<?php

declare(strict_types=1);

require_once dirname(__DIR__, 2) . '/system/bootstrap.php';

$method = strtoupper((string) ($_SERVER['REQUEST_METHOD'] ?? 'GET'));
if ($method !== 'POST') {
    http_response_code(405);
    header('Allow: POST');
    header('Content-Type: text/plain; charset=utf-8');
    header('X-Content-Type-Options: nosniff');
    echo 'Logout requires a POST request.';
    return;
}

try {
    myronRequireCsrf($_POST['csrf_token'] ?? null);
} catch (MyronCsrfFailureException $exception) {
    myronRenderSecurityFailure($exception->getMessage(), 403);
    return;
}

$publicReturnTo = myronSanitizePublicReturn($_POST['public_return_to'] ?? null);

myronLogoutUser();
if ($publicReturnTo !== null) {
    myronRedirect($publicReturnTo);
}

myronRedirectWithFlash(myronBuildAdminUrl('auth.login'), 'You have been logged out.', 'success');
