<?php
require_once 'db/config.php';

// Auth and Role check
if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'Admin') {
    $_SESSION['error'] = "You do not have permission to delete products.";
    header("Location: products.php");
    exit;
}

$id = $_GET['id'] ?? null;

if ($id) {
    $stmt = db()->prepare("UPDATE products SET deleted_at = NOW() WHERE id = ?");
    $stmt->execute([$id]);
    
    // Log action
    $log_stmt = db()->prepare("INSERT INTO audit_logs (user_id, action, entity_type, entity_id, details) VALUES (?, ?, ?, ?, ?)");
    $log_stmt->execute([$_SESSION['user_id'], 'DELETE', 'PRODUCT', $id, "Soft deleted"]);
}

$_SESSION['success'] = "Product deleted successfully.";
header("Location: products.php");
exit;