<?php
require_once __DIR__ . '/../../connect.php';

// Force passenger_id from JWT — never trust user-supplied passenger_id
if ($role !== 'passenger') {
    jsonError("Only passengers can submit ratings");
    exit;
}
$passenger_id = $user_id;
$driverID = filterRequest("driverID");
$rideId = filterRequest("rideId");
$rating = filterRequest("rating");
$comment = filterRequest("comment");

$sql = "INSERT INTO `ratingPassenger` (
    `passenger_id`, `driverID`, `rideId`, `rating`, `comment`
) VALUES (
    :passenger_id, :driverID, :rideId, :rating, :comment
)";

$stmt = $con->prepare($sql);
$stmt->bindParam(':passenger_id', $passenger_id);
$stmt->bindParam(':driverID', $driverID);
$stmt->bindParam(':rideId', $rideId);
$stmt->bindParam(':rating', $rating);
$stmt->bindParam(':comment', $comment);

$stmt->execute();

if ($stmt->rowCount() > 0) {
    jsonSuccess(null, "Rate inserted successfully");
} else {
    jsonError("Failed to save rating information");
}
?>