36 lines
978 B
PHP
36 lines
978 B
PHP
<?php
|
|
/**
|
|
* Auth Logout Endpoint
|
|
*/
|
|
|
|
use App\Core\Database;
|
|
use App\Middleware\AuthMiddleware;
|
|
|
|
// 1. Check Authentication
|
|
$decoded = AuthMiddleware::check();
|
|
$userId = $decoded['user_id'];
|
|
|
|
// 2. Invalidate the refresh token.
|
|
// A mobile logout must only sign THIS device out - clearing the shared user
|
|
// column would drop every other device the user owns.
|
|
$db = Database::getInstance();
|
|
$deviceId = $decoded['device_id'] ?? null;
|
|
|
|
if ($deviceId) {
|
|
$stmt = $db->prepare("
|
|
UPDATE user_devices
|
|
SET refresh_token_hash = NULL,
|
|
refresh_expires_at = NULL,
|
|
push_token = NULL,
|
|
live_activity_token = NULL,
|
|
is_trusted = 0
|
|
WHERE user_id = ? AND device_fingerprint = ?
|
|
");
|
|
$stmt->execute([$userId, $deviceId]);
|
|
} else {
|
|
$stmt = $db->prepare("UPDATE users SET refresh_token_hash = NULL WHERE id = ?");
|
|
$stmt->execute([$userId]);
|
|
}
|
|
|
|
json_success(null, 'تم تسجيل الخروج بنجاح');
|