<?php
require_once __DIR__ . '/../includes/auth.php';
require_owner();
$pdo = require __DIR__ . '/../config/pdo.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    redirect(base_url('owner/users.php'));
}

$id = (int) ($_POST['id'] ?? 0);
$currentId = (int) (current_user()['id'] ?? 0);

if ($id === 0) {
    flash_message('error', 'User tidak valid.');
    redirect(base_url('owner/users.php'));
}

if ($id === $currentId) {
    flash_message('error', 'Owner tidak boleh menghapus dirinya sendiri.');
    redirect(base_url('owner/users.php'));
}

$stmt = $pdo->prepare('DELETE FROM users WHERE id = ? AND role IN ("admin","owner")');
$stmt->execute([$id]);

flash_message('success', 'User berhasil dihapus.');
redirect(base_url('owner/users.php'));
