<?php
session_start();
header('Content-Type: application/json');
require_once("../../includes/config.php");

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_SESSION['admin_id'])) {
    $input_pass = $_POST['current_password'] ?? '';

    $stmt = $pdo->prepare("SELECT password FROM admin_account WHERE id = ?");
    $stmt->execute([$_SESSION['admin_id']]);
    $user = $stmt->fetch();

    if ($user && password_verify($input_pass, $user['password'])) {
        echo json_encode(['status' => 'success']);
    } else {
        echo json_encode(['status' => 'error', 'message' => 'Current password does not match our records.']);
    }
}
exit;
?>