<?php
ini_set('display_errors','0');
error_reporting(E_ALL);
header('Content-Type: application/json; charset=utf-8');
try {
    require_once __DIR__ . '/config/database.php';
    if (file_exists(__DIR__ . '/config/master_auth.php')) require_once __DIR__ . '/config/master_auth.php';
    if (session_status() !== PHP_SESSION_ACTIVE) session_start();
    $conn = function_exists('getConnection') ? getConnection() : null;
    if (!$conn instanceof mysqli) throw new Exception('DB gagal');
    $passcode = trim((string)($_POST['passcode'] ?? ''));
    $employee_id = 0;
    if (function_exists('current_user')) { $cu = current_user(); $employee_id = (int)($cu['employee_id'] ?? 0); }
    if ($employee_id <= 0) $employee_id = (int)($_SESSION['user']['employee_id'] ?? $_SESSION['employee_id'] ?? $_SESSION['user_id'] ?? 0);
    if ($employee_id <= 0) throw new Exception('User tidak valid');
    $stmt = $conn->prepare("SELECT action_passcode_hash FROM users WHERE employee_id = ? LIMIT 1");
    $stmt->bind_param('i', $employee_id);
    $stmt->execute();
    $row = $stmt->get_result()->fetch_assoc();
    $stmt->close();
    $hash = (string)($row['action_passcode_hash'] ?? '');
    $ok = $hash !== '' ? password_verify($passcode, $hash) : false;
    echo json_encode(['ok'=>$ok]);
} catch (Throwable $e) { echo json_encode(['ok'=>false, 'error'=>$e->getMessage()]); }