<?php
require_once '../../../config/cors.php';
require_once '../../../config/db.php';
require_once '../../../helpers/response.php';
require_once '../auth.php';

$user = requirePublicAuth();
$data = json_decode(file_get_contents('php://input'), true);
$message_id = $data['message_id'] ?? null;

if (!$message_id) {
    sendError('Message ID required', 400);
}

// Only delete if user owns this message
$stmt = $pdo->prepare("
    UPDATE chat_messages 
    SET is_deleted = 1 
    WHERE id = ? AND user_id = ? AND user_type = 'public'
");
$stmt->execute([$message_id, $user['id']]);

if ($stmt->rowCount() === 0) {
    sendError('Message not found or you do not have permission to delete it', 403);
}

sendSuccess(null, 'Message deleted');
?>