<?php
declare(strict_types=1);

require __DIR__ . '/config.php';
require_login();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo 'Method not allowed.';
    exit;
}

if (!verify_csrf($_POST['csrf_token'] ?? null)) {
    http_response_code(419);
    echo 'Invalid CSRF token.';
    exit;
}

$id = filter_var($_POST['id'] ?? '', FILTER_VALIDATE_INT);
if ($id === false || $id === null) {
    header('Location: /requests.php?error=Invalid+request+ID.');
    exit;
}

$stmt = db()->prepare('SELECT id, status FROM vm_requests WHERE id = ?');
$stmt->execute([$id]);
$request = $stmt->fetch();

if (!$request) {
    header('Location: /requests.php?error=Request+not+found.');
    exit;
}

if ($request['status'] !== 'queued') {
    header('Location: /requests.php?error=Only+queued+requests+can+be+cancelled.');
    exit;
}

try {
    $stmt = db()->prepare('UPDATE vm_requests SET status = ? WHERE id = ?');
    $stmt->execute(['cancelled', $id]);
} catch (PDOException $e) {
    header('Location: /requests.php?error=Failed+to+cancel+request.');
    exit;
}

header('Location: /requests.php?cancelled=1');
exit;