// GET + POST /api/auth/logout — 退出登录（清除 cookie + 302 跳转 /login）
import { NextResponse, type NextRequest } from 'next/server'

const cookieDomain = process.env.COOKIE_DOMAIN || '.tlyq.ai'

/** 从 OIDC_REDIRECT_URI 提取 site URL（不可信请求头，见 LESSONS-LEARNED #51） */
function getSiteUrl(): string {
  const redirectUri = process.env.OIDC_REDIRECT_URI || ''
  try { const u = new URL(redirectUri); return `${u.protocol}//${u.host}` } catch { /* fallthrough */ }
  return process.env.NEXT_PUBLIC_SITE_URL || 'http://localhost:6179'
}

/** 清除 tlyq_session + session cookie → 302 跳转 /login */
function logoutResponse(): NextResponse {
  const response = NextResponse.redirect(new URL('/login', getSiteUrl()))
  response.cookies.set('tlyq_session', '', {
    httpOnly: true, secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax', domain: cookieDomain, path: '/', maxAge: 0,
  })
  response.cookies.set('session', '', { path: '/', maxAge: 0 })
  return response
}

export async function GET() { return logoutResponse() }
export async function POST() { return logoutResponse() }