@stacksjs/defaults 0.70.363 → 0.70.365

package/app/Actions/Auth/LogoutAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth } from '@stacksjs/auth'
+import { Auth, clearAuthCookie } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
 
 export default new Action({
@@ -7,10 +7,17 @@ export default new Action({
   description: 'Logout from the application',
   method: 'POST',
   async handle() {
+    // `Auth.logout()` resolves the token from the Authorization header or the
+    // auth cookie, so this revokes the session either way.
     await Auth.logout()
 
-    return response.json({
-      message: 'Successfully logged out',
-    })
+    // Clearing is separate from revoking, and both are needed. Revoking alone
+    // leaves the browser sending a dead cookie on every request; clearing alone
+    // leaves a copied cookie valid for the token's whole lifetime, which would
+    // make "log out on a shared computer" mean only "hide the key".
+    return response.json(
+      { message: 'Successfully logged out' },
+      { headers: { 'Set-Cookie': clearAuthCookie() } },
+    )
   },
 })

package/app/Actions/Auth/LogoutAllAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { revokeAllTokens, sessionDestroyAll } from '@stacksjs/auth'
+import { clearAuthCookie, revokeAllTokens, sessionDestroyAll } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
 
 export default new Action({
@@ -21,8 +21,12 @@ export default new Action({
     await revokeAllTokens(Number(user.id))
     await sessionDestroyAll(Number(user.id))
 
-    return response.json({
-      message: 'Successfully logged out from all devices',
-    })
+    // This device included: its cookie carries one of the tokens just revoked,
+    // so leaving it in place means the browser keeps presenting a dead
+    // credential on every request.
+    return response.json(
+      { message: 'Successfully logged out from all devices' },
+      { headers: { 'Set-Cookie': clearAuthCookie() } },
+    )
   },
 })

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.70.363",
+  "version": "0.70.365",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.363",
+  "version": "0.70.365",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",