import {
    createClearedAdminSessionCookie,
    hasTrustedSameOrigin,
    setAdminAuthNoStore
} from "../../../../lib/admin/adminAuth";
import { respondError, respondSuccess } from "../../middleware/apiResponse";

export default async function handler(req, res) {
    setAdminAuthNoStore(res);
    res.setHeader("Allow", "POST");

    if (req.method !== "POST") {
        return respondError(res, {
            status: 405,
            code: "METHOD_NOT_ALLOWED",
            message: "Method not allowed"
        });
    }

    if (!hasTrustedSameOrigin(req)) {
        return respondError(res, {
            status: 403,
            code: "FORBIDDEN",
            message: "Request not permitted"
        });
    }

    res.setHeader("Set-Cookie", createClearedAdminSessionCookie());
    return respondSuccess(res, { authenticated: false });
}