Add logout button to docs page

[dcruzeneil2]

summary

• add a logout button beside the signed-in account details on /docs
• revoke the active database session and clear the browser session cookie
• reject cross-site logout requests and cover the UI and route behavior with tests

testing

• npx tsc --noEmit
• npm test
• npm run build
• npm run spec:check

---

Note

Medium Risk
Touches session revocation and cookie handling, but uses existing origin CSRF checks and is covered by focused route and UI tests.

Overview
Signed-in users on /docs get a log out control next to the account line (POST form to /logout), with light flex styling on the session header row.

POST /logout enforces originOk CSRF checks, revokes the active sessions row when a valid jh_sess token is present, always clears the session cookie via new clearSessionCookieHeader(), and redirects to /login. Vitest covers the route (revoke, stale cookie, cross-site 403) and the docs HTML includes the logout form.

^{Reviewed by Cursor Bugbot for commit 5438dfd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
justhtml	Ready	Preview	Aug 3, 2026 7:38pm