<?php
//paneladm.jatpluss.com/admin/admin_delete_correo.php

session_start();
header('Content-Type: application/json');

if (empty($_SESSION['admin_id'])) {
    http_response_code(403);
    echo json_encode(['error'=>'No autorizado']); exit;
}
require_once __DIR__.'/conexion.php';

/* --- CSRF --- */
if (empty($_POST['csrf_token']) || $_POST['csrf_token'] !== ($_SESSION['csrf_token'] ?? '')) {
    echo json_encode(['error'=>'CSRF inválido']); exit;
}

/* --- ID --- */
$id = (int)($_POST['id'] ?? 0);
if ($id <= 0) { echo json_encode(['error'=>'ID inválido']); exit; }

try {
    $stm = $pdo->prepare("DELETE FROM usuarios_correos WHERE id = ?");
    $stm->execute([$id]);
    echo json_encode(
        $stm->rowCount()
        ? ['success'=>'Registro eliminado']
        : ['error'=>'Registro no encontrado']
    );
} catch (PDOException $e) {
    http_response_code(500);
    echo json_encode(['error'=>'Error BD: '.$e->getMessage()]);
}
