// routes/embedded.php
use App\Embedded\Auth as EmbeddedAuth;

$router->post('/embed/v1/sessions', function () {
    $partner = EmbeddedAuth::verify();
    $body = json_decode(file_get_contents('php://input'), true) ?? [];
    EmbeddedAuth::require($partner, $body['scope'] ?? '');

    $token = bin2hex(random_bytes(32));
    Database::insert('embedded_sessions', [
        'partner_id'  => (int)$partner['id'],
        'tenant_id'   => (int)$body['tenant_id'],
        'customer_id' => $body['customer_id'] ?? null,
        'scope'       => $body['scope'],
        'token_hash'  => hash('sha256', $token),
        'expires_at'  => date('Y-m-d H:i:s', time() + 3600),
    ]);
    \App\Core\Response::json(['token' => $token, 'expires_in' => 3600]);
});

$router->post('/embed/v1/bnpl/checkout', function () {
    $partner = EmbeddedAuth::verify();
    EmbeddedAuth::require($partner, 'bnpl.issue');
    $body = json_decode(file_get_contents('php://input'), true) ?? [];

    try {
        $result = \App\Core\Bnpl\BnplEngine::create(
            (int)$body['customer_id'], (int)$body['sale_id'], (int)$body['plan_id'], (float)$body['amount']
        );
        \App\Core\Response::json(['success' => true, 'bnpl' => $result]);
    } catch (\Throwable $e) {
        \App\Core\Response::json(['error' => $e->getMessage()], 400);
    }
});

$router->post('/embed/v1/loans/apply', function () {
    $partner = EmbeddedAuth::verify();
    EmbeddedAuth::require($partner, 'loan.apply');
    $body = json_decode(file_get_contents('php://input'), true) ?? [];

    $result = \App\Core\Lending\Loan::apply(
        (int)$body['tenant_id'], (int)$body['product_id'], (float)$body['amount'], $body['purpose'] ?? ''
    );
    \App\Core\Response::json(['success' => true, 'application' => $result], 202);
});