<?php
declare(strict_types=1);

require_once dirname(__DIR__) . '/_admin_auth.php';

golder_require_method('POST');
$adminUser = golder_api_admin_auth();
$master = golder_master_pdo();
golder_ensure_payment_tables($master);

$input = golder_api_input();
$requestId = trim((string)($input['payment_request_id'] ?? ''));
$message = trim((string)($input['message'] ?? ''));
if ($requestId === '' || $message === '') {
    golder_json_response(['status' => 'error', 'message' => 'payment_request_id and message are required'], 400);
}

$st = $master->prepare('SELECT id FROM payment_requests WHERE id = :id LIMIT 1');
$st->execute([':id' => $requestId]);
if (!$st->fetch()) {
    golder_json_response(['status' => 'error', 'message' => 'Payment request not found'], 404);
}

$master->prepare('INSERT INTO payment_request_messages (payment_request_id, sender_type, sender_name, message_text) VALUES (:id, :st, :sn, :msg)')->execute([
    ':id' => $requestId,
    ':st' => 'admin',
    ':sn' => $adminUser,
    ':msg' => $message,
]);

golder_json_response(['status' => 'ok']);


