新登录验证机制

src/app/api/logout/route.ts

@@ -1,17 +1,31 @@
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
+
+import { getAuthInfoFromCookie } from '@/lib/auth';
+import { revokeRefreshToken } from '@/lib/refresh-token';
 
 export const runtime = 'nodejs';
 
-export async function POST() {
+export async function POST(request: NextRequest) {
+  const authInfo = getAuthInfoFromCookie(request);
+
+  // 撤销当前设备的 Refresh Token
+  if (authInfo && authInfo.username && authInfo.tokenId) {
+    try {
+      await revokeRefreshToken(authInfo.username, authInfo.tokenId);
+    } catch (error) {
+      console.error('Failed to revoke refresh token:', error);
+    }
+  }
+
   const response = NextResponse.json({ ok: true });
 
   // 清除认证cookie
   response.cookies.set('auth', '', {
     path: '/',
     expires: new Date(0),
-    sameSite: 'lax', // 改为 lax 以支持 PWA
-    httpOnly: false, // PWA 需要客户端可访问
-    secure: false, // 根据协议自动设置
+    sameSite: 'lax',
+    httpOnly: false,
+    secure: false,
   });
 
   return response;