From 16493b4594d126847ced9ec50890f5fa049f1f2e Mon Sep 17 00:00:00 2001
From: TekH <h.tek@digitaldata.works>
Date: Fri, 29 May 2026 12:44:26 +0200
Subject: [PATCH] Add endpoints for envelope receiver logout functionality

Added two new endpoints to `AuthController`: `LogoutEnvelopeReceiver` for removing a specific per-envelope receiver cookie and `LogoutAllEnvelopeReceivers` for clearing all such cookies. Updated `DigitalData.Auth.Claims` package to version 1.0.3. Introduced new `using` directives to support the added functionality. Included XML documentation for the new endpoints to improve code clarity.
---
 .../Controllers/AuthController.cs             | 28 +++++++++++++++++++
 .../EnvelopeGenerator.API.csproj              |  2 +-
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/EnvelopeGenerator.API/Controllers/AuthController.cs b/EnvelopeGenerator.API/Controllers/AuthController.cs
index b20b134b..6a3500c9 100644
--- a/EnvelopeGenerator.API/Controllers/AuthController.cs
+++ b/EnvelopeGenerator.API/Controllers/AuthController.cs
@@ -1,3 +1,4 @@
+using DigitalData.Auth.Claims;
 using EnvelopeGenerator.API.Controllers.Interfaces;
 using EnvelopeGenerator.API.Models;
 using EnvelopeGenerator.Domain.Constants;
@@ -86,4 +87,31 @@ public partial class AuthController(IOptions<AuthTokenKeys> authTokenKeyOptions,
     [Authorize(Policy = AuthPolicy.Receiver)]
     [HttpGet("check/envelope/{envelopeKey}")]
     public IActionResult CheckEnvelopeReceiver([FromRoute] string envelopeKey) => Ok();
+
+    /// <summary>
+    /// Removes the per-envelope receiver cookie for the given envelope key.
+    /// </summary>
+    /// <param name="envelopeKey">The unique envelope key whose cookie should be deleted.</param>
+    /// <response code="200">Cookie successfully deleted.</response>
+    [ProducesResponseType(typeof(void), StatusCodes.Status200OK)]
+    [HttpPost("logout/envelope/{envelopeKey}")]
+    public IActionResult LogoutEnvelopeReceiver([FromRoute] string envelopeKey)
+    {
+        var cookieName = CookieNames.GetEnvelopeReceiverCookieName(authTokenKeys.Cookie, envelopeKey);
+        Response.Cookies.Delete(cookieName);
+        return Ok();
+    }
+
+    /// <summary>
+    /// Removes all per-envelope receiver cookies from the current request.
+    /// </summary>
+    /// <response code="200">All envelope receiver cookies successfully deleted.</response>
+    [ProducesResponseType(typeof(void), StatusCodes.Status200OK)]
+    [HttpPost("logout/envelope")]
+    public IActionResult LogoutAllEnvelopeReceivers()
+    {
+        foreach (var cookieName in Request.Cookies.Keys.Where(k => CookieNames.IsEnvelopeReceiverCookie(k, authTokenKeys.Cookie)))
+            Response.Cookies.Delete(cookieName);
+        return Ok();
+    }
 }
\ No newline at end of file
diff --git a/EnvelopeGenerator.API/EnvelopeGenerator.API.csproj b/EnvelopeGenerator.API/EnvelopeGenerator.API.csproj
index 8b037d24..14acf06c 100644
--- a/EnvelopeGenerator.API/EnvelopeGenerator.API.csproj
+++ b/EnvelopeGenerator.API/EnvelopeGenerator.API.csproj
@@ -30,7 +30,7 @@
 
   <ItemGroup>
     <PackageReference Include="AspNetCore.Scalar" Version="1.1.8" />
-    <PackageReference Include="DigitalData.Auth.Claims" Version="1.0.2" />
+    <PackageReference Include="DigitalData.Auth.Claims" Version="1.0.3" />
     <PackageReference Include="DigitalData.Auth.Client" Version="1.3.7" />
     <PackageReference Include="DigitalData.Core.API" Version="2.2.1" />
     <PackageReference Include="HtmlSanitizer" Version="9.0.892" />