Dave
2594dead84
Add PocketBase login, first-sign-in password changes, account settings, and user activation, reactivation and deletion with self-removal guards. Protect application pages and APIs and keep private pages out of PWA caches. Resolve plant locations from site assignments and improve map controls, profit chart views, navigation and mobile table layouts. Validation: production build and TypeScript passed; 28 unit tests passed. Backend access integration tests and mobile verification are documented.
15 lines
725 B
TypeScript
15 lines
725 B
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { SESSION_COOKIE } from "@/lib/auth-policy";
|
|
|
|
// Logout only needs the local cookie, so it works even when PocketBase is down.
|
|
export async function POST(request: NextRequest) {
|
|
try {
|
|
const origin = request.headers.get("origin");
|
|
if (!origin || new URL(origin).host !== request.headers.get("host")) {
|
|
return NextResponse.json({ error: "Invalid request origin." }, { status: 403 });
|
|
}
|
|
} catch { return NextResponse.json({ error: "Invalid request origin." }, { status: 403 }); }
|
|
const response = NextResponse.json({ ok: true }, { headers: { "Cache-Control": "no-store" } });
|
|
response.cookies.delete(SESSION_COOKIE);
|
|
return response;
|
|
}
|