<?php
/*
   Must mirror login.php exactly - same session name and same cookie path.
   A plain session_start() here opens PHPSESSID on "/" and leaves the real
   PIONEERS_PMS_SESSION cookie on "/rooms/" intact, so the user never logs out.
*/
$sessionName = 'PIONEERS_PMS_SESSION';
$cookiePath  = '/rooms/';

if (session_status() === PHP_SESSION_NONE) {
    session_name($sessionName);
    session_set_cookie_params([
        'lifetime' => 0,
        'path'     => $cookiePath,
        'secure'   => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
        'httponly' => true,
        'samesite' => 'Lax',
    ]);
    session_start();
}

$_SESSION = [];

if (ini_get('session.use_cookies')) {
    setcookie($sessionName, '', [
        'expires'  => time() - 42000,
        'path'     => $cookiePath,
        'secure'   => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
        'httponly' => true,
        'samesite' => 'Lax',
    ]);
}

session_destroy();

header('Location: /rooms/login.php');
exit;
