fix: skip citadel logout on disconnect when no SIWW session exists

[hieu-w]

Jira Link

Description

External wallets connected in connect-only mode never complete SIWW (Sign-In With Wallet), so no citadel access/refresh tokens are stored. On disconnect, clearWalletSession still called AuthSessionManager.logout(), which POSTs to /v1/auth/logout even with an empty body — producing a noisy 401 Unauthorized in the console.

This PR checks for access/refresh tokens before calling remote logout:

• Tokens present → call logout() as before (server session invalidated)
• No tokens → call clearSessionData() only (local cleanup, no API call)

Affected path: all external-wallet connectors that use BaseConnector.clearWalletSession (MetaMask, injected EVM, WalletConnect v2, etc.).

How has this been tested?

• Added unit test in packages/no-modal/test/baseConnector.test.ts asserting clearWalletSession skips logout() and calls clearSessionData() when no SIWW tokens exist
• Manually verified in wallet-services external-transfer flow (initialAuthenticationMode: "connect-only") — disconnect no longer logs citadel 401

Screenshots (if appropriate)

N/A — console-noise fix; no UI changes.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

• My code follows the code style of this project. (run lint)
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

---

Note

Low Risk
Small disconnect cleanup change: remote logout still runs when tokens exist, and local session data is still cleared. No auth-flow or token-issuance changes.

Overview
Stops connect-only disconnects from calling Citadel logout when there is no SIWW session, which previously produced noisy 401s.

clearWalletSession now reads access/refresh tokens first. If either exists it still logs out remotely; otherwise it only clears local session data. Adds a unit test covering the no-token path.

^{Reviewed by Cursor Bugbot for commit a47430c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web3auth-web	Ready	Preview	Aug 24, 2026 5:46am