<?php
// update_status.php - Update Order Status (Admin Only)
session_start();
require_once 'db.php';

// Access Control check
if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'admin') {
    header("Location: login.php");
    exit();
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $order_id = isset($_POST['order_id']) ? intval($_POST['order_id']) : 0;
    $status = isset($_POST['status']) ? trim($_POST['status']) : '';

    // Validate status values
    $allowed_statuses = ['Pending', 'Paid', 'Shipped'];
    if ($order_id > 0 && in_array($status, $allowed_statuses)) {
        try {
            $stmt = $pdo->prepare("UPDATE orders SET status = :status WHERE id = :id");
            $stmt->execute([
                ':status' => $status,
                ':id' => $order_id
            ]);

            header("Location: admin.php?tab=orders&success_msg=" . urlencode("อัปเดตสถานะคำสั่งซื้อเป็น " . $status . " สำเร็จแล้ว"));
            exit();
        } catch (Exception $e) {
            header("Location: admin.php?tab=orders&error_msg=" . urlencode("เกิดข้อผิดพลาด: " . $e->getMessage()));
            exit();
        }
    } else {
        header("Location: admin.php?tab=orders&error_msg=" . urlencode("ข้อมูลสถานะหรือออร์เดอร์ไม่ถูกต้อง"));
        exit();
    }
} else {
    header("Location: admin.php");
    exit();
}
?>