<?php
/**
 * GET /api/rewards/list.php
 * Returns active rewards, plus the caller's current balance so the
 * front-end can grey out ones they can't afford yet.
 */

require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../includes/response.php';
require_once __DIR__ . '/../includes/auth.php';

$userId = require_login();
$pdo = Database::connect();

$stmt = $pdo->query('SELECT id, title, description, points_cost FROM rewards WHERE is_active = 1 ORDER BY points_cost ASC');
$rewards = $stmt->fetchAll();

$stmt = $pdo->prepare('SELECT points_balance FROM loyalty_points WHERE user_id = ?');
$stmt->execute([$userId]);
$balance = (int) ($stmt->fetchColumn() ?: 0);

send_json(true, 'OK', ['rewards' => $rewards, 'points_balance' => $balance]);
