yarm6mesq: Refresh expired tokens and revoke on sign-out

src/app/api/session/route.ts

@@ -1,13 +1,15 @@
 import { NextResponse, type NextRequest } from "next/server";
 import { loginToMinnect, LoginError } from "@/lib/minnect";
 import { createSession, getSession } from "@/lib/session-store";
+import { endSession } from "@/lib/session-refresh";
 import { SESSION_COOKIE, sessionCookieOptions } from "@/lib/cookie";
 
 // This route holds the session on the server. The browser talks only to this
 // app; Minnect tokens never leave the server (ADR-001).
 //
-// This task implements POST (sign in) and GET (who am I). DELETE/revoke and
-// token refresh are separate, later tasks and are not implemented here.
+// POST signs in, GET says who the person is, DELETE signs out (revoke + clear).
+// The reusable token-refresh logic lives in session-refresh.ts for the feed
+// route (a later task) to call before it uses a token.
 
 export const runtime = "nodejs";
 
@@ -45,6 +47,7 @@ export async function POST(req: NextRequest) {
       profileAccessTokenExpiresAt: tokens.profileAccessTokenExpiresAt,
       profileRefreshToken: tokens.profileRefreshToken,
       feedAccessToken: tokens.feedAccessToken,
+      feedAccessTokenExpiresAt: tokens.feedAccessTokenExpiresAt,
       person,
       createdAt: Date.now(),
     });
@@ -87,3 +90,21 @@ export async function GET(req: NextRequest) {
     pictureUrl: session.person.pictureUrl,
   });
 }
+
+/**
+ * DELETE /api/session
+ * Sign out: revoke the refresh token at Minnect (best-effort), delete the
+ * server session, and clear the cookie. Always returns 200: sign-out succeeds
+ * even when revoke errors. After this, the session is gone, so every
+ * token-requiring route (and GET /api/session) returns 401 { error: "sign_in" }.
+ */
+export async function DELETE(req: NextRequest) {
+  const sessionId = req.cookies.get(SESSION_COOKIE)?.value;
+
+  await endSession(sessionId);
+
+  const res = NextResponse.json({ ok: true });
+  // Expire the cookie with the same attributes it was set with.
+  res.cookies.set(SESSION_COOKIE, "", { ...sessionCookieOptions(), maxAge: 0 });
+  return res;
+}