<?php
require __DIR__ . '/../../vendor/autoload.php';
$dotenv = Dotenv\Dotenv::createImmutable(__DIR__ . '/..');
$dotenv->safeLoad();

use App\Auth;
use App\Csrf;
Auth::init();
Auth::requireRole('admin');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: users.php');
    exit;
}

if (!Csrf::verify($_POST['_csrf'] ?? '')) {
    die('Invalid CSRF token');
}

$id = (int)($_POST['id'] ?? 0);
if ($id <= 0) {
    header('Location: users.php'); exit;
}

$pdo = App\Database::getConnection();
$upd = $pdo->prepare("UPDATE users SET status = 'active' WHERE id = :id LIMIT 1");
$upd->execute([':id' => $id]);
header('Location: users.php');
exit;
