<?php
require_once "../includes/auth.php";
requireAdmin();

require_once "../includes/config.php";

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    exit('Method not allowed');
}

requireValidCsrf();

if (!isset($_POST['id'])) {
    header("Location: news_manage.php");
    exit;
}

$id = (int)$_POST['id'];

$approved_by = $_SESSION['member_id'];

$stmt = $conn->prepare("
UPDATE news
SET
    status='published',
    approved_by=?,
    approved_at=NOW()
WHERE id=? AND status='pending'
");

$stmt->bind_param("ii", $approved_by, $id);
$stmt->execute();

header("Location: news_manage.php");
exit;
