sam-react-prod/src/app/api/auth/logout/route.ts

import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

/**
 * Logout Proxy Route Handler
 *
 * Purpose:
 * - Call PHP backend logout API
 * - Clear HttpOnly cookie
 * - Ensure complete session cleanup
 */
export async function POST(request: NextRequest) {
  try {
    // Get access_token from HttpOnly cookie
    const accessToken = request.cookies.get('access_token')?.value;

    if (accessToken) {
      // Call PHP backend logout API
      try {
        await fetch(`${process.env.NEXT_PUBLIC_API_URL}/api/v1/logout`, {
          method: 'POST',
          headers: {
            'Content-Type': 'application/json',
            'Accept': 'application/json',
            'Authorization': `Bearer ${accessToken}`,
            'X-API-KEY': process.env.NEXT_PUBLIC_API_KEY || '',
          },
        });
        console.log('✅ Backend logout API called successfully');
      } catch (error) {
        console.warn('⚠️ Backend logout API failed (continuing with cookie deletion):', error);
      }
    }

    // Clear both HttpOnly cookies
    const clearAccessToken = [
      'access_token=',
      'HttpOnly',
      'Secure',
      'SameSite=Strict',
      'Path=/',
      'Max-Age=0',  // Delete immediately
    ].join('; ');

    const clearRefreshToken = [
      'refresh_token=',
      'HttpOnly',
      'Secure',
      'SameSite=Strict',
      'Path=/',
      'Max-Age=0',  // Delete immediately
    ].join('; ');

    console.log('✅ Logout complete - Access & Refresh tokens cleared');

    const response = NextResponse.json(
      { message: 'Logged out successfully' },
      { status: 200 }
    );

    response.headers.append('Set-Cookie', clearAccessToken);
    response.headers.append('Set-Cookie', clearRefreshToken);

    return response;

  } catch (error) {
    console.error('Logout proxy error:', error);
    return NextResponse.json(
      { error: 'Internal server error' },
      { status: 500 }
    );
  }
}