<?php
// Example endpoint only: integrate with YOUR login, CSRF, orders DB, and server-side authorization.
// Never trust amount or order ID supplied by GET/POST without checking your DB.
require __DIR__.'/ictw-client.php';
session_start();
if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); exit; }
if (!hash_equals($_SESSION['csrf'] ?? '', $_POST['csrf'] ?? '')) { http_response_code(403); exit; }
if (empty($_SESSION['user_id'])) { http_response_code(401); exit; }
// TODO: lookup order by POST order_id, verify current user owns it, status unpaid,
// and retrieve actual amount from the database, e.g. $order['id'], $order['total'].
http_response_code(501);
exit('Implement authenticated database order lookup before enabling this endpoint.');
// After completing the DB lookup safely:
// $result = ictw_create_checkout('PHP-'.$order['id'],(string)$order['total'],'personal');
// Save $result['payment_id'] and redirect with header('Location: '.$result['checkout_url'],true,303);