<?php
require_once __DIR__ . '/../lib.php';

$user = hw_get_auth_user();
if (!$user || !in_array('superadmin', $user['roles'])) {
    hw_json(['success' => false, 'message' => 'Unauthorized'], 401);
}

$input = hw_input_json();
$id = (int)($input['id'] ?? 0);
$status = $input['status'] ?? '';

if (!$id || !$status) {
    hw_json(['success' => false, 'message' => 'ID and status required'], 400);
}

$validStatuses = ['pending', 'confirmed', 'completed', 'cancelled'];
if (!in_array($status, $validStatuses)) {
    hw_json(['success' => false, 'message' => 'Invalid status'], 400);
}

try {
    $pdo = hw_db();
    $stmt = $pdo->prepare("UPDATE appointments SET status = ? WHERE id = ?");
    $stmt->execute([$status, $id]);

    hw_json(['success' => true, 'message' => 'Status updated successfully']);
} catch (Exception $e) {
    hw_json(['success' => false, 'message' => 'Server error'], 500);
}
?>