<?php
require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../auth/protect_admin.php';

if (!empty($_POST['ids']) && is_array($_POST['ids'])) {
    $ids = array_map('intval', $_POST['ids']);
    $in  = implode(',', $ids);

    // hapus foto juga
    $stmt = $pdo->query("SELECT foto FROM siswa WHERE id IN ($in)");
    $rows = $stmt->fetchAll();
    foreach ($rows as $r) {
        if (!empty($r['foto'])) {
            @unlink(__DIR__ . '/../upload/siswa/' . $r['foto']);
        }
    }

    $pdo->query("DELETE FROM siswa WHERE id IN ($in)");
    echo json_encode(['status' => 'ok']);
    exit;
}

echo json_encode(['status' => 'no_ids']);
exit;
