Logout

Sign out — either the active account, or every account (#1488 Phase 4).

Issue #93-2: Implement proper logout Issue #115: Cookie name changed from 'session_id' to 'kagura_session'

Once one session can hold several accounts, "log out" stops having a single meaning, and the two meanings are not interchangeable: ending the session when the user meant "sign out of this one" evicts accounts they never touched, and the reverse leaves them signed in when they asked not to be. scope names which one is intended.

The default is all, so every existing caller — and any older frontend still deployed during a rollout — keeps the exact behaviour it had before this route learned about accounts.

Carried as a query parameter rather than a body: apiClient.post() sends Content-Type: application/json with no body when called without one, and a body-typed parameter makes that pairing a parsing edge case for no gain. /auth/login?return_to= and /auth/google/login?add_account=1 in this same router already read state-changing input this way.

Deliberately NOT behind an auth dependency, as before. Logging out with an expired session must succeed rather than 401 — the user's intent is already satisfied, and a client that cannot log out of a dead session is stuck.

Returns session_ended because the caller's next move depends on it: False means another account is now active and the page should be reloaded as them; True means go to /login. Two paths reach True with scope="current" — the active account was the last one, and the removal could not be completed. The second is a deliberate fail-safe: refusing to remove one account is not a reason to leave the user signed in as it, so it degrades to a full sign-out, which always satisfies the request.

Example: POST /auth/logout Cookie: kagura_session=... Response: {"success": true, "scope": "all", "session_ended": true} Set-Cookie: kagura_session=; Max-Age=0