<?php
ini_set('display_errors', 0);
error_reporting(E_ALL);
header('Content-Type: application/json; charset=utf-8');

require_once __DIR__ . '/../config/config.php';
session_start();

if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true) { http_response_code(401); echo json_encode(['ok'=>false]); exit; }
if (($_SESSION['role'] ?? 'user') !== 'admin') { http_response_code(403); echo json_encode(['ok'=>false]); exit; }

$id = (int)($_POST['id'] ?? 0);
if ($id <= 0) { http_response_code(400); echo json_encode(['ok'=>false,'error'=>'Missing id']); exit; }
if ($id === (int)($_SESSION['id'] ?? 0)) { http_response_code(400); echo json_encode(['ok'=>false,'error'=>'Du kannst dein eigenes Passwort hier nicht resetten']); exit; }

$st = $pdo->prepare("UPDATE users SET password_hash=NULL, first_login=1 WHERE id=:id");
$st->execute([':id'=>$id]);

echo json_encode(['ok'=>true]);