<?php

namespace App\Libraries;

use CodeIgniter\HTTP\RedirectResponse;

class AuthLogout
{
    public static function logout(): RedirectResponse
    {
        $session = session();

        // Regenerate session ID (kills fixation)
        $session->regenerate(true);

        // Destroy CI session
        $session->destroy();

        // Kill PHP session cookie safely
        if (ini_get('session.use_cookies')) {
            $params = session_get_cookie_params();

            setcookie(
                session_name(),   // DO NOT hardcode cookie name
                null,
                time() - 42000,
                $params['path'],
                $params['domain'],
                $params['secure'],
                $params['httponly']
            );
        }

        session_write_close();

        // Redirect with anti-cache headers
        return redirect()->to(base_url('login'))
            ->setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
            ->setHeader('Pragma', 'no-cache')
            ->setHeader('Expires', 'Sat, 26 Jul 1997 05:00:00 GMT');
    }
}