<?php
// GET /api/settings/defaults — narrow, user-scoped endpoint feeding the
// Calculator's one-time Risk Mode / Risk % prefill (calculator-source.html,
// "TRADING DEFAULTS PREFILL" block). Deliberately separate from
// /api/account/state (which is account-scoped, fetched only when an
// account_id is present in the URL) — trading defaults are a per-user
// setting, not a per-account one, and this fetch fires unconditionally on
// every page load regardless of account_id.
header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
    http_response_code(405);
    echo json_encode(['error' => 'Method not allowed']);
    exit;
}

$userId = $auth->requireAuth();

$profile = $db->selectById('user_profiles', $userId, 'user_id');

echo json_encode([
    'default_risk_mode' => $profile['default_risk_mode'] ?? null,
    'default_risk_pct' => $profile['default_risk_pct'] !== null ? (float)$profile['default_risk_pct'] : null,
]);
