<?php
require_once 'config.php';

/**
 * SAC 2026 - GET CRITICAL BILLS (HARDENED)
 */

$role = $_SESSION['user_role'] ?? 'guest';

// Si no es administrativo, devolvemos éxito pero sin datos (Silencio administrativo)
if (!in_array($role, ['admin', 'board', 'programmer'])) {
    response([]); 
}

try {
    // Solo llegamos aquí si somos admin
    $stmt = $pdo->prepare("SELECT 
                            id, 
                            provider,
                            description, 
                            amount_usd as amount, 
                            due_date as dueDate, 
                            status 
                          FROM pending_bills 
                          WHERE status = 'Pendiente' 
                          ORDER BY due_date ASC 
                          LIMIT 10");
    $stmt->execute();
    response($stmt->fetchAll());

} catch (PDOException $e) {
    response([], 200);
}
?>