<?php
require_once "../php/db_connect.php";

if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

if (!isset($_SESSION["role"]) || $_SESSION["role"] !== "superadmin") {
    header("Location: ../html/index.php");
    exit();
}

$id = $_GET["id"] ?? null;
$action = $_GET["action"] ?? "";

if (!$id || !is_numeric($id)) {
    header("Location: superadmin.php?page=users");
    exit();
}

$id = (int)$id;

if ($action === "deactivate") {
    $newStatus = "inactive";
    $message = "deactivated";
} elseif ($action === "activate") {
    $newStatus = "active";
    $message = "activated";
} else {
    header("Location: superadmin.php?page=users");
    exit();
}

$stmt = $conn->prepare("UPDATE users SET status = ? WHERE id = ? AND role != 'superadmin'");
$stmt->bind_param("si", $newStatus, $id);
$stmt->execute();
$stmt->close();

header("Location: superadmin.php?page=users&message=" . urlencode($message));
exit();
?>