import { getGameDb, persist } from '@/lib/db/client';
import { SESSION_HEADER } from '@/lib/auth';

// v0.71.0 — POST /api/logout (no body). Deletes the session named by the X-Flight-Session
// header; idempotent — deleting an unknown or already-deleted session is still 200. A missing
// header has nothing to delete and gets 401 like every other unauthenticated request here.

export async function POST(req: Request) {
  const sessionId = req.headers.get(SESSION_HEADER);
  if (!sessionId) return Response.json({ error: 'authentication required' }, { status: 401 });

  const inst = await getGameDb();
  inst.raw.run('DELETE FROM sessions WHERE id = ?', [sessionId]);
  await persist(inst);
  return Response.json({ ok: true });
}