<?php
session_start();
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST');
header("Access-Control-Allow-Headers: X-Requested-With");

if (isset($_POST['user_id']) && isset($_POST['auth'])) {
    include 'config.php';

    $user_id = $_POST['user_id'];
    $auth = $_POST['auth'];

    // Sanitize input
    $user_id = stripslashes($user_id);
    $user_id = mysqli_escape_string($con, $user_id);

    $auth = stripslashes($auth);
    $auth = mysqli_escape_string($con, $auth);

    $data = array();

    // Query to check the user
    $sql = $con->query("SELECT * FROM users WHERE user_id = '$user_id' AND auth = '$auth'") 
        or die("Error: " . mysqli_error($con));

    if ($sql) {
        $count = mysqli_num_rows($sql);

        if ($count == 1) {
            // Fetch the user's data
            $rows = mysqli_fetch_assoc($sql); // Use fetch_assoc for associative array
            $data[] = $rows;

            $status = true;
            $suc = "Successful";
            $passport_url = $p_url."/passport/";
            $id_url = $p_url."/id_docs/";
        } else {
            // No matching account found
            $suc = "Account Not Found";
            $status = false;
        }
    } else {
        $suc = "Query failed";
        $status = false;
    }

    $con->close();

    // Prepare output
    $output = array(
        'success' => $suc,
        'status' => $status,
        'passport_url' => $passport_url,
        'id_url' => $id_url,
        'data' => $data
    );
    echo json_encode($output); // Output JSON data
} else {
    // Missing required fields
    echo json_encode(array(
        'success' => "Failure",
        'status' => false,
        'message' => "Missing required fields"
    ));
}
?>
