<?php
require_once '../includes/auth.php';
require_once '../db.php';

// Admin and staff only
if (!in_array($_SESSION['user_role'] ?? '', ['admin', 'staff'])) {
    header('Location: ../dashboard.php');
    exit;
}

$id        = intval($_GET['id'] ?? 0);
$client_id = intval($_GET['client_id'] ?? 0);
$fco       = intval($_GET['co'] ?? 0);

if (!$id || !$client_id) {
    header('Location: index.php');
    exit;
}

// Verify payment exists and belongs to this client
$check = $conn->query("SELECT id, client_id FROM client_payments WHERE id = $id LIMIT 1");
if (!$check || $check->num_rows === 0) {
    header("Location: view.php?client_id=$client_id&co=$fco");
    exit;
}
$payment = $check->fetch_assoc();
if ((int)$payment['client_id'] !== $client_id) {
    header("Location: view.php?client_id=$client_id&co=$fco");
    exit;
}

// Delete the payment
$conn->query("DELETE FROM client_payments WHERE id = $id");

header("Location: view.php?client_id=$client_id&co=$fco");
exit;
