<?php
require __DIR__ . '/_bootstrap.php';
require_admin();

$posted = $_POST['csrf'] ?? '';
$sessionToken = $_SESSION['csrf_token'] ?? $_SESSION['csrf'] ?? null;

if (!$sessionToken || !hash_equals($sessionToken, $posted)) {
  http_response_code(403);
  header('Location: ' . url_for('/admin/students.php?msg=' . urlencode('❌ Invalid CSRF. Please try again.')));
  exit;
}

$id = (int)($_POST['id'] ?? 0);
if ($id > 0) {
  $del = $pdo->prepare("DELETE FROM students WHERE id=?");
  $del->execute([$id]);
}
header('Location: ' . url_for('/admin/students.php?msg=' . urlencode('✅ Student deleted.')));
exit;
