<?php
/**
 * POST /api/auth/logout
 *
 * Destroys current session + clears cookie.
 */

declare(strict_types=1);
require_once dirname(__DIR__, 2) . '/config/bootstrap.php';

$user = Session::current();
if ($user) {
    Csrf::validate();
    Logger::audit((int)$user['publisher_id'], 'logout');
}
Session::destroy();

if (str_contains((string)($_SERVER['HTTP_ACCEPT'] ?? ''), 'application/json')
    || $_SERVER['REQUEST_METHOD'] === 'POST') {
    jsonSuccess('Logged out.', ['redirect' => '/login']);
}
redirect('/login');
