v0.71.0: admin panel — users table, login/sessions, generic DB CRUD modal

app/api/logout/route.ts

@@ -0,0 +1,16 @@
+import { getGameDb, persist } from '@/lib/db/client';
+import { SESSION_HEADER } from '@/lib/auth';
+
+// v0.71.0 — POST /api/logout (no body). Deletes the session named by the X-Flight-Session
+// header; idempotent — deleting an unknown or already-deleted session is still 200. A missing
+// header has nothing to delete and gets 401 like every other unauthenticated request here.
+
+export async function POST(req: Request) {
+  const sessionId = req.headers.get(SESSION_HEADER);
+  if (!sessionId) return Response.json({ error: 'authentication required' }, { status: 401 });
+
+  const inst = await getGameDb();
+  inst.raw.run('DELETE FROM sessions WHERE id = ?', [sessionId]);
+  await persist(inst);
+  return Response.json({ ok: true });
+}