first commit

src/app/api/auth/sessions/[id]/route.ts

@@ -0,0 +1,20 @@
+import type {NextRequest} from 'next/server';
+import {authApi} from '@/services/api/authApi';
+import {proxyUpstream} from '@/shared/services/bff';
+
+export const dynamic = 'force-dynamic';
+
+/**
+ * DELETE /api/auth/sessions/{id} — sign one device out.
+ *
+ * Revoking the CURRENT session is allowed and signs this browser out — which is
+ * a legitimate thing to want and a surprising thing to do by accident, so the
+ * screen warns before calling it rather than this route refusing.
+ */
+export async function DELETE(
+  req: NextRequest,
+  {params}: {params: Promise<{id: string}>},
+) {
+  const {id} = await params;
+  return proxyUpstream(req, (token) => authApi.revokeSession(token, id));
+}