<?php // review.php
require_once __DIR__ . '/../config.php'; require_admin();

$db = contracts_db();
mysqli_set_charset($db, 'utf8mb4');             // <-- juda muhim
$db->query("SET NAMES utf8mb4 COLLATE utf8mb4_unicode_ci");
$db->query("SET time_zone = '+05:00'");

$in=json_decode(file_get_contents('php://input'), true);
$id=(int)($in['id']??0); $status=$in['status']??'pending'; $note=$in['note']??null;
if(!$id || !in_array($status,['pending','approved','rejected'])) json_out(['error'=>'Bad request'],400);
$uid=current_user()['id']??null;
$st=db()->prepare("UPDATE kpi_submissions SET status=?, reviewer_id=?, review_note=?, reviewed_at=NOW() WHERE id=?");
$st->bind_param("sisi",$status,$uid,$note,$id); $st->execute(); json_out(['ok'=>true]);
