README — POST /api/admin/auth/sign-out
POST /api/admin/auth/sign-out
Caller and authorization
Request contract
| Location | Name | Required | Meaning |
|---|---|---|---|
| header | X-Admin-CSRF | Yes | Session-bound token from the staff page; not a developer credential. |
Response and failures
{error:{code,message}} for CloudError failures, attaches Request-Id, and disables caching. Handle 401 by signing in; show role refusal for 403 forbidden, reauthenticate only for step_up_required, and collect a reason for 400 reason_required. A CSRF failure needs a current page/session token, not blind retries. Operation-specific 404/409/413/422/502/503 errors retain their status. Honor Retry-After on 429.Implementation contract
/** POST /api/admin/auth/sign-out: ends this session here and at Cognito (its refresh token), clears the cookie. */
export const POST = adminRoute(null, async (_request, ctx) => {
const revoked = await revokeSession(ctx.sessionId, ctx.admin.sub);
await revokeRefreshToken(revoked?.cognitoRefreshToken);
await authAudit({ action: "admin.sign_out", outcome: "ok", actorSub: ctx.admin.sub, role: ctx.admin.role, sessionId: ctx.sessionId, requestId: ctx.requestId, targetId: ctx.sessionId });
const response = new NextResponse(null, { status: 204 });
clearSessionCookie(response.cookies);
return response;
});Modified at 2026-10-26 13:41:16