<?php
header("Content-Type: application/json");
// Use explicit origin to comply with credentials=true
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
if (!empty($origin)) {
    header("Access-Control-Allow-Origin: $origin");
} else {
    $scheme = $_SERVER['REQUEST_SCHEME'] ?? 'https';
    $host = $_SERVER['HTTP_HOST'] ?? '';
    if (!empty($host)) {
        header('Access-Control-Allow-Origin: ' . $scheme . '://' . $host);
    }
}
header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization");
header('Access-Control-Allow-Credentials: true');

if ($_SERVER["REQUEST_METHOD"] === "OPTIONS") {
    http_response_code(200);
    exit;
}

// logout.php: Handles user logout for Ton Sui Mining with secure session cleanup
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
header('Pragma: no-cache');

// Define TONSUI_LOADED constant to prevent direct access to session_init.php
define('TONSUI_LOADED', true);

// Include centralized session initialization
require_once __DIR__ . '/session_init.php';
require_once 'db.php';

// Log the logout event if user was logged in
$userId = isset($_SESSION['user_id']) ? $_SESSION['user_id'] : 0 ?? null;
$username = $_SESSION['username'] ?? 'unknown';
$isAdmin = isset($_SESSION['admin_logged_in']) && $_SESSION['admin_logged_in'];

// Log the logout event
if ($userId) {
    try {
        // Log the logout event in security logs
        $stmt = $pdo->prepare('INSERT INTO security_logs (event_type, user_id, ip_address, user_agent, created_at) 
                              VALUES (?, ?, ?, ?, NOW())');
        $eventType = $isAdmin ? 'admin_logout' : 'user_logout';
        $stmt->execute([
            $eventType,
            $userId,
            $_SERVER['REMOTE_ADDR'] ?? 'unknown',
            $_SERVER['HTTP_USER_AGENT'] ?? 'unknown'
        ]);
    } catch (Exception $e) {
        error_log('Failed to log logout event: ' . $e->getMessage());
    }
}

// Clear all session variables
$_SESSION = [];

// Delete the session cookie (must match attributes from session_init.php)
if (ini_get('session.use_cookies')) {
    $params = session_get_cookie_params();
    $opts = [
        'expires' => time() - 42000,
        'path' => '/',
        'secure' => true,
        'httponly' => true,
        'samesite' => 'None'
    ];
    if (!empty($params['domain'])) {
        $opts['domain'] = $params['domain'];
    }
    setcookie(session_name(), '', $opts);
}

// Destroy the session
if (session_status() === PHP_SESSION_ACTIVE) {
    session_destroy();
}

// Clear any existing output buffers
while (ob_get_level()) {
    ob_end_clean();
}

// Set no-cache headers to prevent caching of the logout response
header_remove('Pragma');
header_remove('Expires');
header_remove('Last-Modified');
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0');
header('Pragma: no-cache');

// Return success response
echo json_encode([
    'success' => true, 
    'message' => 'Logout successful.',
    'redirect' => '/login'  // Client-side should handle the redirect
]);

exit;
