<?php

declare(strict_types=1);

/**
 * POST /api/logout.php → 200 {ok:true}, сессия уничтожена | 403.
 */

require __DIR__ . '/../lib/http.php';
require __DIR__ . '/../lib/auth.php';

http_security_headers();

try {
    method_must('POST');
    require_client_header();

    logout_user();

    json_out(['ok' => true]);
} catch (Throwable $e) {
    error_log('logout: ' . $e->getMessage());
    error_out(500, 'internal');
}