<?php
// Test script to verify Order Tracking API response and ownership security

$ch = curl_init('http://localhost/shop/login');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, __DIR__ . '/cookie_seller.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, __DIR__ . '/cookie_seller.txt');
$res = curl_exec($ch);
preg_match('/name="csrf_token" value="([^"]+)"/', $res, $m);
$csrf = $m[1] ?? '';

// Login as seller (User ID 3, owner of Order 3)
curl_setopt($ch, CURLOPT_URL, 'http://localhost/shop/login');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['csrf_token' => $csrf, 'username' => 'seller', 'password' => 'Seller@123']));
curl_exec($ch);

// Test 1: Fetch Order 3 tracking (Owner access)
curl_setopt($ch, CURLOPT_URL, 'http://localhost/shop/orders/3/tracking');
curl_setopt($ch, CURLOPT_HTTPGET, true);
$res1 = curl_exec($ch);
echo "=== Test 1: Owner accessing Order 3 tracking ===\n" . $res1 . "\n\n";

// Test 2: Try to fetch Order 1 tracking (Order 1 belongs to user_id=2, but logged in as user_id=3)
curl_setopt($ch, CURLOPT_URL, 'http://localhost/shop/orders/1/tracking');
$res2 = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "=== Test 2: Security check - Owner trying to access Order 1 (HTTP {$httpCode}) ===\n" . $res2 . "\n\n";