Log Out

Logging out has to happen on the server. If only the browser forgot the token, anyone who had copied it could still use it. So POST /logout deletes the request's token from the tokens table. After that the shop doesn't know that token, and it gets 401 everywhere.

To delete the token, the route needs the token itself, not just the user: a user who logged in twice has two tokens. So the lines that find it (the header first, then the session) move into a method of their own, currentToken(request), which both currentUser and the logout code call.

A DELETE runs with db.update, like an INSERT. For example, a route that empties a user's cart could run:

db.update("DELETE FROM cart_items WHERE user_id = ?", user.get("id"));

In the tests, Ana logs in twice: first on her phone (token <phone>, sent in the header), then in the browser (token <token>, also kept in its session). Logging out in the browser must not log the phone out:

GET /me  (cookie)  →  200  {"email": "ana@example.com", "id": 2, "role": "customer"}
POST /logout  (cookie)  →  200  {"message": "Logged out"}
GET /me  (cookie)  →  401  {"error": "Login required"}
GET /me  (Bearer <token>)  →  401  {"error": "Login required"}
GET /me  (Bearer <phone>)  →  200  {"email": "ana@example.com", "id": 2, "role": "customer"}
POST /logout  (Bearer <phone>)  →  200  {"message": "Logged out"}
GET /me  (Bearer <phone>)  →  401  {"error": "Login required"}

Your task: move the token-finding lines into currentToken(request), rewrite currentUser on top of it, and add POST /logout behind loginRequired. Its view, endSession, deletes this request's token, ends the session with request.getSession().invalidate() and answers {"message": "Logged out"}.

Assignment
Follow the Coding Tutorial to add a /logout route that really logs the user out.

Hint
Delete the token before you call invalidate(): currentToken reads the session. The view user -> endSession(request) doesn't use user, but loginRequired only calls it for a logged-in user.