Close unauthenticated /api/requests CRUD, and make the session cookie HttpOnly

app/Actions/Auth/LogoutAction.tsadded+31-0

Changes to app/Actions/Auth/LogoutAction.ts

		@@ -0,0 +1,31 @@
	1	+import { Action } from '@stacksjs/actions'
	2	+import { Auth } from '@stacksjs/auth'
	3	+import { withClearedSessionCookie } from '../../Support/sessionCookie'
	4	+
	5	+/**
	6	+ * Logout — app-local override of the framework default, which revoked the token
	7	+ * server-side but left the cookie in the browser for the SPA to clear.
	8	+ *
	9	+ * That split no longer works: with an `HttpOnly` cookie the SPA physically
	10	+ * cannot clear it, so the server has to. Without this the cookie would survive
	11	+ * logout and keep being sent — pointing at a revoked token, so requests would
	12	+ * fail closed rather than open, but the stale credential would linger in the
	13	+ * browser for its full 30-day lifetime.
	14	+ *
	15	+ * `Auth.logout()` revokes the underlying token, and it finds that token through
	16	+ * `requestToken()`, which falls back to the cookie — so this works for a
	17	+ * cookie-only client with no `Authorization` header.
	18	+ */
	19	+export default new Action({
	20	+ name: 'LogoutAction',
	21	+ description: 'Logout from the application',
	22	+ method: 'POST',
	23	+
	24	+ async handle() {
	25	+ await Auth.logout()
	26	+
	27	+ return withClearedSessionCookie({
	28	+ message: 'Successfully logged out',
	29	+ })
	30	+ },
	31	+})