<?php
declare(strict_types=1);
error_reporting(E_ALL);
ini_set('display_errors', 1);

if (session_status() !== PHP_SESSION_ACTIVE) {
    session_set_cookie_params([
        'lifetime' => 0,
        'path'     => '/',
        'domain'   => '',
        'secure'   => isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on',
        'httponly' => true,
        'samesite' => 'Lax',
    ]);
    session_start();
}

header('X-Frame-Options: SAMEORIGIN');
header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: strict-origin-when-cross-origin');

/* ===== DB CREDS: UPDATE USER/PASS IF NEEDED ===== */
$DB_HOST = "localhost";
$DB_USER = "inv11_pacificiconnect_beta";   // <-- change
$DB_PASS = '$JbDLi@evoaag(gV';   // <-- change
$DB_NAME = "inv11_pacificiconnect_beta26";

$con = @new mysqli($DB_HOST, $DB_USER, $DB_PASS, $DB_NAME);
if ($con->connect_error) { http_response_code(500); die("DB connection failed: " . htmlspecialchars($con->connect_error)); }
if (function_exists('mysqli_set_charset')) { mysqli_set_charset($con, 'utf8mb4'); }

function is_logged_in(): bool { return !empty($_SESSION['admin_user']['id']); }
function current_user(): ?array { return $_SESSION['admin_user'] ?? null; }
function redirect(string $to): never { header("Location: $to"); exit; }
function csrf_token(): string { if (empty($_SESSION['csrf'])) $_SESSION['csrf']=bin2hex(random_bytes(32)); return $_SESSION['csrf']; }
function verify_csrf(?string $t): bool { return isset($_SESSION['csrf']) && $t && hash_equals($_SESSION['csrf'],$t); }
