<?php
session_start();
require_once '../config/database.php';

// Check if user is logged in and is admin
if (!isset($_SESSION['user_id']) || ($_SESSION['role'] !== 'admin' && $_SESSION['role'] !== 'director')) {
    http_response_code(403);
    exit('Unauthorized');
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['order'])) {
    $order = json_decode($_POST['order'], true);
    
    if (is_array($order)) {
        $conn->begin_transaction();
        
        try {
            $stmt = $conn->prepare("UPDATE slider_images SET order_number = ? WHERE id = ?");
            
            foreach ($order as $item) {
                $stmt->bind_param("ii", $item['order'], $item['id']);
                $stmt->execute();
            }
            
            $conn->commit();
            echo json_encode(['success' => true]);
        } catch (Exception $e) {
            $conn->rollback();
            http_response_code(500);
            echo json_encode(['error' => $e->getMessage()]);
        }
    } else {
        http_response_code(400);
        echo json_encode(['error' => 'Invalid order data']);
    }
} else {
    http_response_code(400);
    echo json_encode(['error' => 'Invalid request']);
}