<?php
// Removes all passkeys for the signed-in user (disables biometric sign-in).
session_start();
header('Content-Type: application/json');
require_once __DIR__ . '/config/db.php';
require_once __DIR__ . '/includes/webauthn.php';
if (empty($_SESSION['user_id'])) { http_response_code(401); echo json_encode(['ok' => false]); exit; }
wa_ensure_table($conn);
$uid = (int)$_SESSION['user_id'];
$d = $conn->prepare("DELETE FROM webauthn_credentials WHERE user_id=?");
$d->bind_param("i", $uid);
echo json_encode(['ok' => (bool)$d->execute()]);
