<?php
header("Access-Control-Allow-Origin: *");
header("Content-Type: application/json; charset=UTF-8");
require_once 'db.php';

$admin_id = $_GET['admin_id'] ?? 0;

try {
    // 驗證天啟者
    $stmt = $pdo->prepare("SELECT level FROM users WHERE id = ?");
    $stmt->execute([$admin_id]);
    if ($stmt->fetchColumn() < 99) throw new Exception("天啟禁區");

    // 撈取待處理訂單，並聯集使用者的 KYC 圖片
    $sql = "SELECT e.*, u.username, u.id_card_img 
            FROM exchange_orders e 
            JOIN users u ON e.user_id = u.id 
            WHERE e.status = 'pending' 
            ORDER BY e.created_at ASC";
    $stmt = $pdo->query($sql);
    
    echo json_encode(["status" => "success", "data" => $stmt->fetchAll(PDO::FETCH_ASSOC)]);
} catch (Exception $e) {
    echo json_encode(["status" => "error", "message" => $e->getMessage()]);
}
?>