<?php
/**
 * POST /api/auth/token_revoke.php
 * Body (JSON): { refresh_token }
 *
 * Mobile "log out". Revokes one specific refresh token (the device calling
 * this one) - it does NOT log the user out of other devices. The access
 * token already issued to this device stays valid until it naturally
 * expires (max JWT_ACCESS_TTL, currently 1 hour) since access tokens are
 * stateless and can't be revoked individually; the client is expected to
 * discard it locally on logout regardless.
 *
 * No auth required to call this beyond possessing the refresh token itself -
 * that's already proof of the session being logged out. Silently succeeds
 * even if the token doesn't exist / was already revoked, so a client can
 * always safely call this on logout without special-casing errors.
 */

require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../includes/response.php';

only_post_allowed();

$input = get_json_input();
$rawToken = trim((string) ($input['refresh_token'] ?? ''));
if ($rawToken === '') {
    send_error('A refresh token is required.', 422);
}

$tokenHash = hash('sha256', $rawToken);
$pdo = Database::connect();
$pdo->prepare('UPDATE auth_refresh_tokens SET revoked_at = NOW() WHERE token_hash = ? AND revoked_at IS NULL')
    ->execute([$tokenHash]);

send_json(true, 'Logged out.');
