<?php
// =============================================================
//  POST /api/v1/auth/logout
//
//  Revokes the bearer token used on this request. Idempotent — calling it
//  again (or with an already-revoked token) still returns success, since
//  the end state ("this token no longer works") is what the client cares
//  about, not whether it did anything this time.
// =============================================================

require_once __DIR__ . '/../_bootstrap.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    Api::error(405, 'MethodNotAllowed', 'Use POST');
}

api_authenticate();
$token_manager->revoke((string)api_current_token());

Api::success(['status' => 'logged_out']);
