import { NextResponse } from 'next/server';
import { destroySession } from '@/lib/auth/session';

export const dynamic = 'force-dynamic';

/** POST /api/auth/logout — used by the user menu and by API clients; GET is not allowed (CSRF). */
export async function POST(req: Request) {
  await destroySession();
  const url = new URL('/', req.url);
  return NextResponse.redirect(url, 303);
}