import type { Handler } from 'hono';
import type { AuthIdentity } from '@@/auth-token';
import { blacklistToken, cleanupExpiredTokens } from 'officerdb';
import { emitAccountLifecycle } from '@@/account-lifecycle';

export const signoutHandler: Handler = async (ctx) => {
  const user = ctx.get('user') as AuthIdentity;

  // Only a session has something to blacklist. An API key cannot be signed out — it is revoked by id in
  // the keys API, which is the point of holding one instead of a session.
  if (user.jti && user.exp) await blacklistToken(user.jti, user.exp);

  // Tell whatever holds per-account session state that this one ended. The mildest of the three levels:
  // a listener should drop live sessions and keep whatever makes signing back in painless.
  emitAccountLifecycle(user.id, 'signout');

  // Opportunistic cleanup of expired tokens (non-blocking)
  cleanupExpiredTokens().catch(() => {});

  return ctx.json({ ok: true });
};