<?php
namespace App\Controllers;
use App\Core\Controller;
use App\Models\Client;
use App\Models\ClientTransaction;
use App\Models\ForexTrade;

class ApiController extends Controller
{
    public function __construct() {
        header('Content-Type: application/json');
    }

    // POST /api/login (staff)
    public function staffLogin() {
        $data = json_decode(file_get_contents('php://input'), true);
        $userModel = new \App\Models\User();
        $user = $userModel->findByUsername($data['username']);
        if ($user && $userModel->verifyPassword($user, $data['password'])) {
            echo json_encode(['token' => bin2hex(random_bytes(32)), 'user' => $user]);
        } else {
            http_response_code(401);
            echo json_encode(['error' => 'Invalid credentials']);
        }
    }

    // POST /api/client/login
    public function clientLogin() {
        $data = json_decode(file_get_contents('php://input'), true);
        $clientModel = new Client();
        $client = $clientModel->findByUsername($data['username']);
        if ($client && $clientModel->verifyPassword($client, $data['password'])) {
            echo json_encode(['token' => bin2hex(random_bytes(32)), 'client' => $client]);
        } else {
            http_response_code(401); echo json_encode(['error'=>'Invalid']);
        }
    }

    // GET /api/client/statement
    public function clientStatement() { /* ... authenticate via token, fetch statement */ }
}