<?php
if (session_status() == PHP_SESSION_NONE) {
    session_start();
}
require_once '../includes/db.php';
require_once '../includes/auth.php';

check_role('alumno');

$user = get_logged_in_user();

// Get student
$stmt = $pdo->prepare("SELECT * FROM students WHERE user_id = ?");
$stmt->execute([$user['id']]);
$student = $stmt->fetch();

if (!$student) {
    echo json_encode(['success' => false, 'message' => 'Student profile not found.']);
    exit;
}

$notification_id = $_POST['notification_id'] ?? 0;

if (!$notification_id) {
    echo json_encode(['success' => false, 'message' => 'Invalid notification ID.']);
    exit;
}

// Check if notification belongs to user
$stmt = $pdo->prepare("SELECT id FROM notifications WHERE id = ? AND user_id = ?");
$stmt->execute([$notification_id, $user['id']]);
$notification = $stmt->fetch();

if (!$notification) {
    echo json_encode(['success' => false, 'message' => 'Notification not found or access denied.']);
    exit;
}

// Delete notification
$stmt = $pdo->prepare("DELETE FROM notifications WHERE id = ? AND user_id = ?");
if ($stmt->execute([$notification_id, $user['id']])) {
    echo json_encode(['success' => true, 'message' => 'Notificación eliminada exitosamente.']);
} else {
    echo json_encode(['success' => false, 'message' => 'No se pudo eliminar la notificación.']);
}
?>