<?php
// =============================================================
//  POST /api/v1/admin_nurses/delete  { "id": 5 }
//
//  Permanently deletes a Rotation Nurse account — wraps app/manage_
//  rotation_nurses.php's delete_user action exactly.
// =============================================================

require_once __DIR__ . '/../_bootstrap.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    Api::error(405, 'MethodNotAllowed', 'Use POST');
}

$account = api_authenticate();
api_require_permission('delete_user');

$body = json_decode(file_get_contents('php://input'), true) ?? [];
$userId = (int)($body['id'] ?? 0);
if (!$userId) Api::error(422, 'ValidationError', 'id is required');

$stmt = $conn->prepare('DELETE FROM rotation_nurses WHERE id = ?');
$stmt->bind_param('i', $userId);
if (!$stmt->execute()) {
    Api::error(500, 'ServerError', 'Could not delete the account. Please try again.');
}
$deleted = $stmt->affected_rows > 0;
$stmt->close();

if (!$deleted) {
    Api::error(404, 'NotFound', 'Rotation Nurse account not found');
}

$permManager = new PermissionManager($conn);
$permManager->logAudit($account->getId(), 'delete_user', 'rotation_nurses', $userId);

Api::success(['id' => $userId, 'deleted' => true]);
