Function postLogout

web/src/app/api/auth/cli/logout/_post.ts:30–113

({
  req,
  db,
  logger,
}: PostLogoutDeps)

})

export async function postLogout({
  req,
  db,
  logger,
}: PostLogoutDeps): Promise<NextResponse> {
  let body: unknown
  try {
    body = await req.json()
  } catch {
    return NextResponse.json({ error: 'Invalid request body' }, { status: 400 })
  }

  const parsed = reqSchema.safeParse(body)
  if (!parsed.success) {
    return NextResponse.json({ error: 'Invalid request body' }, { status: 400 })
  }

  const {
    authToken: bodyToken,
    userId,
    fingerprintId,
    fingerprintHash,
  } = parsed.data
  const authToken = extractApiKeyFromHeader(req) ?? bodyToken

  if (!authToken) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  try {
    const tokenSessions = await db.getSessionByToken(authToken, userId)
    const tokenValid = tokenSessions.length > 0
    if (!tokenValid) {
      return NextResponse.json({ success: true })
    }

    const fingerprintSessionsDeleted = await db.deleteSessionsByFingerprint(
      userId,
      fingerprintId,
    )
    const fingerprintMatchFound = fingerprintSessionsDeleted.length > 0

    // Always fetch fingerprint data for subsequent logic
    const fingerprintRows = await db.getFingerprintData(fingerprintId)
    const fingerprintData = fingerprintRows[0]

    if (fingerprintMatchFound) {
      // Also clean up orphaned web sessions (fingerprint_id = null) for this user
      await db.deleteOrphanedWebSessions(userId)
    } else if (fingerprintData?.created_at) {
      // Intermediate strategy: delete web sessions created around the same time as the fingerprint
      const timeWindowDeleted = await db.deleteWebSessionsInTimeWindow(
        userId,
        fingerprintData.created_at,
      )
      if (timeWindowDeleted.length === 0) {
        // Final fallback: delete all web sessions when time-window deletion finds nothing
        await db.deleteAllWebSessions(userId)