<?php
/**
 * POST /api/validation/return-to-main — Validation Workflow "← Back to Main
 * Workflow" (2026-08-16 workflow-isolation-leakage pass).
 *
 * $auth/$db are set up by index.php's router (same pattern as
 * api/validation/graduate.php). All real logic lives in
 * ValidationService::returnToMain() (src/ValidationService.php, already
 * required globally by index.php) — this file is a thin HTTP wrapper.
 *
 * Not a graduation: the validation strategy and its trades are left
 * completely untouched (still is_validation = 1) — this only flips
 * workflow_state back to 'main' for a user who got here via "Validate a
 * New Edge →" from an existing main-workflow session (never for a user who
 * entered validation through onboarding — see
 * ValidationService::returnToMain()'s own server-side check, which is the
 * real enforcement; this endpoint does not duplicate that logic).
 */
header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['success' => false, 'error' => 'Method not allowed. Use POST.']);
    exit;
}

$userId = $auth->requireAuth();

$result = ValidationService::returnToMain($userId, $db);

http_response_code($result['success'] ? 200 : 400);
echo json_encode($result);
