add logout method

api/api.go

@@ -72,6 +72,12 @@ func Start() {
 		r.Post("/", Login)
 	})
 
+	r.Route("/logout", func(r chi.Router) {
+		r.Use(SessionAuthMiddleware)
+
+		r.Post("/", Logout)
+	})
+
 	r.Route("/register", func(r chi.Router) {
 		r.Post("/", NewUser)
 	})

api/auth.go

@@ -3,6 +3,7 @@ package api
 import (
 	"context"
 	"net/http"
+	"time"
 
 	"github.com/google/uuid"
 	"golang.org/x/crypto/bcrypt"
@@ -47,6 +48,29 @@ func Login(w http.ResponseWriter, r *http.Request) {
 	w.Write([]byte("Login successful"))
 }
 
+func Logout(w http.ResponseWriter, r *http.Request) {
+	cookie, err := r.Cookie("session_token")
+	if err != nil {
+		http.Error(w, "No session cookie found. You are already logged out", http.StatusBadRequest)
+		return
+	}
+
+	sessionToken := cookie.Value
+	username, valid := ValidateSession(sessionToken)
+	if !valid {
+		http.Error(w, "Session cookie could not be validated. You are already logged out", http.StatusBadRequest)
+		return
+	}
+
+	DeleteSession(sessionToken)
+
+	cookie.Expires = time.Now()
+	http.SetCookie(w, cookie)
+
+	w.Write([]byte(username + " has been logged out"))
+
+}
+
 var sessionStore = make(map[string]string)
 
 func CreateSession(username string) string {
@@ -60,6 +84,13 @@ func ValidateSession(sessionToken string) (string, bool) {
 	return username, exists
 }
 
+func DeleteSession(sessionToken string) (string, bool) {
+	username, exists := sessionStore[sessionToken]
+
+	delete(sessionStore, username)
+	return username, exists
+}
+
 type contextKey string
 
 const usernameKey contextKey = "username"

api/user.go

@@ -32,28 +32,29 @@ func UserCtx(next http.Handler) http.Handler {
 
 func Whoami(w http.ResponseWriter, r *http.Request) {
 	user, ok := r.Context().Value(userKey{}).(*User)
-	if !ok {
+	if !ok || user == nil {
-		w.Write([]byte("undefined"))
+		// Anonymous user
-		return
+		w.Write([]byte("anonymous"))
-	} else {
-		w.Write([]byte(user.Name))
 		return
 	}
+
+	w.Write([]byte(user.Name))
 }
 
 func LoginCtx(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var user *User
+		// Try to retrieve username from context
-		var err error
+		username, ok := r.Context().Value(usernameKey).(string)
-
+		if !ok || username == "" {
-		if username := r.Context().Value(usernameKey).(string); username != "" {
+			// No username provided, assume it's an anonymous user
-			user, err = dbGetUserByName(username)
+			next.ServeHTTP(w, r)
-		} else {
-			render.Render(w, r, ErrNotFound)
 			return
 		}
 
+		// Lookup user in the database
+		user, err := dbGetUserByName(username)
 		if err != nil {
+			// If user is specified and not found, throw an error
 			render.Render(w, r, ErrNotFound)
 			return
 		}