<?php
session_start();
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST');
header("Access-Control-Allow-Headers: X-Requested-With");

if(isset($_POST['user_id']) && isset($_POST['auth'])) {
require_once 'db/config.php'; // should set $con (PDO)

    $user_id = trim($_POST['user_id']);
    $auth    = trim($_POST['auth']);

    // ✅ Use prepared statements
    $stmt = $con->prepare("SELECT user_id FROM users WHERE user_id = ? AND auth = ? LIMIT 1");
    $stmt->bind_param("ss", $user_id, $auth);
    $stmt->execute();
    $result = $stmt->get_result();

    if($result && $result->num_rows === 1) {
        // ✅ Update status to Deleted
        $stmt2 = $con->prepare("UPDATE users SET status = 'Deleted' WHERE user_id = ? AND auth = ?");
        $stmt2->bind_param("ss", $user_id, $auth);
        if($stmt2->execute()) {
            $output = ['status' => true, 'success' => 'Success'];
        } else {
            $output = ['status' => false, 'success' => 'Failed to delete user'];
        }
        $stmt2->close();
    } else {
        $output = ['status' => false, 'success' => 'Invalid credentials'];
    }

    $stmt->close();
    $con->close();
} else {
    $output = ['status' => false, 'success' => 'user_id and auth required'];
}

echo json_encode($output);
?>
