<?php
/**
 * Auth Logout Endpoint
 */

use App\Core\Database;
use App\Middleware\AuthMiddleware;

// 1. Check Authentication
$decoded = AuthMiddleware::check();
$userId = $decoded['user_id'];

// 2. Invalidate the refresh token.
// A mobile logout must only sign THIS device out - clearing the shared user
// column would drop every other device the user owns.
$db = Database::getInstance();
$deviceId = $decoded['device_id'] ?? null;

if ($deviceId) {
    $stmt = $db->prepare("
        UPDATE user_devices
        SET refresh_token_hash = NULL,
            refresh_expires_at = NULL,
            push_token = NULL,
            live_activity_token = NULL,
            is_trusted = 0
        WHERE user_id = ? AND device_fingerprint = ?
    ");
    $stmt->execute([$userId, $deviceId]);
} else {
    $stmt = $db->prepare("UPDATE users SET refresh_token_hash = NULL WHERE id = ?");
    $stmt->execute([$userId]);
}

json_success(null, 'تم تسجيل الخروج بنجاح');