2 files changed, 122 insertions, 0 deletions
diff --git a/src/login/handlers/logout/mod.rs b/src/login/handlers/logout/mod.rs
new file mode 100644
index 0000000..73efe73
--- /dev/null
+++ b/src/login/handlers/logout/mod.rs
@@ -0,0 +1,51 @@
+use axum::{
+    extract::{Json, State},
+    response::{IntoResponse, Response},
+};
+
+use crate::{
+    app::App,
+    clock::RequestedAt,
+    empty::Empty,
+    error::{Internal, Unauthorized},
+    token::{app, extract::IdentityCookie},
+};
+
+#[cfg(test)]
+mod test;
+
+pub async fn handler(
+    State(app): State<App>,
+    RequestedAt(now): RequestedAt,
+    identity: IdentityCookie,
+    Json(_): Json<Request>,
+) -> Result<(IdentityCookie, Empty), Error> {
+    if let Some(secret) = identity.secret() {
+        let identity = app.tokens().validate(&secret, &now).await?;
+        app.tokens().logout(&identity.token).await?;
+    }
+
+    let identity = identity.clear();
+    Ok((identity, Empty))
+}
+
+// This forces the only valid request to be `{}`, and not the infinite
+// variation allowed when there's no body extractor.
+#[derive(Default, serde::Deserialize)]
+pub struct Request {}
+
+#[derive(Debug, thiserror::Error)]
+#[error(transparent)]
+pub struct Error(#[from] pub app::ValidateError);
+
+impl IntoResponse for Error {
+    fn into_response(self) -> Response {
+        let Self(error) = self;
+        match error {
+            app::ValidateError::InvalidToken => Unauthorized.into_response(),
+            app::ValidateError::Name(_) | app::ValidateError::Database(_) => {
+                Internal::from(error).into_response()
+            }
+        }
+    }
+}
diff --git a/src/login/handlers/logout/test.rs b/src/login/handlers/logout/test.rs
new file mode 100644
index 0000000..e7b7dd4
--- /dev/null
+++ b/src/login/handlers/logout/test.rs
@@ -0,0 +1,71 @@
+use axum::extract::{Json, State};
+
+use crate::{
+    empty::Empty,
+    test::{fixtures, verify},
+    token::app,
+};
+
+#[tokio::test]
+async fn successful() {
+    // Set up the environment
+
+    let app = fixtures::scratch_app().await;
+    let now = fixtures::now();
+    let creds = fixtures::user::create_with_password(&app, &fixtures::now()).await;
+    let identity = fixtures::cookie::logged_in(&app, &creds, &now).await;
+
+    // Call the endpoint
+
+    let (response_identity, Empty) = super::handler(
+        State(app.clone()),
+        fixtures::now(),
+        identity.clone(),
+        Json::default(),
+    )
+    .await
+    .expect("logged out with a valid token");
+
+    // Verify the return value's basic structure
+    assert!(response_identity.secret().is_none());
+
+    // Verify the semantics
+    verify::identity::invalid(&app, &identity).await;
+}
+
+#[tokio::test]
+async fn no_identity() {
+    // Set up the environment
+
+    let app = fixtures::scratch_app().await;
+
+    // Call the endpoint
+
+    let identity = fixtures::cookie::not_logged_in();
+    let (identity, Empty) = super::handler(State(app), fixtures::now(), identity, Json::default())
+        .await
+        .expect("logged out with no token succeeds");
+
+    // Verify the return value's basic structure
+
+    assert!(identity.secret().is_none());
+}
+
+#[tokio::test]
+async fn invalid_token() {
+    // Set up the environment
+
+    let app = fixtures::scratch_app().await;
+
+    // Call the endpoint
+
+    let identity = fixtures::cookie::fictitious();
+    let super::Error(error) =
+        super::handler(State(app), fixtures::now(), identity, Json::default())
+            .await
+            .expect_err("logged out with an invalid token fails");
+
+    // Verify the return value's basic structure
+
+    assert!(matches!(error, app::ValidateError::InvalidToken));
+}