Function delete_session

nodedb/src/control/server/http/routes/auth_session.rs:65–87

`DELETE /v1/auth/session` — Invalidate a session handle. ```text DELETE /v1/auth/session Authorization: Bearer X-Session-Id: nds_... ``` The caller must present a valid bearer token. A session handle may only be invalidated by the authenticated caller — the identity is verified before any session state is read or mutated.

(
    ConnectInfo(peer): ConnectInfo<SocketAddr>,
    headers: HeaderMap,
    State(state): State<AppState>,
)

/// invalidated by the authenticated caller — the identity is verified before
/// any session state is read or mutated.
pub async fn delete_session(
    ConnectInfo(peer): ConnectInfo<SocketAddr>,
    headers: HeaderMap,
    State(state): State<AppState>,
) -> Result<impl IntoResponse, ApiError> {
    // Auth check must come first — return 401/403 before touching session state.
    let _identity = {
        let peer_str = peer.to_string();
        crate::control::server::http::auth::resolve_identity(&headers, &state, &peer_str)?
    };

    let handle = headers
        .get("x-session-id")
        .and_then(|v| v.to_str().ok())
        .ok_or_else(|| ApiError::BadRequest("missing X-Session-Id header".into()))?;

    let found = state.shared.session_handles.invalidate(handle);
    if !found {
        return Err(ApiError::BadRequest("session handle not found".into()));
    }

    Ok(axum::Json(HttpStatusOk::ok()))
}