<?php
/**
 * POST /api/v1/logout.php
 *
 * Revokes the Bearer token used for this request. Idempotent.
 */

require_once __DIR__ . '/../../config.php';
require_once __DIR__ . '/../../lib/api.php';

api_require_method('POST');
$user = api_auth($pdo);

$pdo->prepare('UPDATE api_tokens SET revoked_at = NOW() WHERE id = ? AND revoked_at IS NULL')
    ->execute([(int) $user['token_id']]);

audit_log($pdo, 'api_logout', ['user_id' => $user['id']]);
api_ok();
