<?php
/**
 * Flip the current supervisor/manager's REPORT display timezone (EST ⇄ IST) and remember it per user.
 * VIEW-only — record stamping is always Eastern (see includes/db.php + config APP_TIMEZONE). POST + CSRF.
 */
require_once __DIR__ . '/../includes/config.php';
$user = require_login('internal');
csrf_check_or_die();
if (!can_toggle_report_tz()) { http_response_code(403); exit('Forbidden'); }

$tz = (($_POST['tz'] ?? '') === 'IST') ? 'IST' : 'EST';
try { db()->prepare("UPDATE users SET report_tz=? WHERE id=?")->execute([$tz, (int) $user['id']]); }
catch (Throwable $e) { /* column self-provisions on the next authenticated load; session still applies below */ }
$_SESSION['report_tz'] = $tz;
audit_log('user.report_tz.set', 'user', (int) $user['id'], null, ['tz' => $tz]);

redirect(back_url('/admin/'));
