<?php
session_start();
if (!isset($_SESSION['role_id']) || !in_array($_SESSION['role_id'], [1,3,4])) {
    echo json_encode(['success' => false, 'message' => 'Unauthorized']);
    exit();
}

include('../../includes/config.php');

$id = intval($_POST['id'] ?? 0);
$amount = floatval($_POST['amount'] ?? 0);
$description = trim($_POST['description'] ?? '');

if ($id <= 0 || $amount <= 0) {
    echo json_encode(['success' => false, 'message' => 'Invalid input']);
    exit();
}

$stmt = $conn->prepare("UPDATE expenses SET amount = ?, description = ? WHERE id = ?");
$stmt->bind_param("dsi", $amount, $description, $id);

if ($stmt->execute()) {
    echo json_encode(['success' => true]);
} else {
    echo json_encode(['success' => false, 'message' => 'Database update failed']);
}
?>
