Add logout

tests/auth-api.test.ts

@@ -283,6 +283,36 @@ describe('GET /api/auth/me', () => {
     expect(db.firstCalls).toHaveLength(0);
   });
 
+  it('POST /api/auth/logout clears the shared session cookie outside local dev', async () => {
+    const db = new FakeAuthD1();
+    const env = makeEnv(db, {
+      PUBLIC_HOST: 'dev.heygo.cc',
+      PRIVATE_HOST: 'my.dev.heygo.cc',
+      APP_BASE_URL: 'https://dev.heygo.cc',
+      COOKIE_DOMAIN: '.heygo.cc',
+    });
+
+    const response = await fetchWorker('/api/auth/logout', env, { method: 'POST' });
+
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({ ok: true });
+    const setCookie = response.headers.get('set-cookie');
+    expect(setCookie).toContain(`${AUTH_SESSION_COOKIE_NAME}=;`);
+    expect(setCookie).toContain('Expires=Thu, 01 Jan 1970 00:00:00 GMT');
+    expect(setCookie).toContain('Domain=.heygo.cc');
+    expect(setCookie).toContain('HttpOnly');
+    expect(response.headers.get('cache-control')).toBe('no-store');
+  });
+
+  it('rejects GET /api/auth/logout with 405', async () => {
+    const db = new FakeAuthD1();
+    const env = makeEnv(db);
+
+    const response = await fetchWorker('/api/auth/logout', env, { method: 'GET' });
+
+    expect(response.status).toBe(405);
+  });
+
   it('falls through (returns null) for non-matching paths so the worker 404s', async () => {
     const db = new FakeAuthD1();
     const env = makeEnv(db);