From b131e78e90408e3a316605080b5c87b52fb97e3b Mon Sep 17 00:00:00 2001
From: KittenTM <aidenplayzroblox123@gmail.com>
Date: Wed, 11 Feb 2026 04:46:12 +0100
Subject: [PATCH] Add logging out

---
 main.py          |  2 ++
 routes/logout.py | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 routes/logout.py

diff --git a/main.py b/main.py
index c810f53..0116de3 100644
--- a/main.py
+++ b/main.py
@@ -4,6 +4,7 @@ from config import settings
 import uvicorn
 from fastapi.middleware.cors import CORSMiddleware
 from database import init_db
+from routes import logout
 
 app = FastAPI()
 
@@ -27,6 +28,7 @@ async def force_cors_on_errors(request: Request, call_next):
 
 app.include_router(sso.router, prefix="/api/v2/sso")
 app.include_router(user.router, prefix="/api/v1/users")
+app.include_router(logout.router, prefix="/api/v1")
 
 if __name__ == '__main__':
     uvicorn.run("main:app", host="0.0.0.0", port=settings.port, reload=True)
diff --git a/routes/logout.py b/routes/logout.py
new file mode 100644
index 0000000..9508024
--- /dev/null
+++ b/routes/logout.py
@@ -0,0 +1,48 @@
+from fastapi import APIRouter, Request, Form, Response, Depends
+from fastapi.responses import RedirectResponse
+from sqlalchemy.orm import Session as DBSession
+from database import SessionLocal, User, Session
+from config import settings, cipher
+from services import auth
+from typing import Optional
+import uuid
+
+router = APIRouter()
+
+def get_db():
+    db = SessionLocal()
+    try:
+        yield db
+    finally:
+        db.close()
+
+@router.post('/spfn/logout')
+async def logout(
+    request: Request,
+    frontend_origin: Optional[str] = Form(None),
+    db: DBSession = Depends(get_db)
+):
+    host = (frontend_origin or request.headers.get("referer") or "/").rstrip('/')
+    redirect_url = f"{host}/sign_in/"
+    
+    response = RedirectResponse(url=redirect_url, status_code=303)
+    session_id = request.cookies.get("session_id")
+
+    if session_id:
+        try:
+            db.query(Session).filter(Session.id == session_id).delete()
+            db.commit()
+            print(f"Session {session_id} deleted from database.")
+        except Exception as e:
+            print(f"Error deleting session: {e}")
+            db.rollback()
+
+    response.delete_cookie(
+        key="session_id",
+        path="/",
+        domain=None,
+        httponly=settings.cookie_httponly,
+        samesite="lax"
+    )
+
+    return response
\ No newline at end of file