package API::Command::Logout;
use strict;
use warnings;

use Apache2::Const qw(OK FORBIDDEN HTTP_OK HTTP_UNAUTHORIZED HTTP_NOT_FOUND HTTP_NOT_IMPLEMENTED);

use lib '/app/tools/api/lib';
use API::Response;
use API::DB::Item::PortalSession;

use base 'API::Command';

sub area { return "user"; }
sub cmd  { return "logout"; }

sub execute {
    my ($self) = @_;

    my $response = $self->SUPER::execute();
    return $response if ($response);

    my $userID = $self->{userID};    # derived from session (see SUPER::execute)

    if ($userID) {
        API::DB::Item::PortalSession->RemoveOldSessions($userID);
        API::Session->DelCookie( (API::Session::CURRENT_USER_COOKIE, 'userId', 'RS_USER') );
    }

    # Even if they were already logged out, we should just play nice here.
    return $self->createResponse(
        status => HTTP_OK,
        data   => { msg => "logged out" }
    );
}

1;