ThreadCount
344b1701dd
Uniform stock management for healthcare linen rooms. Licensed under the GNU AGPL v3.
24 lines
926 B
TypeScript
24 lines
926 B
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { sameOriginJson } from "@/lib/csrf";
|
|
import { clearStaffCookie, currentStaff } from "@/lib/staffsession";
|
|
import { clientIp } from "@/lib/ratelimit";
|
|
import { recordAuthEvent } from "@/lib/audit";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
export async function POST(req: NextRequest) {
|
|
const csrf = sameOriginJson(req);
|
|
if (csrf) return NextResponse.json({ error: csrf }, { status: 403 });
|
|
// Read the session before dropping it, so the trail can say who left. Signing out still succeeds
|
|
// when there was nothing to sign out of.
|
|
const sess = await currentStaff();
|
|
await clearStaffCookie();
|
|
if (sess) {
|
|
recordAuthEvent(
|
|
{ facilityId: sess.facilityId, userId: sess.staffId, userName: `${sess.first} ${sess.last}`.trim() || sess.email },
|
|
"staff:signout", clientIp(req.headers),
|
|
);
|
|
}
|
|
return NextResponse.json({ ok: true });
|
|
}
|