<?php
// Delete user endpoint (admin only). Protect primary admin.
header('Content-Type: application/json; charset=utf-8');
session_start();

if (empty($_SESSION['user_id']) || empty($_SESSION['is_admin'])) {
    http_response_code(403);
    echo json_encode(['success' => false, 'message' => 'Access denied']);
    exit;
}

$userId = isset($_POST['user_id']) ? (int)$_POST['user_id'] : 0;
if (!$userId) { http_response_code(400); echo json_encode(['success'=>false,'message'=>'Invalid user']); exit; }

$protectedEmail = 'maham11abc@gmail.com';

// Load DB if available
$dbPath = __DIR__ . '/db_config.php';
if (file_exists($dbPath)) require $dbPath;

// Try DB
if (isset($conn) && $conn) {
    $stmt = @$conn->prepare('SELECT email FROM users WHERE id = ? LIMIT 1');
    if ($stmt) { $stmt->bind_param('i',$userId); $stmt->execute(); $r=$stmt->get_result(); $row=$r? $r->fetch_assoc():null; $stmt->close(); }
    $email = $row['email'] ?? null;
    if ($email === $protectedEmail) { echo json_encode(['success'=>false,'message'=>'Cannot delete primary admin']); exit; }

    // delete from users and related tables
    $del = @$conn->prepare('DELETE FROM users WHERE id = ?'); if ($del) { $del->bind_param('i',$userId); $del->execute(); $del->close(); }
    $del2 = @$conn->prepare('DELETE FROM admins WHERE user_id = ?'); if ($del2) { $del2->bind_param('i',$userId); $del2->execute(); $del2->close(); }
    $del3 = @$conn->prepare('DELETE FROM subadmins WHERE user_id = ?'); if ($del3) { $del3->bind_param('i',$userId); $del3->execute(); $del3->close(); }
    echo json_encode(['success'=>true]); exit;
}

// JSON fallback: remove from data/users.json and admin/subadmin lists
$usersFile = __DIR__ . '/data/users.json';
if (file_exists($usersFile)) {
    $j = json_decode(file_get_contents($usersFile), true);
    if (is_array($j)) {
        $j = array_values(array_filter($j, function($u) use ($userId) { return !isset($u['id']) || $u['id'] != $userId; }));
        file_put_contents($usersFile, json_encode($j, JSON_PRETTY_PRINT));
    }
}

$adminsFile = __DIR__ . '/data/admins.json';
if (file_exists($adminsFile)) {
    $a = json_decode(file_get_contents($adminsFile), true);
    if (is_array($a)) { $a = array_values(array_diff($a, [$userId])); file_put_contents($adminsFile, json_encode($a, JSON_PRETTY_PRINT)); }
}

$subsFile = __DIR__ . '/data/subadmins.json';
if (file_exists($subsFile)) {
    $s = json_decode(file_get_contents($subsFile), true);
    if (is_array($s)) { $s = array_values(array_filter($s, function($x) use ($userId){ return !isset($x['user_id']) || $x['user_id'] != $userId; })); file_put_contents($subsFile, json_encode($s, JSON_PRETTY_PRINT)); }
}

echo json_encode(['success'=>true]); exit;

?>
<?php
session_start();
header('Content-Type: application/json');
if (!isset($_SESSION['is_admin']) || $_SESSION['is_admin'] !== true) {
    echo json_encode(['success'=>false,'message'=>'Access denied']); exit;
}
require_once __DIR__ . '/db_config.php';
require_once __DIR__ . '/helpers/database_helper.php';

$user_id = isset($_POST['user_id']) ? (int)$_POST['user_id'] : 0;
if ($user_id <= 0) { echo json_encode(['success'=>false,'message'=>'Invalid id']); exit; }

// remove from admins table
if ($conn) {
    $stmt = $conn->prepare('DELETE FROM admins WHERE user_id = ?');
    if ($stmt) { $stmt->bind_param('i',$user_id); $stmt->execute(); $stmt->close(); }
    $stmt2 = $conn->prepare('DELETE FROM users WHERE id = ?');
    if ($stmt2) { $stmt2->bind_param('i',$user_id); $stmt2->execute(); $stmt2->close(); }
}

// remove from subadmins.json
$subs = DatabaseHelper::loadJson('subadmins.json', []);
if (isset($subs[(string)$user_id])) { unset($subs[(string)$user_id]); DatabaseHelper::saveJson('subadmins.json', $subs); }

echo json_encode(['success'=>true]);

?>
