<?php
require_once 'auth.php';

if (!is_logged_in() || !hasPermission('delete_candidates')) {
    header('Location: login.php');
    exit;
}

require_once 'db/config.php';

if (isset($_GET['id'])) {
    $id = $_GET['id'];
    $pdo = db();
    $stmt = $pdo->prepare("DELETE FROM candidates WHERE id = :id");
    $stmt->bindParam(':id', $id, PDO::PARAM_INT);
    $stmt->execute();
}

header('Location: dashboard.php');
exit;