<?php
declare(strict_types=1);

require_once __DIR__ . '/../config/constants.php';

session_name(SESSION_NAME);
session_start();

/**
 * 1. Not logged in → redirect
 */
if (empty($_SESSION['employee_id'])) {
    header('Location: ' . ADMIN_BASE_URL . 'index.php');
    exit;
}

/**
 * 2. Session expiry check
 */
if (!empty($_SESSION['expires_at']) && time() > $_SESSION['expires_at']) {
    session_unset();
    session_destroy();

    header('Location: ' . ADMIN_BASE_URL . 'index.php');
    exit;
}

/**
 * 3. Optional: User-Agent binding (session hijack protection)
 */
if (
    isset($_SESSION['user_agent']) &&
    $_SESSION['user_agent'] !== ($_SERVER['HTTP_USER_AGENT'] ?? '')
) {
    session_unset();
    session_destroy();

    header('Location: ' . ADMIN_BASE_URL . 'index.php');
    exit;
}
