sdyl405w4: Remove the sign-out feature and the Minnect revoke call

src/lib/auth-client.ts

@@ -31,19 +31,6 @@ export async function loadSession(f: Fetch = fetch): Promise<Person | null> {
   }
 }
 
-/**
- * DELETE /api/session: sign out. Resolves once the server has cleared the
- * session and cookie. A failed request still returns the UI to signed-out,
- * because the local session view is no longer trustworthy.
- */
-export async function signOut(f: Fetch = fetch): Promise<void> {
-  try {
-    await f("/api/session", { method: "DELETE", credentials: "same-origin", cache: "no-store" });
-  } catch {
-    // Ignore: the caller returns to the sign-in screen regardless.
-  }
-}
-
 export type SignInResult = { ok: true; person: Person } | { ok: false; message: string };
 
 /** POST /api/session. A 401 is always the one wrong-credentials message. */

src/lib/minnect.ts

@@ -196,27 +196,6 @@ export async function refreshProfileTokens(
   };
 }
 
-/**
- * Revoke a profile refresh token on sign-out.
- * `POST /api/v4/auth/revoke-token` with `{ refreshToken }`. Best-effort: any
- * error (network or non-200) is swallowed so that sign-out still succeeds.
- */
-export async function revokeToken(
-  refreshToken: string,
-  options: LoginOptions = {},
-): Promise<void> {
-  const doFetch = options.fetchImpl ?? fetch;
-  try {
-    await doFetch(`${PROFILES_BASE_URL}/api/v4/auth/revoke-token`, {
-      method: "POST",
-      headers: jsonHeaders(),
-      body: JSON.stringify({ refreshToken }),
-    });
-  } catch {
-    // Sign-out still succeeds if revoke fails (spec, "Sign out").
-  }
-}
-
 /** `GET /api/v1/auth/me` on the feed host. Returns data.id, or null on any failure. */
 async function fetchFeedUserId(feedToken: string, doFetch: typeof fetch): Promise<string | null> {
   try {

src/lib/session-refresh.ts

@@ -4,12 +4,11 @@ import {
   updateSession,
   type SessionData,
 } from "./session-store";
-import { exchangeFeedToken, refreshProfileTokens, revokeToken } from "./minnect";
+import { exchangeFeedToken, refreshProfileTokens } from "./minnect";
 
 // Reusable server-side session logic the route handlers share. The feed route
 // (a later task) calls `ensureFreshSession` before using a token, and
-// `refreshSession` once after a feed call returns 401. Sign-out uses
-// `endSession`. Minnect tokens never leave the server; nothing here is logged.
+// `refreshSession` once after a feed call returns 401. Minnect tokens never leave the server; nothing here is logged.
 
 /** Refresh when a token expires within this window (spec: two minutes). */
 export const REFRESH_WINDOW_MS = 2 * 60 * 1000;
@@ -85,20 +84,3 @@ export async function ensureFreshSession(
   }
   return session;
 }
-
-/**
- * Sign-out. Revoke the refresh token (best-effort) and delete the server
- * session. Always resolves: a revoke error does not stop sign-out. The caller
- * clears the cookie.
- */
-export async function endSession(
-  sessionId: string | undefined,
-  options: Pick<RefreshOptions, "fetchImpl"> = {},
-): Promise<void> {
-  if (!sessionId) return;
-  const session = getSession(sessionId);
-  if (session) {
-    await revokeToken(session.profileRefreshToken, options);
-  }
-  deleteSession(sessionId);
-}