<?php
// get_config.php — Public API to safely expose UPI config
// This file reads data/info.json server-side and returns only
// the required fields. The /data/ folder itself stays blocked.

header('Content-Type: application/json');
header('Cache-Control: no-store, no-cache, must-revalidate');
header('X-Content-Type-Options: nosniff');

$configFile = __DIR__ . '/data/info.json';

if (!file_exists($configFile)) {
    http_response_code(404);
    echo json_encode(['error' => 'Config not found']);
    exit;
}

$raw = file_get_contents($configFile);
$cfg = json_decode($raw, true);

if (!$cfg || empty($cfg['name']) || empty($cfg['email'])) {
    http_response_code(500);
    echo json_encode(['error' => 'Invalid config']);
    exit;
}

// Return only the needed fields — nothing extra
echo json_encode([
    'name'  => $cfg['name'],
    'email' => $cfg['email'],
]);
