<?php
require_once __DIR__ . '/auth.php';
admin_require_login();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: dashboard.php');
    exit;
}

admin_check_csrf();

$id = (int) ($_POST['id'] ?? 0);
if ($id > 0) {
    db()->prepare('DELETE FROM rsvps WHERE id = ?')->execute([$id]);
}

$back = (string) ($_POST['back'] ?? '');
if ($back !== '' && $back[0] !== '?') {
    $back = '';
}
header('Location: dashboard.php' . $back);
