<?php
/**
 * RUHONDO BEACH RESORT HMS + POS System
 * Logout Script
 * Developer: JOACHIM'S INNOTECH
 */

// Initialize system
require_once dirname(__DIR__) . '/config/config.php';
require_once dirname(__DIR__) . '/config/constants.php';
require_once dirname(__DIR__) . '/config/database.php';
require_once dirname(__DIR__) . '/config/helpers.php';
require_once dirname(__DIR__) . '/config/auth.php';
require_once dirname(__DIR__) . '/config/csrf.php';

// Verify CSRF for POST requests (optional, for security)
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!verify_csrf_token($_POST[CSRF_TOKEN_NAME] ?? '')) {
        // Invalid CSRF token - still logout but log it
        log_message("CSRF token mismatch during logout for user " . (current_user_id() ?? 'unknown'), 'WARNING');
    }
}

// Perform logout
logout_user();

// Set logout message
set_flash_message('success', 'You have been successfully logged out.');

// Determine if this was an AJAX request
if (is_ajax_request()) {
    // Return JSON response for AJAX
    header('Content-Type: application/json');
    echo json_encode([
        'status' => 'success',
        'message' => 'Logged out successfully',
        'redirect' => base_url('login.php')
    ]);
    exit;
}

// Redirect to login page
redirect('login.php');