<?php
session_start();
require_once '../includes/config.php';

if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'admin') {
    http_response_code(403);
    echo "Unauthorized";
    exit;
}

$id = $_POST['id'] ?? null;
$status = $_POST['status'] ?? null;

if ($id && in_array($status, ['approved', 'rejected'])) {
    $stmt = $pdo->prepare("UPDATE incident_reports SET status = ? WHERE id = ?");
    $stmt->execute([$status, $id]);
    echo "success";
} else {
    http_response_code(400);
    echo "Invalid request";
}
