<?php
// ============================================================
//  netcash-return.php — Accept / Redirect URL
// ============================================================
//
//  Netcash sends the cardholder here in two situations:
//    1. Successful real-time payment (Card, Instant EFT, ...)
//    2. As the "Redirect URL" when the cardholder clicks Cancel
//       on the Netcash payment-selection page
//
//  We MUST NOT assume success just because the user lands here.
//  Netcash's POST includes TransactionAccepted=true when the
//  payment actually went through — anything else (including no
//  POST at all on cancel) means the payment did not happen.
//
//  Authoritative payment processing happens in netcash-notify.php
//  via the Notify URL. This page only shows the right friendly
//  page based on what Netcash told the browser.
//
// ============================================================
require_once __DIR__ . '/includes/auth.php';
require_once __DIR__ . '/includes/csrf.php';

$reference = $_POST['Reference'] ?? $_GET['Reference'] ?? '';
$amount    = $_POST['Amount']    ?? $_GET['Amount']    ?? '';
$reason    = $_POST['Reason']    ?? $_GET['Reason']    ?? '';

// Treat as successful ONLY if Netcash explicitly says so.
// Anything else (declined, cancelled, no data) → bounce to the
// cancel page so the member can retry.
$accepted = strtolower(trim((string)($_POST['TransactionAccepted']
    ?? $_GET['TransactionAccepted'] ?? ''))) === 'true';

if (!$accepted) {
    if (auth_member_check()) {
        header('Location: ' . SITE_URL . '/member/payment-cancel.php?gateway=netcash'
            . ($reason !== '' ? '&r=' . urlencode(mb_substr((string)$reason, 0, 80)) : ''));
        exit;
    }
    // Not logged in (rare for our flow but possible) — show a generic decline page
    header('Location: ' . SITE_URL . '/netcash-decline.php?Reason='
        . urlencode((string)$reason ?: 'Payment cancelled'));
    exit;
}

// ── Confirmed success ─────────────────────────────────────
if (auth_member_check()) {
    header('Location: ' . SITE_URL . '/member/welcome.php?paid=1');
    exit;
}
?><!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Payment received — Buy Local Lowveld</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<style>
body{font-family:system-ui,-apple-system,sans-serif;max-width:560px;margin:3rem auto;padding:0 1.25rem;color:#1f2937;}
.box{background:#f0fdf4;border:1px solid #86efac;border-radius:10px;padding:2rem;text-align:center;}
.icon{font-size:2.5rem;margin-bottom:.5rem;}
h1{margin:0 0 .25rem;color:#065f46;}
p{margin:.4rem 0;}
.btn{display:inline-block;background:#16a34a;color:#fff;text-decoration:none;padding:.65rem 1.4rem;border-radius:6px;font-weight:600;margin-top:1rem;}
.muted{color:#64748b;font-size:.85rem;}
</style>
</head>
<body>
<div class="box">
    <div class="icon">✓</div>
    <h1>Payment received</h1>
    <p>Thanks — your payment has been received successfully.</p>
    <?php if ($reference): ?>
        <p class="muted">Reference: <code><?= htmlspecialchars($reference) ?></code></p>
    <?php endif; ?>
    <p>You'll get a receipt by email shortly.</p>
    <a class="btn" href="<?= htmlspecialchars(SITE_URL) ?>/login.php">Sign in to your dashboard</a>
</div>
</body>
</html>