<?php
// penalize_hacker.php
header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
header("Pragma: no-cache");
header('Content-Type: application/json');
require 'db.php';

$input = json_decode(file_get_contents('php://input'), true);
$guestId = (int) ($input['guest_id'] ?? 0);

if ($guestId <= 0) {
    echo json_encode(['status' => 'error', 'message' => 'Invalid biometric identity']);
    exit;
}

try {
    // Kara -50 punktów
    $penalty = 50;

    $stmt = $pdo->prepare("UPDATE guests SET points = points - ? WHERE id = ?");
    $stmt->execute([$penalty, $guestId]);

    // Fetch new total (optional for logging/display)
    $stmt = $pdo->prepare("SELECT name, points FROM guests WHERE id = ?");
    $stmt->execute([$guestId]);
    $guest = $stmt->fetch();

    echo json_encode([
        'status' => 'success',
        'message' => 'Security protocol executed. Penalty applied.',
        'guest_name' => $guest['name'],
        'current_points' => (int) $guest['points']
    ]);

} catch (Exception $e) {
    echo json_encode(['status' => 'error', 'message' => 'System error during penalty application']);
}
?>