<?php
header("Content-Type: application/json");
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: POST, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Accept");

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}

include_once '../db_config.php';

$data = json_decode(file_get_contents("php://input"));

if (
    !empty($data->exam_id) &&
    !empty($data->student_id) &&
    isset($data->restrict)
) {
    try {
        $exam_id = (int)$data->exam_id;
        $student_id = (int)$data->student_id;
        $restrict = (bool)$data->restrict;

        if ($restrict) {
            // Check if restriction already exists
            $check_query = "SELECT COUNT(*) FROM exam_restrictions WHERE exam_id = ? AND student_id = ?";
            $check_stmt = $conn->prepare($check_query);
            $check_stmt->execute([$exam_id, $student_id]);
            $exists = $check_stmt->fetchColumn() > 0;

            if (!$exists) {
                // Insert restriction
                $insert_query = "INSERT INTO exam_restrictions (exam_id, student_id) VALUES (?, ?)";
                $insert_stmt = $conn->prepare($insert_query);
                $insert_stmt->execute([$exam_id, $student_id]);
            }
            $message = "Student restricted from taking the exam.";
        } else {
            // Delete restriction
            $delete_query = "DELETE FROM exam_restrictions WHERE exam_id = ? AND student_id = ?";
            $delete_stmt = $conn->prepare($delete_query);
            $delete_stmt->execute([$exam_id, $student_id]);
            $message = "Student restriction removed.";
        }

        echo json_encode([
            "success" => true,
            "message" => $message
        ]);

    } catch (PDOException $e) {
        http_response_code(500);
        echo json_encode([
            "success" => false,
            "message" => "Database error: " . $e->getMessage()
        ]);
    }
} else {
    http_response_code(400);
    echo json_encode([
        "success" => false,
        "message" => "Incomplete request. Exam ID, Student ID, and restrict values are required."
    ]);
}
?>