@payez/next-mvp 4.8.8 → 4.8.9

package/dist/routes/auth/logout.d.ts

@@ -14,6 +14,9 @@
  * @since auth-ready-v2
  */
 import { NextRequest, NextResponse } from 'next/server';
+/** 4.8.9: answered (status 500) when the server-side session delete failed. The browser's cookies are cleared either way. */
+export declare const SESSION_NOT_ENDED_CODE = "SESSION_NOT_ENDED";
+export declare const SESSION_NOT_ENDED_MESSAGE = "You were signed out on this device, but we could not end your session on the server. Try signing out again.";
 /**
  * POST /api/auth/logout - Sign out and clean up session
  *

package/dist/routes/auth/logout.js

@@ -15,6 +15,7 @@
  * @since auth-ready-v2
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_NOT_ENDED_MESSAGE = exports.SESSION_NOT_ENDED_CODE = void 0;
 exports.POST = POST;
 const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
@@ -22,6 +23,9 @@ const session_store_1 = require("../../lib/session-store");
 const app_slug_1 = require("../../lib/app-slug");
 const site_logger_1 = require("../../lib/site-logger");
 const safe_error_response_1 = require("../../lib/safe-error-response");
+/** 4.8.9: answered (status 500) when the server-side session delete failed. The browser's cookies are cleared either way. */
+exports.SESSION_NOT_ENDED_CODE = 'SESSION_NOT_ENDED';
+exports.SESSION_NOT_ENDED_MESSAGE = 'You were signed out on this device, but we could not end your session on the server. Try signing out again.';
 /**
  * POST /api/auth/logout - Sign out and clean up session
  *
@@ -41,6 +45,9 @@ async function POST(req) {
             });
         }
         const sessionId = session.session?.token;
+        // 4.8.9: a sign-out that did not end the session must not say it did. The delete below can fail (a faulting store); the
+        // cookies are still cleared, but the answer is then a typed failure instead of success:true.
+        let serverDeleteFailed = false;
         // Delete session from EVERY store — canonical + BA secondary (181922).
         // Canonical-only deletion let the ba: record resurrect the session.
         if (sessionId) {
@@ -49,7 +56,8 @@ async function POST(req) {
                 console.info('[LOGOUT_ROUTE] Session deleted from store');
             }
             catch (error) {
-                console.warn('[LOGOUT_ROUTE] Failed to delete session:', error);
+                serverDeleteFailed = true;
+                console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', error);
             }
         }
         // Log logout event (fire-and-forget)
@@ -65,10 +73,12 @@ async function POST(req) {
             });
         }
         // Build response that clears session cookies
-        const response = server_1.NextResponse.json({
-            success: true,
-            message: 'Logged out successfully'
-        });
+        const response = serverDeleteFailed
+            ? server_1.NextResponse.json({ success: false, code: exports.SESSION_NOT_ENDED_CODE, message: exports.SESSION_NOT_ENDED_MESSAGE }, { status: 500 })
+            : server_1.NextResponse.json({
+                success: true,
+                message: 'Logged out successfully'
+            });
         // Clear NextAuth session cookies (using app-slug prefixed names)
         const cookieNames = [
             (0, app_slug_1.getSessionCookieName)(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.8.8",
+  "version": "4.8.9",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/routes/auth/logout.ts

@@ -27,6 +27,10 @@ import {
 import { siteEvents, getClientIp } from '../../lib/site-logger';
 import { logExceptionWithCorrelation } from '../../lib/safe-error-response';
 
+/** 4.8.9: answered (status 500) when the server-side session delete failed. The browser's cookies are cleared either way. */
+export const SESSION_NOT_ENDED_CODE = 'SESSION_NOT_ENDED';
+export const SESSION_NOT_ENDED_MESSAGE = 'You were signed out on this device, but we could not end your session on the server. Try signing out again.';
+
 /**
  * POST /api/auth/logout - Sign out and clean up session
  *
@@ -48,6 +52,9 @@ export async function POST(req: NextRequest) {
     }
 
     const sessionId = session.session?.token;
+    // 4.8.9: a sign-out that did not end the session must not say it did. The delete below can fail (a faulting store); the
+    // cookies are still cleared, but the answer is then a typed failure instead of success:true.
+    let serverDeleteFailed = false;
 
     // Delete session from EVERY store — canonical + BA secondary (181922).
     // Canonical-only deletion let the ba: record resurrect the session.
@@ -56,7 +63,8 @@ export async function POST(req: NextRequest) {
         await deleteSessionEverywhere(sessionId);
         console.info('[LOGOUT_ROUTE] Session deleted from store');
       } catch (error) {
-        console.warn('[LOGOUT_ROUTE] Failed to delete session:', error);
+        serverDeleteFailed = true;
+        console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', error);
       }
     }
 
@@ -74,10 +82,12 @@ export async function POST(req: NextRequest) {
     }
 
     // Build response that clears session cookies
-    const response = NextResponse.json({
-      success: true,
-      message: 'Logged out successfully'
-    });
+    const response = serverDeleteFailed
+      ? NextResponse.json({ success: false, code: SESSION_NOT_ENDED_CODE, message: SESSION_NOT_ENDED_MESSAGE }, { status: 500 })
+      : NextResponse.json({
+          success: true,
+          message: 'Logged out successfully'
+        });
 
     // Clear NextAuth session cookies (using app-slug prefixed names)
     const cookieNames = [