<?php
require_once __DIR__ . '/../config/helpers.php';
cors();

$id     = $_GET['id'] ?? '';
$method = $_SERVER['REQUEST_METHOD'];
$db     = db();

if ($id === '') json_err('Missing id');

if ($method === 'PUT') {
    require_admin();
    $b      = body();
    $status = $b['status'] ?? '';
    if (!in_array($status, ['pending','reviewed','implemented'])) json_err('Invalid status');
    $db->prepare('UPDATE suggestions SET status = ? WHERE id = ?')->execute([$status, $id]);
    json_ok(['updated' => true]);
}

if ($method === 'DELETE') {
    require_admin();
    $db->prepare('DELETE FROM suggestions WHERE id = ?')->execute([$id]);
    json_ok(['deleted' => true]);
}

json_err('Method not allowed', 405);