<?php
require_once '../config.php';
require_once '../../includes/Auth.php';
require_once '../../includes/Shop.php';

$auth = new Auth();
$user = $auth->requireAuth();
$shop = new Shop();

if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    $shop_id = $_GET['shop_id'] ?? null;

    if (!$shop_id) {
        jsonResponse(['success' => false, 'message' => 'Shop ID is required'], 400);
    }

    // Security check: ensure the current user owns the shop or is an admin
    if (!$auth->hasRole('admin') && !$shop->isOwner($shop_id, $user['id'])) {
        jsonResponse(['success' => false, 'message' => 'Unauthorized'], 403);
    }

    try {
        $orders = $shop->getShopOrders($shop_id);
        jsonResponse(['success' => true, 'orders' => $orders]);
    } catch (Exception $e) {
        jsonResponse(['success' => false, 'message' => $e->getMessage()], 500);
    }
}