<?php
header('Content-Type: application/json');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization');
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { http_response_code(200); exit; }

require_once __DIR__ . '/../../config.php';

$headers    = getallheaders();
$authHeader = isset($headers['Authorization']) ? $headers['Authorization'] : (isset($headers['authorization']) ? $headers['authorization'] : '');
$token      = str_replace('Bearer ', '', $authHeader);

if (empty($token)) {
    $body  = json_decode(file_get_contents('php://input'), true);
    $token = isset($body['token']) ? $body['token'] : '';
}

if (!empty($token)) {
    $db = getDB();
    $db->prepare("DELETE FROM admin_sessions WHERE token = ?")->execute([$token]);
}

echo json_encode(['success' => true]);
