<?php

declare(strict_types=1);

namespace App\Auth;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;

/**
 * `POST /logout` — clears the session and bounces back to `/login`.
 * CSRF-protected by the global middleware (yes, even logout: otherwise
 * an attacker can force a victim to log out at an inopportune moment).
 */
final class LogoutController
{
    public function __construct(private readonly SessionManager $sessions)
    {
    }

    public function __invoke(ServerRequestInterface $request, ResponseInterface $response): ResponseInterface
    {
        $this->sessions->clear();
        $this->sessions->flash('info', 'You have been signed out.');

        return $response->withStatus(303)->withHeader('Location', '/login');
    }
}
