at-container-registry/pkg/appview/handlers/logout.go

package handlers

import (
	"net/http"

	"atcr.io/pkg/appview/db"
)

// LogoutHandler handles user logout from the web UI
// This only clears the current UI session cookie - it does NOT revoke OAuth tokens
// OAuth sessions remain intact so other browser tabs/devices stay logged in
type LogoutHandler struct {
	BaseUIHandler
}

func (h *LogoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	// Get UI session ID from cookie
	uiSessionID, hasSession := db.GetSessionID(r)
	if !hasSession {
		// No session to logout from, just redirect
		http.Redirect(w, r, "/", http.StatusFound)
		return
	}

	// Delete only this UI session and clear cookie
	// OAuth session remains intact for other browser tabs/devices
	h.SessionStore.Delete(uiSessionID)
	db.ClearCookie(w)

	// Redirect to home page
	http.Redirect(w, r, "/", http.StatusFound)
}