<?php
require_once __DIR__ . '/../../config/cors.php';
require_once __DIR__ . '/../../config/jwt.php';

auth_required();

if ($_SERVER['REQUEST_METHOD'] !== 'PUT') {
    http_response_code(405); echo json_encode(['error' => 'Method not allowed']); exit;
}

$body   = json_decode(file_get_contents('php://input'), true);
$id     = (int)($body['id'] ?? 0);
$status = $body['status'] ?? '';

$allowed = ['pending', 'in_progress', 'completed'];
if (!$id || !in_array($status, $allowed)) {
    http_response_code(400); echo json_encode(['error' => 'Invalid input']); exit;
}

$stmt = $pdo->prepare('UPDATE parcels SET survey_status = ? WHERE id = ?');
$stmt->execute([$status, $id]);

echo json_encode(['success' => true]);
