Method Logout

server-source-code/internal/handler/auth.go:1123–1136

Logout handles POST /auth/logout. Revokes the current session server-side and clears auth cookies on the client. The patchmon_device_trust cookie is intentionally preserved — "remember this device" must survive logout (that is the whole point of the feature). Trust is killed only by explicit revocat

(w http.ResponseWriter, r *http.Request)

// must survive logout (that is the whole point of the feature). Trust is killed only
// by explicit revocation, password change, TFA disable, or natural expiry.
func (h *AuthHandler) Logout(w http.ResponseWriter, r *http.Request) {
	userID, _ := r.Context().Value(middleware.UserIDKey).(string)
	sessionID, _ := r.Context().Value(middleware.SessionIDKey).(string)
	if h.log != nil {
		h.log.Debug("auth request", "method", r.Method, "path", r.URL.Path, "user_id", userID, "session_id", sessionID)
	}
	if sessionID != "" && userID != "" && h.sessions != nil {
		if err := h.sessions.RevokeByID(r.Context(), sessionID, userID); err != nil && h.log != nil {
			h.log.Error("logout revoke session failed", "user_id", userID, "session_id", sessionID, "error", err)
		}
	}
	clearAuthCookies(w, r)
	JSON(w, http.StatusOK, map[string]string{"message": "Logged out"})
}

// parseUserAgent extracts browser, OS, and device from user agent string.
func parseUserAgent(ua string) map[string]string {