Update: 2026-07-30 02:27:45

app/modules_app/auth/logout.php

@@ -10,9 +10,26 @@ use App\Middleware\AuthMiddleware;
 $decoded = AuthMiddleware::check();
 $userId = $decoded['user_id'];
 
-// 2. Invalidate Refresh Token
+// 2. Invalidate the refresh token.
+// A mobile logout must only sign THIS device out - clearing the shared user
+// column would drop every other device the user owns.
 $db = Database::getInstance();
-$stmt = $db->prepare("UPDATE users SET refresh_token_hash = NULL WHERE id = ?");
-$stmt->execute([$userId]);
+$deviceId = $decoded['device_id'] ?? null;
+
+if ($deviceId) {
+    $stmt = $db->prepare("
+        UPDATE user_devices
+        SET refresh_token_hash = NULL,
+            refresh_expires_at = NULL,
+            push_token = NULL,
+            live_activity_token = NULL,
+            is_trusted = 0
+        WHERE user_id = ? AND device_fingerprint = ?
+    ");
+    $stmt->execute([$userId, $deviceId]);
+} else {
+    $stmt = $db->prepare("UPDATE users SET refresh_token_hash = NULL WHERE id = ?");
+    $stmt->execute([$userId]);
+}
 
 json_success(null, 'تم تسجيل الخروج بنجاح');