<?php
// GET /api/auth/profile.php — Protected
require_once __DIR__ . '/../init.php';

if ($_SERVER['REQUEST_METHOD'] !== 'GET') Response::error('Method not allowed.', 405);

$user = AuthMiddleware::verifyToken();
$db   = DB::conn();

$stmt = $db->prepare(
    'SELECT u.id, u.username, u.email, u.phone, u.role, u.avatar_url,
            u.full_name, u.is_email_verified, u.is_phone_verified, u.created_at,
            sp.shop_name, sp.shop_desc, sp.shop_logo, sp.is_approved
     FROM users u
     LEFT JOIN seller_profiles sp ON sp.user_id = u.id
     WHERE u.id = ?'
);
$stmt->execute([$user['id']]);
$profile = $stmt->fetch();

if (!$profile) Response::error('User not found.', 404);

$profile['id'] = (int)$profile['id'];
$profile['is_email_verified'] = (bool)$profile['is_email_verified'];
$profile['is_phone_verified'] = (bool)$profile['is_phone_verified'];

Response::success('Profile fetched.', ['user' => $profile]);