<?php
// POST /api/auth/apply_seller.php — Protected (buyer -> seller upgrade)
require_once __DIR__ . '/../init.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') Response::error('Method not allowed.', 405);

$authUser = AuthMiddleware::verifyToken();
$body     = getBody();

$shopName = trim($body['shop_name'] ?? '');
$shopDesc = trim($body['shop_desc'] ?? '') ?: null;

if (!$shopName) Response::error('Shop name is required.');
if (strlen($shopName) < 3 || strlen($shopName) > 100) {
    Response::error('Shop name must be 3–100 characters.');
}

$db = DB::conn();

// ─── Check existing application ───────────────────────────
$stmt = $db->prepare('SELECT id FROM seller_profiles WHERE user_id = ?');
$stmt->execute([$authUser['id']]);
if ($stmt->fetch()) Response::error('Seller application already submitted.', 409);

// ─── Insert seller profile ────────────────────────────────
$stmt = $db->prepare(
    'INSERT INTO seller_profiles (user_id, shop_name, shop_desc, is_approved, approved_at)
     VALUES (?, ?, ?, 1, NOW())'
);
$stmt->execute([$authUser['id'], $shopName, $shopDesc]);

// ─── Elevate role to seller ───────────────────────────────
$db->prepare("UPDATE users SET role = 'seller' WHERE id = ?")
   ->execute([$authUser['id']]);

// ─── Issue new access token with updated role ─────────────
$stmt = $db->prepare('SELECT id, username, email, role, avatar_url FROM users WHERE id = ?');
$stmt->execute([$authUser['id']]);
$updatedUser = $stmt->fetch();

$newAccessToken = buildAccessToken($updatedUser);

Response::success('Congratulations! Your seller account is now active.', [
    'role'        => 'seller',
    'shop_name'   => $shopName,
    'accessToken' => $newAccessToken,
]);