<?php

if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

/**
 * ADMIN ACCESS CONTROL
 * - Ensures only logged-in admins can access admin pages
 */

function require_admin() {

    // Check if user is logged in
    if (!isset($_SESSION['user_id']) && !isset($_SESSION['admin_id'])) {
        header("Location: /admin/login.php");
        exit;
    }

    // Check role
    if (!isset($_SESSION['role']) || $_SESSION['role'] !== 'admin') {
        // Optional: log unauthorized access attempt
        error_log("Unauthorized admin access attempt from user ID: " . ($_SESSION['user_id'] ?? 'unknown'));

        // Redirect to user dashboard or login
        header("Location:  /auth/login.php");
        exit;
    }

    return true;
}