<?php
require_once '../includes/auth.php';
requirePermission('sales', 'edit');
require_once '../db.php';

$id = (int)($_GET['id'] ?? 0);
if ($id <= 0) { header("Location: index.php"); exit; }

$inv = $conn->query("
    SELECT id, status FROM sales_invoices WHERE id = $id AND company_id = $cid
")->fetch_assoc();

if (!$inv || $inv['status'] !== 'draft') {
    header("Location: index.php");
    exit;
}

$conn->query("
    UPDATE sales_invoices SET status = 'cancelled' WHERE id = $id AND company_id = $cid AND status = 'draft'
");

header("Location: index.php?msg=cancelled");
exit;
