From 766b7586fde4f1321e2c23428001c2dd67576dd4 Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rosehogenson@posteo.net>
Date: Thu, 24 Sep 2026 16:44:50 -0700
Subject: Add a way to log out

---
 roseh.moe.go | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

(limited to 'roseh.moe.go')

diff --git a/roseh.moe.go b/roseh.moe.go
index 54ce6f4..53deb02 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -692,13 +692,10 @@ func makeToken() string {
 	return base64.RawURLEncoding.EncodeToString(append(t, mac(t, "auth")...))
 }
 
-const cookieExpiration = 7 * 24 * time.Hour
-const authCookieName = "a"
-
-func attachCookie(w http.ResponseWriter) {
-	http.SetCookie(w, &http.Cookie{
+func makeCookie(val string) *http.Cookie {
+	return &http.Cookie{
 		Name:        authCookieName,
-		Value:       makeToken(),
+		Value:       val,
 		Path:        "/",
 		Domain:      selfURL.Hostname(),
 		Expires:     time.Now().Add(cookieExpiration),
@@ -706,7 +703,14 @@ func attachCookie(w http.ResponseWriter) {
 		HttpOnly:    true,
 		SameSite:    http.SameSiteStrictMode,
 		Partitioned: true,
-	})
+	}
+}
+
+const cookieExpiration = 7 * 24 * time.Hour
+const authCookieName = "a"
+
+func attachCookie(w http.ResponseWriter) {
+	http.SetCookie(w, makeCookie(makeToken()))
 }
 
 func cookieAuth(w http.ResponseWriter, r *http.Request) bool {
@@ -819,6 +823,11 @@ func login(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, redirect, http.StatusSeeOther)
 }
 
+func logout(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, makeCookie("!"))
+	io.WriteString(w, "logged out\n")
+}
+
 var (
 	//go:embed templates/note.html.template
 	notepadString   string
@@ -1131,6 +1140,7 @@ func main() {
 	mux.HandleFunc("GET /wormhole/{hole}", wormholeDownload)
 	mux.HandleFunc("GET /login", serveLogin)
 	mux.HandleFunc("POST /login", login)
+	mux.Handle("GET /logout", &authHandler{h: http.HandlerFunc(logout), noRedirect: true})
 	mux.Handle("GET /notepad", &authHandler{h: http.HandlerFunc(notepad)})
 	mux.Handle("POST /notepad", &authHandler{h: http.HandlerFunc(autosave), noRedirect: true})
 	mux.HandleFunc("GET /cmd/{$}", cmdIndex)
-- 
cgit v1.3.1