0.2.40

server/internal/api/admin.go

@@ -33,6 +33,7 @@ func (s *Server) adminRoutes() http.Handler {
 	mux := http.NewServeMux()
 
 	mux.HandleFunc("GET /admin/{$}", s.handleAdminRoot)
+	mux.HandleFunc("POST /admin/logout", s.handleAdminLogout)
 	mux.HandleFunc("GET /admin/{page}", s.handleAdminPage)
 	// One person's own page. It is a path rather than a query string so it can be linked,
 	// bookmarked and returned to after a sign-in, like every other page here.
@@ -148,7 +149,7 @@ func (s *Server) adminAuth(h http.HandlerFunc) http.Handler {
 			return
 		}
 		if browser && operatorPresent(r) {
-			s.renewInstallerSession(w, r)
+			s.renewAdminSession(w, r)
 		}
 		h(w, r)
 	})
@@ -213,7 +214,7 @@ func (s *Server) serveAdminPage(w http.ResponseWriter, r *http.Request, page, ne
 		return
 	}
 	// Opening a page is somebody at the keyboard, so it starts the clock again.
-	s.renewInstallerSession(w, r)
+	s.renewAdminSession(w, r)
 	secure := r.TLS != nil || strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https")
 	http.SetCookie(w, &http.Cookie{
 		Name:     adminCookieName,
@@ -230,6 +231,24 @@ func (s *Server) serveAdminPage(w http.ResponseWriter, r *http.Request, page, ne
 	_, _ = w.Write(body)
 }
 
+func (s *Server) handleAdminLogout(w http.ResponseWriter, r *http.Request) {
+	if s.cfg.AdminToken == "" {
+		http.NotFound(w, r)
+		return
+	}
+	s.clearInstallerCookie(w)
+	secure := r.TLS != nil || strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https")
+	http.SetCookie(w, &http.Cookie{
+		Name:     adminCookieName,
+		Path:     "/admin",
+		MaxAge:   -1,
+		HttpOnly: true,
+		Secure:   secure,
+		SameSite: http.SameSiteStrictMode,
+	})
+	http.Redirect(w, r, "/admin/", http.StatusSeeOther)
+}
+
 type adminStatus struct {
 	// ServerVersion is what the page's footer reports. An operator reading the live log
 	// needs to know which build wrote it, and the page is the one place that is asked.