message: use auth middleware
diff: -import { Request, Response } from 'express'
  +import { Response } from 'express'
  import { asyncWrapper } from '@shared/helpers'
  -import { COOKIE_SECRET } from '@shared/config'
  +import Boom from '@hapi/boom'
  import { request } from '@shared/request'
  import {
  selectRefreshToken,
  @@ -8,32 +8,35 @@ import {
  deleteRefreshToken
  } from '@shared/queries'
  import { logoutSchema } from '@shared/validation'
  -import { AccountData } from '@shared/types'
  +import { AccountData, RequestExtended } from '@shared/types'
  interface HasuraData {
  auth_refresh_tokens: { account: AccountData }[]
  }
  -async function logout({ body, cookies, signedCookies, query }: Request, res: Response): Promise<unknown> {
  - // clear cookie
  +async function logout({ body, refresh_token }: RequestExtended, res: Response): Promise<unknown> {
  + console.log('in logout')
  + console.log({ refresh_token })
  +
  + if (!refresh_token || !refresh_token.value) {
  + throw Boom.unauthorized('Invalid or expired refresh token.')
  + }
  +
  + // clear cookies
  + if (refresh_token.type === 'cookie') {
  res.clearCookie('refresh_token')
  res.clearCookie('permission_variables')
  + }
  // should we delete all refresh tokens to this user or not
  const { all } = await logoutSchema.validateAsync(body)
  - let { refresh_token } = COOKIE_SECRET ? signedCookies : cookies
  -
  - if (!refresh_token) {
  - refresh_token = query.refresh_token
  - }
  -
  if (all) {
  // get user based on refresh token
  let hasura_data: HasuraData | null = null
  try {
  hasura_data = await request<HasuraData>(selectRefreshToken, {
  - refresh_token,
  + refresh_token: refresh_token.value,
  current_timestamp: new Date()
  })
  } catch (error) {
  @@ -58,7 +61,7 @@ async function logout({ body, cookies, signedCookies, query }: Request, res: Res
  // if only to delete single refresh token
  try {
  await request(deleteRefreshToken, {
  - refresh_token
  + refresh_token: refresh_token.value
  })
  } catch (error) {
  return res.status(204).send()
  