<?php
// GET /api/profile

if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
    sendError('Method not allowed', 405);
}

$payload = authenticate();

$db = getDB();
$stmt = $db->prepare("SELECT name, employee_id, mobile, role FROM users WHERE id = ?");
$stmt->bind_param("i", $payload['user_id']);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
$stmt->close();
$db->close();

if (!$user) {
    sendError('User not found', 404);
}

sendSuccess(['data' => $user]);
