<?php
require_once __DIR__ . '/../../connect.php';

// حارس الصلاحيات: رفع الحظر عملية إدارية، وكانت هذه النقطة بلا أي فحص دور.
if ($role !== 'admin' && $role !== 'super_admin') {
    http_response_code(403);
    echo json_encode([
        'status'  => 'failure',
        'message' => 'Forbidden. Admin access required.',
    ], JSON_UNESCAPED_UNICODE);
    exit;
}

function normalize_phone($s) { return preg_replace('/\D+/', '', (string)$s); }

$phone = filterRequest("phone");
if (empty($phone)) { jsonError("phone is required"); exit; }

$phn = normalize_phone($phone);
$stmt = $con->prepare("DELETE FROM passenger_blacklist WHERE phone_normalized = :phn");
$stmt->execute(['phn' => $phn]);

if ($stmt->rowCount() > 0) { jsonSuccess(null, "Removed from blacklist"); }
else                       { jsonError("Phone was not blacklisted"); }