{"version":3,"file":"logout.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/logout.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/logout\n *\n * Destroys the current session and logs the user out.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiSuccess, handleError } from \"#api/error.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\n\nexport const POST: APIRoute = async ({ session, url }) => {\n\ttry {\n\t\t// Destroy session\n\t\tif (session) {\n\t\t\tsession.destroy();\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (isSafeRedirect(redirect)) {\n\t\t\treturn new Response(null, {\n\t\t\t\tstatus: 302,\n\t\t\t\theaders: { Location: redirect },\n\t\t\t});\n\t\t}\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Logged out successfully\",\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Logout failed\", \"LOGOUT_ERROR\");\n\t}\n};\n\n// No GET handler — logout must be POST-only to prevent CSRF via link/img tags\n"],"mappings":";;;;;;AAQA,MAAa,YAAY;AAKzB,MAAa,OAAiB,OAAO,EAAE,SAAS,UAAU;AACzD,KAAI;AAEH,MAAI,QACH,SAAQ,SAAS;EAIlB,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,eAAe,SAAS,CAC3B,QAAO,IAAI,SAAS,MAAM;GACzB,QAAQ;GACR,SAAS,EAAE,UAAU,UAAU;GAC/B,CAAC;AAGH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,iBAAiB,eAAe"}