<?php
include "check_login.php";
include "dbcon.php";

$phase_id   = (int)$_GET['phase_id'];
$project_id = (int)$_GET['project_id'];
$pm_id      = $userpmid;

/* 🔐 SECURITY: PM ka hi project */
$chk = mysqli_query($conn, "
    SELECT id FROM projects 
    WHERE id = $project_id 
      AND pm_id = $pm_id
");

if (mysqli_num_rows($chk) == 0) {
    http_response_code(403);
    exit('Unauthorized');
}

$q = mysqli_query($conn, "
    SELECT * FROM phase_messages
    WHERE project_id=$project_id
      AND phase_id=$phase_id
    ORDER BY id ASC
");

while ($m = mysqli_fetch_assoc($q)) {

    if ($m['sender_role'] == 'pm') {
        echo '
        <div class="text-end mb-2">
            <div class="d-inline-block bg-soft-primary text-primary px-3 py-2 rounded">
                ' . nl2br(htmlspecialchars($m['message'])) . '
            </div>
            <div class="fs-10 text-muted">
                You • ' . date('d M H:i', strtotime($m['created_at'])) . '
            </div>
        </div>';
    } else {
        echo '
        <div class="text-start mb-2">
            <div class="d-inline-block bg-soft-info text-dark px-3 py-2 rounded">
                ' . nl2br(htmlspecialchars($m['message'])) . '
            </div>
            <div class="fs-10 text-muted">
                Admin • ' . date('d M H:i', strtotime($m['created_at'])) . '
            </div>
        </div>';
    }
}
