<?php
header('Content-Type: application/json');
// Critical: Add cache control headers
header('Cache-Control: no-cache, no-store, must-revalidate');
header('Pragma: no-cache');
header('Expires: 0');
// CRITICAL: Allow origin with credentials
$allowed_origin = isset($_SERVER['HTTP_ORIGIN']) ? $_SERVER['HTTP_ORIGIN'] : '*';
header("Access-Control-Allow-Origin: $allowed_origin");
header('Access-Control-Allow-Methods: GET, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization');
header('Access-Control-Allow-Credentials: true');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}

// Define TONSUI_LOADED constant to prevent direct access to session_init.php
define('TONSUI_LOADED', true);

// Include centralized session initialization
require_once __DIR__ . '/session_init.php';

// Require user authentication
requireLogin(true);

require_once 'db.php';

try {
    $user_id = isset($_SESSION['user_id']) ? $_SESSION['user_id'] : 0;
    
    // CRITICAL FIX: JOIN with investment_plans to get plan details
    // Frontend expects: plan_name, roi_percentage, total_earned
    // investments table only has: plan_id, roi (amount), total_return
    $stmt = $pdo->prepare("
        SELECT 
            i.*,
            p.name as plan_name,
            p.roi_percentage,
            p.duration_days,
            i.roi as roi_amount,
            i.total_return as total_earned
        FROM investments i
        LEFT JOIN investment_plans p ON i.plan_id = p.id
        WHERE i.user_id = ?
        ORDER BY i.created_at DESC
    ");
    $stmt->execute([$user_id]);
    $investments = $stmt->fetchAll(PDO::FETCH_ASSOC);
    
    echo json_encode([
        'success' => true,
        'investments' => $investments
    ]);
} catch (Exception $e) {
    echo json_encode([
        'success' => false,
        'message' => 'Failed to fetch investments: ' . $e->getMessage()
    ]);
}
?>
