<?php
declare(strict_types=1);
require_once __DIR__ . '/includes/session.php';
require_once __DIR__ . '/includes/csrf.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: dashboard.php');
    exit;
}

if (!csrf_verify($_POST['csrf_token'] ?? null)) {
    http_response_code(403);
    exit('Недійсний запит.');
}

$userId = (int)($_SESSION['user_id'] ?? 0);
unset(
    $_SESSION['user_id'],
    $_SESSION['user_name'],
    $_SESSION['user_email'],
    $_SESSION['user_role'],
    $_SESSION['user_last_activity']
);
csrf_rotate();
session_regenerate_id(true);
mps_log('user_logout', ['user_id' => $userId]);

header('Location: login.php');
exit;