feat: add logout endpoint

1 files changed, 15 insertions, 0 deletions

diff --git a/app/controllers/sessions/controller_test.go b/app/controllers/sessions/controller_test.go
index 46c32fd..e325afc 100644
--- a/app/controllers/sessions/controller_test.go
+++ b/app/controllers/sessions/controller_test.go
@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"net/url"
 	"testing"
+	"time"
 
 	"github.com/oauth2-proxy/mockoidc"
 	"github.com/stretchr/testify/assert"
@@ -13,6 +14,7 @@ import (
 	"github.com/xlgmokha/x/pkg/x"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/oidc"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/test"
+	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/web/cookie"
 )
 
 func TestSessions(t *testing.T) {
@@ -131,4 +133,17 @@ func TestSessions(t *testing.T) {
 			})
 		})
 	})
+
+	t.Run("POST /session/destroy", func(t *testing.T) {
+		t.Run("clears the session cookie", func(t *testing.T) {
+			cookie := cookie.New("session", "value", time.Now().Add(5*time.Minute))
+			r, w := test.RequestResponse("POST", "/session/destroy", test.WithCookie(cookie))
+
+			mux.ServeHTTP(w, r)
+
+			require.Equal(t, http.StatusFound, w.Code)
+			assert.Equal(t, "/", w.Header().Get("Location"))
+			assert.Equal(t, "session=; Path=/; Domain=localhost; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=0; HttpOnly; Secure", w.Header().Get("Set-Cookie"))
+		})
+	})
 }