<?php
session_start();
require_once '../config/database.php';

// Security: Admin only
if (!isset($_SESSION['role']) || $_SESSION['role'] !== 'admin') {
    die("Unauthorized.");
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $exam_id = $_POST['exam_id'];
    $student_id = $_POST['student_id'];

    try {
        $pdo->beginTransaction();

        // 1. Delete the results entry so the 'Prevent Re-taking' check passes
        $stmt = $pdo->prepare("DELETE FROM exam_results WHERE exam_id = ? AND student_id = ?");
        $stmt->execute([$exam_id, $student_id]);

        // 2. Optional: Delete detailed answers if you store them in a separate table
        // $stmt = $pdo->prepare("DELETE FROM student_answers WHERE exam_id = ? AND student_id = ?");
        // $stmt->execute([$exam_id, $student_id]);

        $pdo->commit();
        header("Location: view_results.php?msg=rescheduled");
    } catch (Exception $e) {
        $pdo->rollBack();
        die("Error: " . $e->getMessage());
    }
}