<?php
include '../includes/db.php';
include_once __DIR__ . '/../includes/permissions.php';
session_start();

require_permission('users_delete');

// Check if user is admin
if (!isset($_SESSION['user_id'])) {
    header("Location: index.php?error=Unauthorized");
    exit;
}
// Again, assuming auth.php handles the role check

if (isset($_GET['id'])) {
    $user_id_to_delete = $_GET['id'];

    // Prevent deleting user with ID 1 and the currently logged-in user
    if ($user_id_to_delete == 1 || $user_id_to_delete == $_SESSION['user_id']) {
        header("Location: users.php?error=Cannot delete this user.");
        exit;
    }

    $stmt = $conn->prepare("DELETE FROM users WHERE id = ?");
    $stmt->bind_param("i", $user_id_to_delete);

    if ($stmt->execute()) {
        header("Location: users.php?success=2"); // Success code 2 for deletion
    } else {
        header("Location: users.php?error=" . urlencode($stmt->error));
    }

    $stmt->close();
    $conn->close();
    exit;

} else {
    header("Location: users.php");
    exit;
}
?>