<?php
session_start();
include "../../connect/db.php";

if (!isset($_SESSION['man'])) { die("Access Denied"); }

if ($_SERVER['REQUEST_METHOD'] !== 'POST' || !isset($_POST['id']) || empty($_POST['reason'])) {
    die("Invalid request. A rejection reason is required.");
}

$id = intval($_POST['id']);
$reason = $mysqli->real_escape_string($_POST['reason']);
$admin = $_SESSION['man'];

$update = $mysqli->query("UPDATE virtualcard SET
    status = 'rejected',
    rejection_reason = '$reason',
    rejected_by = '$admin',
    rejected_at = NOW()
    WHERE id = $id AND status = 'pending'");

if ($update && $mysqli->affected_rows > 0) {
    echo "success";
} else {
    echo "Application not found or already processed.";
}
