pastilhasandClaude Opus 5
00997f5ff1
a user can mint a long-lived key for an app or a device instead of carrying a 30-day session, so multiple logins on the mobile apps are per-device revocable rather than one shared token. identity was being decided independently in userMiddleware and originScopeMiddleware, each verifying the token itself. teaching only one of them a new credential format is how those two stop agreeing, so both now call resolveAuthToken and neither knows what a bearer string is. verified: a member's key returns the same status as their jwt on every route tried, 403s included. a key carries its holder's full authority — not an escalation, it equals what the password could already do. scoping wants a scopes column, not a change here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
20 lines
819 B
TypeScript
20 lines
819 B
TypeScript
import type { Handler } from 'hono';
|
|
import type { AuthIdentity } from '@@/auth-token';
|
|
import { blacklistToken, cleanupExpiredTokens, clearVaultTokens } from 'officerdb';
|
|
|
|
export const signoutHandler: Handler = async (ctx) => {
|
|
const user = ctx.get('user') as AuthIdentity;
|
|
|
|
// Only a session has something to blacklist. An API key cannot be signed out — it is revoked by id in
|
|
// the keys API, which is the point of holding one instead of a session.
|
|
if (user.jti && user.exp) await blacklistToken(user.jti, user.exp);
|
|
|
|
// Drop the brokered vault session on logout (the protector key stays, so re-login is frictionless).
|
|
clearVaultTokens(user.id).catch(() => {});
|
|
|
|
// Opportunistic cleanup of expired tokens (non-blocking)
|
|
cleanupExpiredTokens().catch(() => {});
|
|
|
|
return ctx.json({ ok: true });
|
|
};
|