1import { NextResponse } from 'next/server';2import { destroySession } from '@/lib/auth/session';34export const dynamic = 'force-dynamic';56/** POST /api/auth/logout — used by the user menu and by API clients; GET is not allowed (CSRF). */7export async function POST(req: Request) {8 await destroySession();9 const url = new URL('/', req.url);10 return NextResponse.redirect(url, 303);11}12