<?php
// core/auth.php
require_once(dirname(__FILE__) . "/security.php");
configure_secure_session();
session_start();
send_security_headers();

if (empty($_SESSION['sess_userid']) || $_SESSION['sess_userid'] !== session_id()) {
    header("Location: ../views/login.php");
    exit();
}
$account = $_SESSION['account'] ?? '';
$login_id = $_SESSION['account'] ?? '';
$name = $_SESSION['name'] ?? '';
$position = $_SESSION['position'] ?? '';
$ip = $_SESSION['ip'] ?? '';

// Auto Logout Logic
require_once(dirname(__FILE__) . "/settings.php");
$app_settings = get_app_settings();

if (isset($app_settings['auto_logout_enable']) && $app_settings['auto_logout_enable'] === '1') {
    $timeout_minutes = (int)($app_settings['auto_logout_minutes'] ?? 30);
    if ($timeout_minutes < 1) $timeout_minutes = 30; // fallback
    $timeout_seconds = $timeout_minutes * 60;
    
    if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > $timeout_seconds)) {
        header("Location: ../views/login.php?action=timeout");
        exit();
    }
    $_SESSION['last_activity'] = time(); // update last activity timestamp
}
?>