api/manage-session.js

import { exchangeManageToken, manageCookieName } from "./manage-auth.js";

export default async function handler(req, res) {
  if (req.method === "DELETE") {
    res.setHeader("Set-Cookie", `${manageCookieName}=; Path=/; HttpOnly; SameSite=Strict; Secure; Max-Age=0`);
    return res.status(204).end();
  }
  if (req.method !== "POST") return res.status(405).json({ error: "POSTまたはDELETEのみ利用できます" });
  try {
    const assertion = await exchangeManageToken(req.body?.token);
    res.setHeader("Set-Cookie", `${manageCookieName}=${assertion}; Path=/; HttpOnly; SameSite=Strict; Secure; Max-Age=28800`);
    return res.status(200).json({ ok: true });
  } catch (error) { return res.status(error.status || 401).json({ error: error.message }); }
}