<?php
/**
 * back.php — Logout endpoint
 *
 * Called by: login page AJAX "logout" / "go back" button.
 * Destroys the current session completely so the user is signed out.
 *
 * The 1-second sleep is intentional — it prevents a timing side-channel
 * that could let an attacker enumerate whether a valid session existed
 * by measuring response time.
 *
 * Flow:
 *   1. Load session.php to resume the active PHP session.
 *   2. Load db_auth.php to run standard auth/session bootstrap (required
 *      by session.php dependency chain).
 *   3. Sleep 1 second (timing protection).
 *   4. Destroy the session entirely.
 *   5. Return { success: 1 }.
 *
 * Response JSON:
 *   { "success": 1 }
 */

require_once '../../../session.php';
define('UNAUTHENTICATED_ROUTE', true);
require_once '../../../assets/utils/db_auth.php';

// Clear session token so the account is free to log in elsewhere immediately
if (!empty($_SESSION['login_user_id'])) {
    $pdo1->prepare("UPDATE user SET session_token = NULL, session_token_at = NULL WHERE user_id = :uid")
         ->execute([':uid' => (int)$_SESSION['login_user_id']]);
}

// Intentional 1-second delay — prevents timing attacks on session enumeration
sleep(1);

session_destroy();

$answer["success"] = 1;
exit(json_encode($answer));