<?php
/**
 * POST /api/admin/reports_update.php
 * Body (JSON): { id, status } — status must be one of reviewing|resolved|dismissed.
 */

require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../includes/response.php';
require_once __DIR__ . '/../includes/auth.php';

only_post_allowed();
require_login();
require_role(['admin']);

$input = get_json_input();
$id = (int) ($input['id'] ?? 0);
$status = $input['status'] ?? '';

if ($id <= 0 || !in_array($status, ['reviewing', 'resolved', 'dismissed'], true)) {
    send_error('A valid report id and status are required.', 422);
}

$pdo = Database::connect();
$stmt = $pdo->prepare('SELECT id FROM reports WHERE id = ?');
$stmt->execute([$id]);
if (!$stmt->fetch()) {
    send_error('Report not found.', 404);
}

$stmt = $pdo->prepare('UPDATE reports SET status = ? WHERE id = ?');
$stmt->execute([$status, $id]);

send_json(true, 'Report updated.');
