<?php
session_start();
if (!isset($_SESSION['role_id']) || $_SESSION['role_id'] != 1) {
    http_response_code(403);
    echo json_encode(['success' => false, 'message' => 'Unauthorized']);
    exit();
}

include('../../includes/config.php');

$data = json_decode(file_get_contents('php://input'), true);

if (empty($data['id']) || !in_array($data['action'], ['delete', 'undelete'])) {
    echo json_encode(['success' => false, 'message' => 'Invalid parameters']);
    exit();
}

$id = (int)$data['id'];
$action = $data['action'];

if ($action === 'delete') {
    $sql = "UPDATE expenses SET deleted_at = NOW() WHERE id = ?";
} else {
    $sql = "UPDATE expenses SET deleted_at = NULL WHERE id = ?";
}

$stmt = $conn->prepare($sql);
$stmt->bind_param('i', $id);

if ($stmt->execute()) {
    echo json_encode(['success' => true]);
} else {
    echo json_encode(['success' => false, 'message' => 'Database update failed']);
}
$stmt->close();
