<?php
session_start();
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST');
header("Access-Control-Allow-Headers: X-Requested-With");
header('Content-Type: application/json; charset=utf-8');

include 'config.php';

// Helper function to sanitize user input
function check_input($par) {
    return htmlspecialchars(stripslashes(trim($par)));
}

// Check if required POST parameters are present
if (empty($_POST['user_id']) || empty($_POST['auth'])) {
    echo json_encode(['status' => false, 'success' => 'Missing required parameters']);
    exit;
}

$user_id = check_input($_POST['user_id']);
$auth = check_input($_POST['auth']);

// Use prepared statement to prevent SQL injection
$stmt = $con->prepare("SELECT * FROM users WHERE user_id = ? AND auth = ?");
$stmt->bind_param("ss", $user_id, $auth);
$stmt->execute();
$userResult = $stmt->get_result();

if ($userResult && $userResult->num_rows === 1) {
    // Fetch user's activities
    $stmt = $con->prepare("SELECT * FROM socials WHERE user_id = ? ORDER BY id DESC LIMIT 200");
    $stmt->bind_param("s", $user_id);
    $stmt->execute();
    $activityResult = $stmt->get_result();

    $data = [];
    while ($row = $activityResult->fetch_assoc()) {
        $data[] = $row;
    }

    if (!empty($data)) {
        $response = ['status' => true, 'success' => 'Success', 'data' => $data];
    } else {
        $response = ['status' => true, 'success' => 'No Socials', 'data' => []];
    }
} else {
    $response = ['status' => false, 'success' => 'Invalid user ID or authentication token'];
}

$con->close();

echo json_encode($response); // Output JSON response
?>
