<?php
require_once __DIR__ . '/../config/config.php';

function isLoggedIn() {
    return !empty($_SESSION['user']);
}

function currentUser() {
    return $_SESSION['user'] ?? null;
}

function requireLogin($roles = []) {
    if (!isLoggedIn()) {
        header('Location: /admin/login.php');
        exit;
    }
    if ($roles && !in_array($_SESSION['user']['role'], $roles, true)) {
        http_response_code(403);
        exit('Access denied');
    }
}

function passwordExpired($passwordChangedAt) {
    if (!$passwordChangedAt) return true;
    $expires = strtotime($passwordChangedAt . ' +' . PASSWORD_EXPIRY_DAYS . ' days');
    return time() > $expires;
}

function loginUser(array $user) {
    $_SESSION['user'] = $user;
}

function logoutUser() {
    $_SESSION = [];
    session_destroy();
}
?>
