<?php
require_once __DIR__ . '/../includes/auth.php';
requireLogin();
requirePermission('users.manage');

require_once __DIR__ . '/../config/database.php';

$userId = (int)$_GET['id'];

$stmt = $pdo->prepare("SELECT status FROM users WHERE id = ?");
$stmt->execute([$userId]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$user) {
    die("User not found.");
}

$newStatus = ($user['status'] === 'ACTIVE') ? 'SUSPENDED' : 'ACTIVE';

$update = $pdo->prepare("UPDATE users SET status = ? WHERE id = ?");
$update->execute([$newStatus, $userId]);

/* Audit */
$audit = $pdo->prepare("
    INSERT INTO audit_logs (user_id, action)
    VALUES (?, ?)
");
$audit->execute([
    $_SESSION['user_id'],
    "Changed user ID {$userId} status to {$newStatus}"
]);

header("Location: users.php");
exit;
