import { NextResponse } from "next/server";
import { cookies } from "next/headers";
import { apiError } from "@/lib/api.ts";
import { SESSION_COOKIE, assertSameOrigin, destroySession, logAuthEvent, userForToken } from "@/lib/auth/session.ts";

export async function POST() {
  try {
    await assertSameOrigin();
    const jar = await cookies();
    const token = jar.get(SESSION_COOKIE)?.value;
    if (token) {
      const u = userForToken(token);
      destroySession(token);
      if (u) logAuthEvent("logout", { userId: u.id, username: u.username });
    }
    const res = NextResponse.json({ ok: true });
    res.cookies.delete(SESSION_COOKIE);
    return res;
  } catch (e) {
    return apiError(e);
  }
}