fix(backend): await session destroy before logout response

[LucasSantana-Dev]

Closes #1623

Description

Wraps `req.session.destroy()` in a Promise and awaits it before sending the logout response. This ensures the session is fully destroyed before the client receives the success response, preventing a race condition where rapid logout→login sequences could operate on a session that hasn't been fully destroyed yet.

If session.destroy() fails, the error is now properly rejected and handled by asyncHandler instead of being silently logged.

Testing

• All auth route tests pass (131 tests)
• Type checking passes with no errors

Changes Made

• Modified `/packages/backend/src/routes/auth.ts` logout handler to wrap `session.destroy()` callback in a Promise and await completion before sending the success response
• If destroy fails, the error is now properly rejected instead of silently logged

---

Summary by cubic

Ensure logout waits for the session to be fully destroyed before responding, preventing race conditions during rapid logout→login. Errors from req.session.destroy() now reject and flow to the error handler instead of being silently logged.

^{Written for commit 6d2c49e. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 15 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c6506cda-4d26-4eb0-be23-09e9053849b6

📥 Commits

Reviewing files that changed from the base of the PR and between a54c81f and 6d2c49e.

📒 Files selected for processing (1)

• packages/backend/src/routes/auth.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-1623-session-destroy-v2

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Failed to generate code suggestions for PR

[github-actions]

	Warnings
⚠️	User-facing change without a CHANGELOG.md update. Add a line under ## [Unreleased] if this should appear in release notes. (Or apply the skip-changelog label if this PR does not affect end users.)
⚠️	Branch fix-1623-session-destroy-v2 doesn't follow the standard prefix convention (feature/, fix/, refactor/, chore/, docs/, ci/, test/, release/).

Generated by 🚫 dangerJS against 6d2c49e

[cubic-dev-ai]

No issues found across 1 file

<sub>Auto-approved: Wraps session.destroy in a Promise and awaits it to prevent race conditions on logout.

Re-trigger cubic</sub>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
66.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud