<?php
require_once __DIR__ . '/../includes/functions.php';
requireAdmin();
if ($_SERVER['REQUEST_METHOD'] !== 'POST') jsonResponse(['success'=>false,'error'=>'Method not allowed'], 405);

$id     = (int)($_POST['id']     ?? 0);
$status = in_array($_POST['status'] ?? '', ['active','inactive']) ? $_POST['status'] : null;

if (!$id || !$status) jsonResponse(['success'=>false,'error'=>'Invalid request.']);
if ($id === (int)$_SESSION['user_id']) jsonResponse(['success'=>false,'error'=>'Cannot change your own status.']);

$db   = getDB();
$stmt = $db->prepare("UPDATE users SET status = ? WHERE id = ?");
$stmt->execute([$status, $id]);

jsonResponse(['success'=>true]);
