sdyl405w4: Remove the sign-out feature and the Minnect revoke call

src/app/api/session/route.ts

@@ -1,13 +1,14 @@
 import { NextResponse, type NextRequest } from "next/server";
 import { loginToMinnect, LoginError } from "@/lib/minnect";
 import { createSession, getSession } from "@/lib/session-store";
-import { endSession } from "@/lib/session-refresh";
 import { SESSION_COOKIE, sessionCookieOptions } from "@/lib/cookie";
 
 // This route holds the session on the server. The browser talks only to this
 // app; Minnect tokens never leave the server (ADR-001).
 //
-// POST signs in, GET says who the person is, DELETE signs out (revoke + clear).
+// POST signs in, GET says who the person is. There is no sign-out: the session ends
+// when the server restarts or the cookie is cleared, and Minnect's revoke endpoint
+// is never called (the refresh token is shared across the person's devices).
 // The reusable token-refresh logic lives in session-refresh.ts for the feed
 // route (a later task) to call before it uses a token.
 
@@ -91,21 +92,3 @@ export async function GET(req: NextRequest) {
     feedUserId: session.person.feedUserId ?? null,
   });
 }
-
-/**
- * DELETE /api/session
- * Sign out: revoke the refresh token at Minnect (best-effort), delete the
- * server session, and clear the cookie. Always returns 200: sign-out succeeds
- * even when revoke errors. After this, the session is gone, so every
- * token-requiring route (and GET /api/session) returns 401 { error: "sign_in" }.
- */
-export async function DELETE(req: NextRequest) {
-  const sessionId = req.cookies.get(SESSION_COOKIE)?.value;
-
-  await endSession(sessionId);
-
-  const res = NextResponse.json({ ok: true });
-  // Expire the cookie with the same attributes it was set with.
-  res.cookies.set(SESSION_COOKIE, "", { ...sessionCookieOptions(), maxAge: 0 });
-  return res;
-}

src/components/App.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useEffect, useState } from "react";
-import { loadSession, signOut, type Person } from "@/lib/auth-client";
+import { loadSession, type Person } from "@/lib/auth-client";
 import { SignInForm } from "./SignInForm";
 import { Logo } from "./Logo";
 import { Feed } from "./Feed";
@@ -10,7 +10,6 @@ type State = { kind: "loading" } | { kind: "out" } | { kind: "in"; person: Perso
 
 export function App() {
   const [state, setState] = useState<State>({ kind: "loading" });
-  const [signingOut, setSigningOut] = useState(false);
 
   useEffect(() => {
     let live = true;
@@ -22,14 +21,6 @@ export function App() {
     };
   }, []);
 
-  async function handleSignOut() {
-    if (signingOut) return;
-    setSigningOut(true);
-    await signOut();
-    setSigningOut(false);
-    setState({ kind: "out" });
-  }
-
   if (state.kind === "loading") {
     return (
       <main className="center">
@@ -54,9 +45,6 @@ export function App() {
           <strong>{state.person.name}</strong>
           <span>{state.person.email}</span>
         </div>
-        <button type="button" onClick={handleSignOut} disabled={signingOut}>
-          {signingOut ? "Signing out..." : "Sign out"}
-        </button>
       </header>
       <Feed feedUserId={state.person.feedUserId} onSignedOut={() => setState({ kind: "out" })} />
     </main>

src/lib/auth-client.ts

@@ -31,19 +31,6 @@ export async function loadSession(f: Fetch = fetch): Promise<Person | null> {
   }
 }
 
-/**
- * DELETE /api/session: sign out. Resolves once the server has cleared the
- * session and cookie. A failed request still returns the UI to signed-out,
- * because the local session view is no longer trustworthy.
- */
-export async function signOut(f: Fetch = fetch): Promise<void> {
-  try {
-    await f("/api/session", { method: "DELETE", credentials: "same-origin", cache: "no-store" });
-  } catch {
-    // Ignore: the caller returns to the sign-in screen regardless.
-  }
-}
-
 export type SignInResult = { ok: true; person: Person } | { ok: false; message: string };
 
 /** POST /api/session. A 401 is always the one wrong-credentials message. */

src/lib/minnect.ts

@@ -196,27 +196,6 @@ export async function refreshProfileTokens(
   };
 }
 
-/**
- * Revoke a profile refresh token on sign-out.
- * `POST /api/v4/auth/revoke-token` with `{ refreshToken }`. Best-effort: any
- * error (network or non-200) is swallowed so that sign-out still succeeds.
- */
-export async function revokeToken(
-  refreshToken: string,
-  options: LoginOptions = {},
-): Promise<void> {
-  const doFetch = options.fetchImpl ?? fetch;
-  try {
-    await doFetch(`${PROFILES_BASE_URL}/api/v4/auth/revoke-token`, {
-      method: "POST",
-      headers: jsonHeaders(),
-      body: JSON.stringify({ refreshToken }),
-    });
-  } catch {
-    // Sign-out still succeeds if revoke fails (spec, "Sign out").
-  }
-}
-
 /** `GET /api/v1/auth/me` on the feed host. Returns data.id, or null on any failure. */
 async function fetchFeedUserId(feedToken: string, doFetch: typeof fetch): Promise<string | null> {
   try {

src/lib/session-refresh.ts

@@ -4,12 +4,11 @@ import {
   updateSession,
   type SessionData,
 } from "./session-store";
-import { exchangeFeedToken, refreshProfileTokens, revokeToken } from "./minnect";
+import { exchangeFeedToken, refreshProfileTokens } from "./minnect";
 
 // Reusable server-side session logic the route handlers share. The feed route
 // (a later task) calls `ensureFreshSession` before using a token, and
-// `refreshSession` once after a feed call returns 401. Sign-out uses
-// `endSession`. Minnect tokens never leave the server; nothing here is logged.
+// `refreshSession` once after a feed call returns 401. Minnect tokens never leave the server; nothing here is logged.
 
 /** Refresh when a token expires within this window (spec: two minutes). */
 export const REFRESH_WINDOW_MS = 2 * 60 * 1000;
@@ -85,20 +84,3 @@ export async function ensureFreshSession(
   }
   return session;
 }
-
-/**
- * Sign-out. Revoke the refresh token (best-effort) and delete the server
- * session. Always resolves: a revoke error does not stop sign-out. The caller
- * clears the cookie.
- */
-export async function endSession(
-  sessionId: string | undefined,
-  options: Pick<RefreshOptions, "fetchImpl"> = {},
-): Promise<void> {
-  if (!sessionId) return;
-  const session = getSession(sessionId);
-  if (session) {
-    await revokeToken(session.profileRefreshToken, options);
-  }
-  deleteSession(sessionId);
-}