import {cookies} from 'next/headers';
import {
  SESSION_COOKIE,
  sessionCookieOptions,
} from '@/features/auth/services/sessionToken';

export const dynamic = 'force-dynamic';

/**
 * POST /api/auth/logout
 *
 * Ending a session is a server action, not a client one: only the server can
 * invalidate an httpOnly cookie. The client clearing its own state would leave
 * the credential intact and the next request still authenticated.
 *
 * Overwritten with an expired value rather than only `.delete()`-ed — some
 * proxies drop a bare deletion, and an empty value fails signature
 * verification anyway, so the session is dead by two independent routes.
 */
export async function POST(): Promise<Response> {
  const store = await cookies();
  store.set(SESSION_COOKIE, '', sessionCookieOptions(0));
  store.delete(SESSION_COOKIE);

  return Response.json(
    {data: {ok: true}, meta: {generatedAt: new Date().toISOString()}},
    {headers: {'cache-control': 'no-store'}},
  );
}
