<?php
require_once __DIR__.'/../../config.php';
require_once __DIR__ . '/../../engine/Kernel.php';
require_once __DIR__.'/../../engine/Logger.php';
require_once __DIR__.'/../../engine/QRPayEngine.php';
if ($_SERVER['REQUEST_METHOD']!=='POST'){http_response_code(405);exit;}
$ctx = Kernel::handle(['auth' => true]);
$u   = $ctx['user'];
$b  = json_decode(file_get_contents('php://input'),true)??[];
$qr = trim($b['qr_token'] ?? '');
$pin= trim($b['pin'] ?? '');
if(!$qr || !$pin){http_response_code(400);die(json_encode(['error'=>'missing_fields']));}
$result = QRPayEngine::scan($qr, (int)$u['id'], $pin);
http_response_code(($result['ok']??false)?200:400);
echo json_encode($result, JSON_UNESCAPED_UNICODE);
