<?php
// Backoffice gym switcher: sets which gym the content pages edit (session),
// then goes back to where the admin was. POST + CSRF only.
require __DIR__ . '/../../../config/db.php';
require __DIR__ . '/../../../config/functions.php';
$user = require_admin();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_check();
    $gym = db_gyms_get($pdo, (int) ($_POST['gym_id'] ?? 0));
    if ($gym && $gym['deleted_at'] === null) {
        $_SESSION['admin_gym_id'] = (int) $gym['id'];
        session()->setFlashdata('success', 'A editar: ' . $gym['name'] . '.');
    }
}
// Only same-site backoffice paths as the return target.
$back = (string) ($_POST['back'] ?? '');
if (!preg_match('~^views/[A-Za-z0-9_/.-]+\.php(\?[A-Za-z0-9_=&%.-]*)?$~', $back) || str_contains($back, '..')) {
    $back = 'views/admin/dashboard.php';
}
header('Location: ' . base_url($back));
exit;