<?php
/**
 * user-management-ajax.php — async JSON endpoint for User Management mutations.
 * Thin wrapper around whp_ajax_endpoint (auth + CSRF + JSON envelope) + the
 * shared action handler. User Management is permission-gated (not strictly
 * root) via the 'user-management' API permission, so we run the same
 * check_api_permission('user-management') gate the page's other async
 * endpoint (api/delete-user-ajax.php) uses, on top of the standard auth gate.
 * Mirrors api/announcement-ajax.php.
 */
require_once __DIR__ . '/../includes/whp-ajax-endpoint.php';   // also loads auto-prepend (AUTH_USER, CSRF, check_api_permission)
require_once __DIR__ . '/../libs/usermgmt.php';
require_once __DIR__ . '/../libs/user_management_actions.php';

whp_ajax_endpoint(function () {
    // Permission gate mirrors api/delete-user-ajax.php. On denial this
    // emits its own {status:error} JSON and exits before the handler runs.
    check_api_permission('user-management');

    $UserMgmt = new usermgmt();
    return whp_user_management_handle_action($UserMgmt);
});
