From cb4a103e0b59519933b1ccbd0d8897d3c7238273 Mon Sep 17 00:00:00 2001
From: haturatu <taro@eyes4you.org>
Date: Mon, 13 Oct 2025 02:25:46 +0900
Subject: ref: refactor

---
 handlers/auth_logout.go | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 handlers/auth_logout.go

(limited to 'handlers/auth_logout.go')

diff --git a/handlers/auth_logout.go b/handlers/auth_logout.go
new file mode 100644
index 0000000..d008a81
--- /dev/null
+++ b/handlers/auth_logout.go
@@ -0,0 +1,41 @@
+package handlers
+
+import (
+	"auth-proxy/config"
+	"auth-proxy/logging"
+	"auth-proxy/models"
+	"net/http"
+	"time"
+)
+
+// LogoutHandler invalidates the user's token by expiring the cookie.
+func LogoutHandler(w http.ResponseWriter, r *http.Request) {
+	ip := logging.GetClientIP(r)
+	cookie, err := r.Cookie("auth_token")
+	if err != nil {
+		// No cookie, nothing to do.
+		http.Redirect(w, r, config.Paths.Login, http.StatusFound)
+		return
+	}
+
+	err = models.DeleteAuthToken(cookie.Value)
+	if err != nil {
+		// Log the error but still proceed with logging the user out client-side.
+		logging.AppLog.Error("Failed to delete token on logout", "error", err, "ip", ip)
+	}
+
+	// Expire the cookie by setting its max age to a negative number.
+	http.SetCookie(w, &http.Cookie{
+		Name:     "auth_token",
+		Value:    "",
+		Path:     "/",
+		Expires:  time.Unix(0, 0),
+		MaxAge:   -1,
+		HttpOnly: true,
+		Secure:   r.TLS != nil,
+		SameSite: http.SameSiteLaxMode,
+	})
+
+	logging.SecurityLog.Info("LOGOUT SUCCESS", "ip", ip)
+	http.Redirect(w, r, config.Paths.Login, http.StatusFound)
+}
-- 
cgit v1.2.3