<?php
$pageName = "View Loan Transaction";
include_once("layouts/header.php");

// SECURITY: Validate session
if (!isset($_SESSION['user_id'])) {
    header('Location: ../login.php');
    exit('Unauthorized access');
}

// SECURITY: Validate ID parameter
$id = null;
if (isset($_GET['id'])) {
    $id = SecurityUtils::validateInput($_GET['id'], 'string', 100);
    if (!$id) {
        die('Invalid loan reference ID');
    }
} else {
    die('Loan reference ID required');
}

// SECURITY: Use parameterized query
$sql = "SELECT * FROM loan WHERE loan_reference_id = :id";
$stmt = $conn->prepare($sql);
$stmt->execute([':id' => $id]);
$result = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$result) {
    die('Loan transaction not found');
}

// SECURITY: Verify user owns this transaction
if ($result['acct_id'] != $_SESSION['user_id']) {
    SecurityUtils::logSecurityEvent('UNAUTHORIZED_TRANSACTION_ACCESS', [
        'attempted_loan_id' => $id,
        'user_id' => $_SESSION['user_id']
    ]);
    die('Access denied: Not your transaction');
}

$loanStatus = loanModalStatus($result);

if(empty($result['loan_message'])){
    $loanMsg = "N/A";
}else{
    $loanMsg = sanitize($result['loan_message']);
}


?>

<div id="content" class="main-content">
    <div class="layout-px-spacing">
        <div class="row layout-top-spacing">
            <div class="col-md-8 offset-md-2 mt-5">
                <div class="card component-card">
                    <div class="card-body">
                        <div class="user-profile">
                            <div class="row">
                                <div class="col-md-12 mb-3">
                                    <h3 class=" text-info">Loan Transaction</h3>

                                </div>
                            </div>
                            <div class="row">
                                <div class="col-md-8 offset-md-2">
                                    <table class="table table-bordered">
                                        <tbody>
                                        <tr>
                                            <td>AMOUNT</td>
                                            <td><?=$currency. $result['amount'] ?></td>
                                        </tr>
                                        <tr>
                                            <td>REFERENCE ID</td>
                                            <td><?= $result['loan_reference_id'] ?></td>
                                        </tr>
                                        <tr>
                                            <td>Loan Reason</td>
                                            <td><?= $result['loan_remarks'] ?></td>
                                        </tr>
                                        <tr>
                                            <td>Message</td>
                                            <td><?= $loanMsg ?></td>
                                        </tr>

                                        <tr>
                                            <td>STATUS</td>
                                            <td><?=$loanStatus ?></td>
                                        </tr>

                                        </tbody>
                                    </table>
                                </div>
                            </div>
                        </div>
                    </div>
                </div>
            </div>


<?php

include_once("./layouts/footer.php");

?>
