<?php
require_once __DIR__ . '/includes/bootstrap.php';

// Logout must be POST + CSRF so a malicious link or <img> can't sign the
// user out (XSRF-logout). Anyone landing here via GET is sent back to the
// dashboard; the panel header renders the actual logout control as a tiny
// auto-submitting form.
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: ' . (auth_user() ? 'dashboard.php' : 'login.php'));
    exit;
}
if (!csrf_check($_POST['_csrf'] ?? '')) {
    header('Location: ' . (auth_user() ? 'dashboard.php' : 'login.php'));
    exit;
}

auth_logout();
header('Location: login.php');
exit;
