<?php
require_once __DIR__ . '/../app/bootstrap.php';
use App\Core\Auth; use App\Core\PosService; use App\Core\Response;
PosService::requireAccess('public/login.php');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') Response::json(['ok'=>false,'message'=>'POST required.'], 405);
if (!verify_csrf()) Response::json(['ok'=>false,'message'=>'Invalid security token.'], 419);
$action = (string)($_POST['action'] ?? '');
$userId = (int)Auth::id();
if ($action === 'open') Response::json(PosService::openShift((int)($_POST['register_id'] ?? 0), $userId, (float)($_POST['opening_cash'] ?? 0)));
if ($action === 'close') Response::json(PosService::closeShift((int)($_POST['shift_id'] ?? 0), $userId, (float)($_POST['closing_cash'] ?? 0)));
if ($action === 'cash_movement') Response::json(PosService::cashMovement((int)($_POST['shift_id'] ?? 0), $userId, (string)($_POST['movement_type'] ?? ''), (float)($_POST['amount'] ?? 0), (string)($_POST['reason'] ?? '')));
Response::json(['ok'=>false,'message'=>'Unsupported shift action.'], 422);
