<?php
header('Content-Type: application/json');
require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../config/security.php';

$username = getSafeString('username');
$password = getSafeString('password');
$pin_code = getSafeString('pin_code');
$role = getSafeString('role', 'user');

if (!$username || !$password) {
    echo json_encode(['success' => false, 'error' => 'Username and password required']);
    exit;
}

$password_hash = password_hash($password, PASSWORD_DEFAULT);
$stmt = $mysqli->prepare("INSERT INTO users (username, password_hash, pin_code, role) VALUES (?, ?, ?, ?)");
$stmt->bind_param("ssss", $username, $password_hash, $pin_code, $role);
$ok = $stmt->execute();
$insert_id = $stmt->insert_id;

echo json_encode(['success' => $ok, 'insert_id' => $insert_id]);
?>
