<?php
$page_title = 'Step 4 — Remove email from allowlist';
require 'header.php';
?>

<p>
    The complement to Step 3: <span class="endpoint">POST /allowlists/delete</span>
    takes an email address off the allowlist. Useful for cleaning up test data,
    or for revoking an override when someone really shouldn't be receiving mail
    from you any more.
</p>

<h2>Try it</h2>

<form method="post" onsubmit="return confirm('Remove this email from the allowlist?');">
    <label>Email address <small>(required)</small></label>
    <input type="email" name="email" required value="<?= h($_POST['email'] ?? '') ?>" placeholder="user@example.com">

    <button type="submit" name="run" class="danger">Remove from allowlist</button>
</form>

<?php
if (isset($_POST['run']) && is_configured() && !empty($_POST['email'])) {

    // --- The call --------------------------------------------
    $result = mandrill_call('/allowlists/delete', [
        'email' => trim($_POST['email']),
    ]);
    // ---------------------------------------------------------

    if (!mandrill_is_error($result)) {
        $deleted = $result['decoded']['deleted'] ?? false;
        if ($deleted) {
            echo '<div class="callout ok"><strong>Removed.</strong> '
               . h($_POST['email']) . ' is no longer on the allowlist.</div>';
        } else {
            echo '<div class="callout info"><strong>Nothing to remove.</strong> '
               . 'The API returned <code>deleted: false</code>, which means the '
               . 'address wasn\'t on the allowlist in the first place — not an error.</div>';
        }
    }

    render_debug($result);
}
?>

<h2>The call</h2>

<pre><code>$result = mandrill_call('/allowlists/delete', [
    'email' =&gt; 'user@example.com',
]);

if ($result['decoded']['deleted']) {
    echo 'Removed';
}</code></pre>

<h2>Response shape</h2>

<pre><code>{
    "email":   "user@example.com",
    "deleted": true
}</code></pre>

<p>
    Same convention as add: <code>deleted: true</code> means the row was
    there and got removed, <code>deleted: false</code> means it wasn't
    there. Both are HTTP 200.
</p>

<div class="callout info">
    <strong>Heads up:</strong> removing from the allowlist does <em>not</em>
    add the address to the denylist. It just removes the override. The
    address will now be subject to Mandrill's normal rejection rules again.
</div>

<p><a href="05-send.php">→ Next: actually send an email</a></p>

<?php require 'footer.php'; ?>
