<?php
// admin/update-order-status.php
require_once __DIR__ . '/../includes/config.php';
require_once __DIR__ . '/../includes/functions.php';

header('Content-Type: application/json');

if (!isAdmin()) {
    echo json_encode(['success' => false, 'message' => 'Unauthorized']);
    exit;
}

$order_id = intval($_POST['order_id'] ?? 0);
$status = $_POST['status'] ?? '';

$valid_statuses = ['pending', 'processing', 'shipped', 'delivered', 'cancelled'];

if (!$order_id || !in_array($status, $valid_statuses)) {
    echo json_encode(['success' => false, 'message' => 'Invalid request']);
    exit;
}

try {
    $stmt = $pdo->prepare("UPDATE orders SET order_status = ? WHERE id = ?");
    $stmt->execute([$status, $order_id]);
    
    echo json_encode(['success' => true, 'message' => 'Order status updated']);
} catch (Exception $e) {
    echo json_encode(['success' => false, 'message' => $e->getMessage()]);
}
?>