import { NextResponse } from "next/server";
import { logout } from "@/server/auth/login-service";
import { clearSessionCookie, readSessionCookie } from "@/server/auth/session-cookie";
import { jsonError } from "@/server/http/api-auth";
import { metaFromHeaders } from "@/server/http/request-meta";
import { isSameOriginRequest } from "@/server/http/same-origin";

export async function POST(request: Request): Promise<NextResponse> {
  if (!isSameOriginRequest(request)) return jsonError(403, "Origen no permitido");
  const token = await readSessionCookie();
  if (token) await logout(token, metaFromHeaders(request.headers));
  await clearSessionCookie();
  return NextResponse.json({ ok: true }, { headers: { "Cache-Control": "no-store" } });
}