<?php
// Root-only API: re-enable a WHP account (cascades to all its sites).
// POST params: username
// Returns JSON: { "ok": true, "sites": {...}, "site_count": N } or { "ok": false, "error": "..." }

require_once('/docker/whp/web/libs/permission_checker.php');
require_once('/docker/whp/web/libs/account_disable.php');

header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo '{}';
    return;
}
if (!validate_csrf_token()) {
    http_response_code(403);
    echo json_encode(['ok' => false, 'error' => 'csrf']);
    return;
}
if (!is_root_user()) {
    http_response_code(403);
    echo json_encode(['ok' => false, 'error' => 'forbidden']);
    return;
}

$username = trim((string)($_POST['username'] ?? ''));
$actor    = defined('AUTH_USER') ? AUTH_USER : 'unknown';

if ($username === '') {
    http_response_code(400);
    echo json_encode(['ok' => false, 'error' => 'empty_username']);
    return;
}

echo json_encode(enable_account($username, $actor));
