<?php
session_start();
require_once 'db/config.php';

// Ensure user is logged in and is a vendor
if (!isset($_SESSION['user_id']) || $_SESSION['user_role'] !== 'vendor') {
    header("Location: login.php");
    exit();
}

$vendor_id = $_SESSION['user_id'];
$item_id = $_GET['id'] ?? null;

$pdo = db();

if ($item_id) {
    try {
        // Verify ownership before deleting
        $stmt = $pdo->prepare("SELECT id FROM items WHERE id = ? AND owner_id = ?");
        $stmt->execute([$item_id, $vendor_id]);
        $item = $stmt->fetch();

        if ($item) {
            // Item belongs to the vendor, proceed with deletion
            $stmt = $pdo->prepare("DELETE FROM items WHERE id = ? AND owner_id = ?");
            $stmt->execute([$item_id, $vendor_id]);

            $_SESSION['success_message'] = "Item deleted successfully!";
        } else {
            $_SESSION['error_message'] = "Item not found or you don't have permission to delete it.";
        }
    } catch (PDOException $e) {
        $_SESSION['error_message'] = "Database error: " . $e->getMessage();
    }
} else {
    $_SESSION['error_message'] = "No item ID provided.";
}

header("Location: my_listings.php");
exit();
?>