<?php
require_once __DIR__ . '/db.php'; // DB connection (PDO assumed)

// Function to verify merchant credentials
function verify_merchant($merchant_key, $amount, $signature) {
    global $pdo;

    // Fetch merchant record from DB
    $stmt = $pdo->prepare("SELECT id, secret_key FROM users WHERE merchant_key = ?");
    $stmt->execute([$merchant_key]);
    $merchant = $stmt->fetch(PDO::FETCH_ASSOC);

    // If merchant not found
    if (!$merchant) {
        return false;
    }

    // Generate expected signature
    $expected_signature = hash_hmac('sha256', $merchant_key . $amount, $merchant['secret_key']);

    // Compare signatures securely
    if (!hash_equals($expected_signature, $signature)) {
        return false;
    }

    // Return merchant's user ID
    return $merchant['id'];
}
