<?php
/**
 * POST /api/notifications/unregister_device.php
 * Body (JSON): { device_token }
 *
 * Called on logout so a signed-out device stops receiving pushes meant
 * for the account that just logged out. No auth required beyond having
 * the token itself - mirrors auth/token_revoke.php's reasoning: possessing
 * the token is what's being un-registered, not a specific user's session
 * (the app may already have cleared its bearer token by the time this
 * fires during logout).
 */

require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../includes/response.php';

only_post_allowed();

$input = get_json_input();
$deviceToken = trim((string) ($input['device_token'] ?? ''));
if ($deviceToken === '') {
    send_error('device_token is required.', 422);
}

$pdo = Database::connect();
$pdo->prepare('DELETE FROM device_tokens WHERE token = ?')->execute([$deviceToken]);

send_json(true, 'Device unregistered.');
