<?php
require_once '../../config/db.php';
// Ideally check Admin Auth here
// In this demo, we assume the folder is protected or we simply return data

header('Content-Type: application/json');

try {
    $status = isset($_GET['status']) ? $_GET['status'] : null;

    $sql = "SELECT r.*, u1.username as reporter, u2.username as reported 
            FROM reports r 
            JOIN users u1 ON r.reporter_id = u1.id 
            LEFT JOIN users u2 ON r.reported_id = u2.id";
            
    if ($status) {
        $sql .= " WHERE r.status = :status";
    }
    
    $sql .= " ORDER BY r.created_at DESC LIMIT 50";

    $stmt = $pdo->prepare($sql);
    if ($status) $stmt->bindParam(':status', $status);
    $stmt->execute();
    
    $reports = $stmt->fetchAll(PDO::FETCH_ASSOC);

    echo json_encode([
        'count' => count($reports),
        'data' => $reports
    ]);

} catch (PDOException $e) {
    http_response_code(500);
    echo json_encode(['error' => $e->getMessage()]);
}
?>
