<?php
require_once __DIR__ . '/../app/bootstrap.php';
use App\Core\Auth; use App\Core\PosService; use App\Core\Response;
PosService::requireAccess('public/login.php');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') Response::json(['ok'=>false,'message'=>'POST required.'], 405);
if (!verify_csrf()) Response::json(['ok'=>false,'message'=>'Invalid security token.'], 419);
if (!PosService::can('pos.refund')) Response::json(['ok'=>false,'message'=>'No refund permission.'], 403);
$res = PosService::createRefund(
    (string)($_POST['sale_no'] ?? ''),
    (float)($_POST['amount'] ?? 0),
    (string)($_POST['method'] ?? 'cash'),
    (string)($_POST['reason'] ?? '')
);
Response::json($res, $res['ok'] ? 200 : 422);
