17 lines
738 B
TypeScript
17 lines
738 B
TypeScript
import { getGameDb, persist } from '@/lib/db/client';
|
|
import { SESSION_HEADER } from '@/lib/auth';
|
|
|
|
// v0.71.0 — POST /api/logout (no body). Deletes the session named by the X-Flight-Session
|
|
// header; idempotent — deleting an unknown or already-deleted session is still 200. A missing
|
|
// header has nothing to delete and gets 401 like every other unauthenticated request here.
|
|
|
|
export async function POST(req: Request) {
|
|
const sessionId = req.headers.get(SESSION_HEADER);
|
|
if (!sessionId) return Response.json({ error: 'authentication required' }, { status: 401 });
|
|
|
|
const inst = await getGameDb();
|
|
inst.raw.run('DELETE FROM sessions WHERE id = ?', [sessionId]);
|
|
await persist(inst);
|
|
return Response.json({ ok: true });
|
|
}
|