<?php
declare(strict_types=1);

require __DIR__ . '/../lib/helpers.php';

$db  = require __DIR__ . '/../config/db.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); exit('Method not allowed'); }
csrf_check($_POST['csrf'] ?? '');

$action = $_POST['action'] ?? '';
$id     = (int)($_POST['id'] ?? 0);
if ($id <= 0) { http_response_code(400); exit('Invalid id'); }

$allowed = ['archive' => 'archived', 'restore' => 'active', 'delete' => 'deleted'];
if (!array_key_exists($action, $allowed)) { http_response_code(400); exit('Invalid action'); }

$stmt = $db->prepare("UPDATE documents SET status = :status WHERE id = :id");
$stmt->execute([':status' => $allowed[$action], ':id' => $id]);

header('Location: ' . base_url('index.php'));
