Builds the response every auth route ends with: the access token as the
plain-text body, and the refresh token in an httpOnly cookie (1-year expiry).
With no id, the body is empty and the cookie is cleared — a logout.
Exported so a custom login route (magic link, passkey, admin impersonation)
can end the same way the built-in ones do.
Parameters
Optionalid: number
The user to start a session for; omit to end one.
Returns NextResponse<unknown>
NextResponse with the token body and Set-Cookie header.
Builds the response every auth route ends with: the access token as the plain-text body, and the refresh token in an httpOnly cookie (1-year expiry). With no
id, the body is empty and the cookie is cleared — a logout.Exported so a custom login route (magic link, passkey, admin impersonation) can end the same way the built-in ones do.