth"
 	"code.gitea.io/gitea/models/db"
@@ -471,10 +472,12 @@ func HandleSignOut(ctx *context.Context) {
 // SignOut sign out from login status
 func SignOut(ctx *context.Context) {
 	if ctx.Doer != nil {
-		eventsource.GetManager().SendMessageBlocking(ctx.Doer.ID, &eventsource.Event{
+		// Retry briefly in case another tab is still establishing its SSE connection
+		// when this logout fires — otherwise the event would be silently dropped.
+		eventsource.GetManager().SendMessageBlockingWithRetry(ctx.Doer.ID, &eventsource.Event{
 			Name: "logout",
 			Data: ctx.Session.ID(),
-		})
+		}, 500*time.Millisecond)
 	}
 
 	// prepare the sign-out URL before destroying the session