<?php
/**
 * POST /api/reports/create.php
 * Body (JSON): { reason, product_id? , reported_user_id? }
 * At least one of product_id / reported_user_id is required.
 */

require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../includes/response.php';
require_once __DIR__ . '/../includes/auth.php';

only_post_allowed();
$userId = require_login();

$input = get_json_input();
$reason = trim($input['reason'] ?? '');
$productId = !empty($input['product_id']) ? (int) $input['product_id'] : null;
$reportedUserId = !empty($input['reported_user_id']) ? (int) $input['reported_user_id'] : null;

if ($reason === '') {
    send_error('Please describe the issue.', 422);
}
if (!$productId && !$reportedUserId) {
    send_error('A product or user to report is required.', 422);
}

$pdo = Database::connect();
$stmt = $pdo->prepare(
    'INSERT INTO reports (reported_by, product_id, reported_user_id, reason) VALUES (?, ?, ?, ?)'
);
$stmt->execute([$userId, $productId, $reportedUserId, $reason]);

send_json(true, 'Thanks — our team will take a look.', [], 201);
