<?php
/**
 * API - Cancel Payment
 */

header('Content-Type: application/json');

require_once '../../config/config.php';
require_once '../../config/database.php';
require_once '../../includes/functions.php';
require_once '../../includes/Auth.php';

if (!auth()->isUserLoggedIn()) {
    jsonError('Unauthorized', 401);
}

$userId = auth()->getUserId();
$paymentId = (int)($_GET['id'] ?? 0);

if (!$paymentId) {
    jsonError('Payment ID required');
}

// Only cancel own pending payments
$result = dbUpdate('upi_payments', [
    'status' => 'expired'
], 'id = :id AND user_id = :uid AND status = :status', [
    'id' => $paymentId,
    'uid' => $userId,
    'status' => 'pending'
]);

if ($result) {
    jsonSuccess('Payment cancelled');
} else {
    jsonError('Payment not found or already processed');
}
