alisaza
e1eaf5eff5
Extract admin dashboard from ghabilee-frontend2 into a dedicated Next.js app for backoffice.ghabilee.ir (no SEO indexing / Clarity).
27 lines
992 B
TypeScript
27 lines
992 B
TypeScript
import { NextResponse } from 'next/server'
|
|
|
|
import { CLEAR_REFRESH_SESSION_HEADER, expiredRefreshSessionSetCookieHeaders } from '@/lib/refreshSessionCookie'
|
|
|
|
export const dynamic = 'force-dynamic'
|
|
|
|
/**
|
|
* Browser-side cookie cleanup only: expires Nest httpOnly refresh cookies on this origin.
|
|
* Does not revoke `refresh_tokens` in Nest — an already-exfiltrated token stays valid until
|
|
* expiry unless retried `POST /auth/logout` succeeded. Complementary to `attemptServerLogout`.
|
|
* Requires `x-ghabilee-logout` so a cross-site form POST cannot CSRF-clear cookies.
|
|
*/
|
|
export function POST(request: Request) {
|
|
if (request.headers.get(CLEAR_REFRESH_SESSION_HEADER) !== '1') {
|
|
return NextResponse.json({ ok: false }, { status: 403 })
|
|
}
|
|
|
|
const response = NextResponse.json({ ok: true })
|
|
|
|
response.headers.set('Cache-Control', 'no-store')
|
|
for (const cookie of expiredRefreshSessionSetCookieHeaders()) {
|
|
response.headers.append('Set-Cookie', cookie)
|
|
}
|
|
|
|
return response
|
|
}
|