<?php require_once __DIR__ . '/../../app/bootstrap.php'; App\Core\Auth::requireRole(['admin']); if(!verify_csrf()) App\Core\Response::json(['ok'=>false,'message'=>'Invalid CSRF'],419); $id=(int)($_POST['order_id']??0); $status=$_POST['status']??'pending'; if(!in_array($status,['pending','confirmed','processing','shipped','delivered','cancelled'],true)) App\Core\Response::json(['ok'=>false,'message'=>'Invalid status'],422); App\Core\Database::execute('UPDATE orders SET order_status=?, updated_at=NOW() WHERE id=?',[$status,$id]); if($status==='delivered'){ App\Core\Database::safeExecute('UPDATE orders SET payment_status=CASE WHEN payment_method="cod" THEN "paid" ELSE payment_status END,paid_amount=CASE WHEN payment_method="cod" THEN total_amount ELSE paid_amount END,due_amount=CASE WHEN payment_method="cod" THEN 0 ELSE due_amount END WHERE id=?',[$id]); } App\Core\Database::execute('INSERT INTO order_status_history (order_id,status,note,created_by,created_at) VALUES (?,?,?,?,NOW())',[$id,$status,'Admin status update',App\Core\Auth::id()]); if($status==='delivered') App\Core\AffiliateService::processOrder($id); App\Core\Response::json(['ok'=>true]);
