<?php

function auth_start(): void {
    if (session_status() === PHP_SESSION_NONE) {
        session_name('copymail_sess');
        session_start();
    }
}

function auth_check(): void {
    auth_start();
    if (empty($_SESSION['admin_id'])) {
        header('Location: /login.php');
        exit;
    }
    if (function_exists('vision_enforce')) vision_enforce();
}

function admin_check(): void {
    auth_check();
    if ($_SESSION['admin_role'] !== 'admin') {
        header('Location: /');
        exit;
    }
}

function auth_login(string $username, string $password): bool {
    $st = db()->prepare('SELECT id, role, account_id, password FROM admin_users WHERE username = ? LIMIT 1');
    $st->execute([$username]);
    $row = $st->fetch();
    if ($row && password_verify($password, $row['password'])) {
        $_SESSION['admin_id']         = $row['id'];
        $_SESSION['admin_user']       = $username;
        $_SESSION['admin_role']       = $row['role'];
        $_SESSION['admin_account_id'] = $row['account_id'];
        return true;
    }
    return false;
}

function auth_logout(): void {
    auth_start();
    session_destroy();
    header('Location: /login.php');
    exit;
}

function current_user(): string  { return $_SESSION['admin_user'] ?? ''; }
function is_admin(): bool        { return ($_SESSION['admin_role'] ?? '') === 'admin'; }
function current_account_id(): ?int {
    $id = $_SESSION['admin_account_id'] ?? null;
    return $id ? (int)$id : null;
}