<?php
// Ends the local session. Nothing to coordinate with an identity provider —
// this install owns its own sessions.

require __DIR__ . '/../../config/db.php';
require __DIR__ . '/../../config/functions.php';

if (!empty($_SESSION['user_id'])) {
    audit('auth.logout', ['target_type' => 'user', 'target_id' => (int) $_SESSION['user_id']]);
}
$_SESSION = [];
// Drop the cookie too, so the browser doesn't keep presenting a dead id.
if (ini_get('session.use_cookies')) {
    $p = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
}
session_destroy();

header('Location: ' . base_url('views/auth/login.php?loggedout=1'));
exit;