✏ EDIT: booking_detail.php

<?php
// Returns details of a single booking including associated items and
// payments. Only the owner (customer) or an administrator can access
// a booking's details.

require_once __DIR__ . '/bootstrap.php';

$user = require_login();

$id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
if ($id <= 0) {
    respond(null, 'Invalid booking ID');
}

try {
    // Fetch booking
    $stmt = $pdo->prepare('SELECT * FROM bookings WHERE id = ?');
    $stmt->execute([$id]);
    $booking = $stmt->fetch();
    if (!$booking) {
        respond(null, 'Booking not found');
    }
    // Access control: customers can only view their own bookings
    if ($user['role'] !== 'ADMIN' && $booking['customer_id'] != $user['id']) {
        respond(null, 'Access denied');
    }
    // Fetch booking items
    $stmt = $pdo->prepare('SELECT item_id, item_name_snapshot, price_per_unit_snapshot, qty_booked, qty_returned, damage_qty, damage_comment FROM booking_items WHERE booking_id = ?');
    $stmt->execute([$id]);
    $items = $stmt->fetchAll();
    // Fetch payments
    $stmt = $pdo->prepare('SELECT id, booking_id, amount, method, txn_ref, status, created_at FROM payments WHERE booking_id = ?');
    $stmt->execute([$id]);
    $payments = $stmt->fetchAll();
    $booking['items'] = $items;
    $booking['payments'] = $payments;
    respond($booking);
} catch (PDOException $e) {
    respond(null, 'Database error');
}

[✗] CANCEL