<?php
session_start();
include '../functions.php';

header('Content-Type: application/json');

if (!isset($_SESSION['user_id']) || !isset($_SESSION['email'])) {
    echo json_encode(['success' => false, 'message' => 'Session expired. Please log in again.']);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    echo json_encode(['success' => false, 'message' => 'Invalid request method.']);
    exit;
}

$input = json_decode(file_get_contents('php://input'), true) ?? [];
$pin   = trim($input['pin'] ?? '');

if ($pin === '') {
    echo json_encode(['success' => false, 'message' => 'Please enter your transaction PIN.']);
    exit;
}

$stmt = $connect->prepare("SELECT pin FROM users WHERE id = ? LIMIT 1");
$stmt->bind_param("i", $_SESSION['user_id']);
$stmt->execute();
$row = $stmt->get_result()->fetch_assoc();
$stmt->close();

if (!$row || $pin !== (string)$row['pin']) {
    echo json_encode(['success' => false, 'message' => 'Incorrect PIN. Please try again.']);
    exit;
}

echo json_encode(['success' => true]);
