<?php

require_once __DIR__ . '/functions.php';
require_once __DIR__ . '/app/platform-admin.php';
require_once __DIR__ . '/app/audit.php';

$pdo = app_db_pdo();
$user = app_require_platform_admin($pdo);
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: backoffice.php');
    exit;
}
app_require_csrf();

$requestId = filter_var($_POST['request_id'] ?? null, FILTER_VALIDATE_INT);
if ($requestId === false || $requestId <= 0) {
    http_response_code(400);
    exit('Ungültige Rechtserklärung.');
}
$stmt = $pdo->prepare('SELECT tenant_id, reference_code FROM legal_requests WHERE id = ? LIMIT 1');
$stmt->execute([$requestId]);
$request = $stmt->fetch();
if ($request === false) {
    http_response_code(404);
    exit('Rechtserklärung nicht gefunden.');
}
$pdo->prepare("UPDATE legal_requests SET status = 'processed', processed_at = NOW() WHERE id = ?")
    ->execute([$requestId]);
app_audit_log(
    $pdo,
    $request['tenant_id'] !== null ? (int)$request['tenant_id'] : null,
    (int)$user['user_id'],
    'legal_request.processed',
    'legal_request',
    (int)$requestId,
    ['reference_code' => (string)$request['reference_code']]
);

header('Location: backoffice.php?legal_request=processed');
exit;