<?php
/**
 * POST /auth/logout (with csrf) — ends this app's session AND the central Sassly session.
 * GET is refused on purpose: a GET logout can be triggered by any page (logout CSRF).
 */

declare(strict_types=1);

require __DIR__ . '/../../bootstrap.php'; // ADAPT: the app bootstrap (loads config + DB, includes lib/sassly-auth/sassly_auth_bootstrap.php)

sassly_session_start();

if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST' || !sassly_csrf_valid($_POST['csrf'] ?? null)) {
    sassly_render_page(400, 'Permintaan tidak valid', 'Gunakan tombol Keluar di aplikasi.', false, sassly_paths()['home']);
    exit;
}

$hint = is_string($_SESSION['sassly_denied_hint'] ?? null) ? $_SESSION['sassly_denied_hint'] : null;
$logoutUrl = sassly_auth()->prepareLogout(null, $hint);

$_SESSION = [];
$p = session_get_cookie_params();
setcookie(session_name(), '', [
    'expires' => time() - 3600,
    'path' => $p['path'],
    'domain' => $p['domain'],
    'secure' => $p['secure'],
    'httponly' => $p['httponly'],
    'samesite' => $p['samesite'] !== '' ? $p['samesite'] : 'Lax',
]);
session_destroy();

header('Cache-Control: no-store');
header('Location: ' . $logoutUrl, true, 302);
exit;