<?php
session_start();

if (!isset($_SESSION["user"]) || empty($_SESSION["user"]["is_admin"])) {
    header("Location: ../Index.php");
    exit;
}

require "../Auth/db.php";

$id = $_POST["id"] ?? null;
$isVip = $_POST["is_vip"] ?? 0;
$isBanned = $_POST["is_banned"] ?? 0;

if (!$id) {
    die("Missing user ID.");
}

$stmt = $pdo->prepare("
    UPDATE users
    SET is_vip = ?, is_banned = ?
    WHERE id = ?
");

$stmt->execute([$isVip, $isBanned, $id]);

header("Location: UserProfile.php?id=" . urlencode($id));
exit;