<?php
/**
 * Example: protect a JSON API endpoint with Sassly access tokens (for the Sassly Suites mobile app
 * or app-to-app calls). Web pages use sassly_require_login() instead.
 */

declare(strict_types=1);

require __DIR__ . '/../../bootstrap.php'; // ADAPT: the app bootstrap (loads config + DB, includes lib/sassly-auth/sassly_auth_bootstrap.php)

header('Content-Type: application/json; charset=utf-8');
header('Cache-Control: no-store');

$token = SasslyAuthClient::bearerTokenFromRequest();
if ($token === null) {
    http_response_code(401);
    header('WWW-Authenticate: Bearer');
    echo json_encode(['error' => 'unauthenticated']);
    exit;
}

try {
    $claims = sassly_auth()->verifyAccessToken($token, 'sassly-api'); // add a scope as 3rd arg if needed
} catch (SasslyAuthException $e) {
    http_response_code($e->reason === 'insufficient_scope' ? 403 : 401);
    header('WWW-Authenticate: Bearer error="invalid_token"');
    echo json_encode(['error' => $e->reason]);
    exit;
}

// Map the Sassly account to the local user exactly like web logins do (sub only; no email linking here).
$st = sassly_app_pdo()->prepare('SELECT * FROM users WHERE sassly_sub = ? AND is_active = 1'); // ADAPT
$st->execute([$claims['sub']]);
$user = $st->fetch(PDO::FETCH_ASSOC);
if ($user === false) {
    http_response_code(403);
    echo json_encode(['error' => 'not_registered']);
    exit;
}

echo json_encode(['ok' => true, 'user_id' => $user['id']]);