<?php
require_once __DIR__ . '/../../config/database.php';
require_once __DIR__ . '/../../config/constants.php';
require_once __DIR__ . '/../../includes/functions.php';

apply_cors();

if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
    send_error('Method not allowed.', 405);
}

$pdo = getDbConnection();
$stmt = $pdo->query('SELECT * FROM payment_gateways WHERE is_active = 1 LIMIT 1');
$gateway = $stmt->fetch();

if (!$gateway) {
    send_success([
        'gateway' => 'MANUAL_UPI',
        'mode' => 'LIVE',
        'key_id' => '',
        'upi_id' => '',
        'upi_name' => '',
        'qr_image_url' => '',
        'instructions' => 'Contact support to complete payment.',
    ]);
}

// Only Razorpay's publishable key_id is safe for the client — key_secret,
// webhook_secret, salt_key are NEVER included in this response.
send_success([
    'gateway' => $gateway['gateway_name'],
    'mode' => $gateway['mode'],
    'key_id' => $gateway['gateway_name'] === 'RAZORPAY' ? $gateway['key_id'] : '',
    'merchant_id' => $gateway['gateway_name'] === 'PHONEPE' ? $gateway['merchant_id'] : '',
    'upi_id' => $gateway['upi_id'],
    'upi_name' => $gateway['upi_name'],
    'qr_image_url' => $gateway['qr_image_url'],
    'instructions' => $gateway['instructions'],
]);
