✏ EDIT: booking_list.php

<?php
// Returns a list of bookings. Admins can optionally filter by
// booking_status via the status parameter. Customers receive only
// their own bookings.

require_once __DIR__ . '/bootstrap.php';

$user = require_login();

// Optional status filter
$status = isset($_GET['status']) ? trim($_GET['status']) : '';

try {
    if ($user['role'] === 'ADMIN') {
        if ($status !== '') {
            $stmt = $pdo->prepare('SELECT id, customer_name, total_amount, booking_status, payment_status, return_status, created_at FROM bookings WHERE booking_status = ? ORDER BY created_at DESC');
            $stmt->execute([$status]);
        } else {
            $stmt = $pdo->prepare('SELECT id, customer_name, total_amount, booking_status, payment_status, return_status, created_at FROM bookings ORDER BY created_at DESC');
            $stmt->execute();
        }
    } else {
        // Customer: always filter by their id
        $customerId = $user['id'];
        $stmt = $pdo->prepare('SELECT id, customer_name, total_amount, booking_status, payment_status, return_status, created_at FROM bookings WHERE customer_id = ? ORDER BY created_at DESC');
        $stmt->execute([$customerId]);
    }
    $bookings = $stmt->fetchAll();
    respond($bookings);
} catch (PDOException $e) {
    respond(null, 'Database error');
}

[✗] CANCEL