<?php include 'protect.php'; ?>

<?php
include 'db.php';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $id = intval($_POST['id'] ?? 0);
    $field = $_POST['field'] ?? '';
    $value = $_POST['value'] ?? '';

    $allowed_fields = ['quantity', 'price', 'notes'];
    if ($id > 0 && in_array($field, $allowed_fields)) {
        if (in_array($field, ['quantity', 'price'])) {
            $value = floatval($value);
        }

        $stmt = $conn->prepare("UPDATE transactions SET $field = ? WHERE id = ?");
        $stmt->bind_param(in_array($field, ['quantity', 'price']) ? "di" : "si", $value, $id);
        $stmt->execute();
        echo json_encode(['success' => true]);
        exit;
    }
}

echo json_encode(['success' => false]);