<?php
// ─── GET /api/users/list.php ─────────────────────────────────────────────
define('ROOT', dirname(__DIR__, 2));
require_once ROOT . '/core/DB.php';
require_once ROOT . '/core/Response.php';
require_once ROOT . '/core/Auth.php';

Auth::require();
$db = DB::get();

$rows = $db->rows(
    "SELECT u.record_id, u.username, u.user_type, u.team_id
     FROM   users u
     ORDER BY u.user_type, u.username"
);

// Never return passwords
Response::ok($rows);