<?php
require_once __DIR__ . '/../app/bootstrap.php';
use App\Core\Database; use App\Core\Security;
$order=null; $history=[]; $error=null;
if($_SERVER['REQUEST_METHOD']==='POST'){
 if(!verify_csrf()) $error='Invalid security token.'; elseif(!Security::rateLimit('track-order:'.Security::clientIp(),20,3600)) $error='Too many tracking attempts. Try again later.'; else { $no=mb_substr(trim((string)($_POST['order_no']??'')),0,80); $phone=mb_substr(trim((string)($_POST['phone']??'')),0,60); if($no===''||$phone==='') $error='Order number and phone are required.'; else { $order=Database::safeFetchOne('SELECT * FROM orders WHERE order_no=? AND customer_phone=? LIMIT 1',[$no,$phone]); if($order) $history=Database::safeFetchAll('SELECT * FROM order_status_history WHERE order_id=? ORDER BY id ASC',[$order['id']]); else $error='No matching order was found.'; } }
}
$pageTitle='Track Order | '.BRAND_NAME; require ROOT_PATH.'/app/Layouts/frontend_header.php';
?>
<section class="container py-5"><div class="row g-4"><div class="col-lg-5"><div class="card border-0 shadow-sm"><div class="card-body p-4"><h1 class="h3">Track Order</h1><p class="text-muted">Use the exact order number and customer phone.</p><?php if($error): ?><div class="alert alert-danger"><?= e($error) ?></div><?php endif; ?><form method="post"><?= csrf_field() ?><label class="form-label">Order number</label><input class="form-control mb-3" name="order_no" value="<?= e($_POST['order_no']??'') ?>" required><label class="form-label">Phone</label><input class="form-control mb-3" name="phone" value="<?= e($_POST['phone']??'') ?>" required><button class="btn btn-primary w-100">Track</button></form></div></div></div><div class="col-lg-7"><?php if($order): ?><div class="card border-0 shadow-sm"><div class="card-body p-4"><div class="d-flex justify-content-between"><div><h3><?= e($order['order_no']) ?></h3><p class="text-muted mb-0"><?= e($order['created_at']) ?></p></div><?= badge($order['order_status']) ?></div><hr><div class="row"><div class="col-6"><small>Total</small><h5><?= money($order['total_amount']) ?></h5></div><div class="col-6"><small>Payment</small><h5><?= e(ucwords(str_replace('_',' ',$order['payment_status']))) ?></h5></div></div><h5 class="mt-4">Status history</h5><div class="list-group list-group-flush"><?php foreach($history as $h): ?><div class="list-group-item px-0 d-flex justify-content-between"><span><?= e(ucwords($h['status'])) ?><?php if($h['note']): ?><small class="text-muted d-block"><?= e($h['note']) ?></small><?php endif; ?></span><small><?= e($h['created_at']) ?></small></div><?php endforeach; ?></div></div></div><?php else: ?><div class="landing-hero p-5 h-100"><h3>Order updates</h3><p class="mb-0">Confirmed, processing, shipped and delivered events will appear here.</p></div><?php endif; ?></div></div></section><?php require ROOT_PATH.'/app/Layouts/frontend_footer.php'; ?>
