<?php
require_once '../includes/auth.php';
require_once '../db.php';

// Admin and staff only
if (!in_array($_SESSION['user_role'] ?? '', ['admin', 'staff'])) {
    header('Location: ../dashboard.php');
    exit;
}

$id        = intval($_GET['id'] ?? 0);
$vendor_id = intval($_GET['vendor_id'] ?? 0);
$fco       = intval($_GET['co'] ?? 0);

if (!$id || !$vendor_id) {
    header('Location: index.php');
    exit;
}

// Verify payment exists and belongs to this vendor
$check = $conn->query("SELECT id, vendor_id FROM vendor_payments WHERE id = $id LIMIT 1");
if (!$check || $check->num_rows === 0) {
    header("Location: view.php?vendor_id=$vendor_id&co=$fco");
    exit;
}
$payment = $check->fetch_assoc();
if ((int)$payment['vendor_id'] !== $vendor_id) {
    header("Location: view.php?vendor_id=$vendor_id&co=$fco");
    exit;
}

// Delete the payment
$conn->query("DELETE FROM vendor_payments WHERE id = $id");

header("Location: view.php?vendor_id=$vendor_id&co=$fco");
exit;
