<?php
/**
 * security-management-ajax.php — async JSON endpoint for Security Management
 * mutations (block/unblock IP, add/remove exemption, update log-monitoring
 * config, sync blocked IPs). Thin wrapper around whp_ajax_endpoint (auth + CSRF
 * + JSON envelope) + the shared action handler. Security Management is
 * root-only, so we add a root gate on top of the standard auth gate. Mirrors
 * api/announcement-ajax.php.
 */
require_once __DIR__ . '/../includes/whp-ajax-endpoint.php';   // also loads auto-prepend (AUTH_USER, CSRF)
require_once __DIR__ . '/../libs/security_manager.php';
require_once __DIR__ . '/../libs/log_monitor_manager.php';
require_once __DIR__ . '/../libs/security_management_actions.php';

whp_ajax_endpoint(function () {
    if (AUTH_USER !== 'root') {
        return ['message' => 'Only root users can manage security settings', 'type' => 'danger'];
    }
    $SecManager = new security_manager();
    $LogMonitor = new log_monitor_manager();
    return whp_security_management_handle_action($SecManager, $LogMonitor);
});
