<?php
/** POST /api/fraud/check — fraud signal detection */
require_once __DIR__ . '/../../config.php';
require_once __DIR__ . '/../../engine/Kernel.php';
Kernel::handle(['auth' => false, 'public' => true]);
require_once __DIR__ . '/../../engine/Logger.php';
require_once __DIR__ . '/../../engine/FraudGraph.php';

if ($_SERVER['REQUEST_METHOD']!=='POST'){http_response_code(405);die(json_encode(['error'=>'method_not_allowed']));}
// session managed by Kernel::handle
$userId = (int)($_SESSION['user_id'] ?? 0);
if (!$userId){http_response_code(401);die(json_encode(['error'=>'not_authenticated']));}
$data   = json_decode(file_get_contents('php://input'),true) ?: [];
$meta   = array_merge($data, ['ip' => $_SERVER['REMOTE_ADDR']??null]);
echo json_encode(FraudGraph::check($userId, (float)($data['amount']??0), $meta), JSON_UNESCAPED_UNICODE);
