<?php
/**
 * POST /api/cart/remove.php
 * Body (JSON): { product_id }
 */

require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../includes/response.php';
require_once __DIR__ . '/../includes/auth.php';

only_post_allowed();
$userId = require_login();

$input = get_json_input();
$productId = (int) ($input['product_id'] ?? 0);

if ($productId <= 0) {
    send_error('A valid product_id is required.', 422);
}

$pdo = Database::connect();
$stmt = $pdo->prepare('DELETE FROM cart_items WHERE user_id = ? AND product_id = ?');
$stmt->execute([$userId, $productId]);

send_json(true, 'Removed from cart.');
