<?php
session_start();
require_once __DIR__ . '/../db/config.php';

header('Content-Type: application/json');

if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'super_admin') {
    http_response_code(403);
    echo json_encode(['success' => false, 'error' => 'Unauthorized']);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['success' => false, 'error' => 'Method not allowed']);
    exit;
}

$key = $_POST['key'] ?? '';
$value = $_POST['value'] ?? '';

if (empty($key)) {
    echo json_encode(['success' => false, 'error' => 'Missing key']);
    exit;
}

// Basic security check to ensure we only update allowed settings
$allowed_keys = ['whatsapp_enabled', 'wablas_token', 'wablas_server', 'wablas_security_key'];
if (!in_array($key, $allowed_keys)) {
    echo json_encode(['success' => false, 'error' => 'Invalid key']);
    exit;
}

try {
    set_setting($key, $value);
    echo json_encode(['success' => true]);
} catch (Exception $e) {
    echo json_encode(['success' => false, 'error' => $e->getMessage()]);
}