<?php
// admin/auth.php
if (session_status() === PHP_SESSION_NONE) session_start();

if (!isset($_SESSION['admin'])) {
    header("Location: index.php");
    exit;
}

$script = str_replace('\\', '/', $_SERVER['SCRIPT_NAME'] ?? '');
$role   = strtolower((string)($_SESSION['admin_role'] ?? 'staff'));

$ROLE_PERMISSIONS = [
    'super' => [
        '/exam/admin/dashboard.php',
        '/exam/admin/users.php',
        '/exam/admin/courses.php',
        '/exam/admin/create_exam.php',
        '/exam/admin/add_question.php',
        '/exam/admin/add_question_select.php',
        '/exam/admin/bulk_upload_questions.php',
        '/exam/admin/add_student.php',
        '/exam/admin/bulk_exam_attempt.php',
        '/exam/admin/student_created_list.php',
        '/exam/admin/results.php',
        '/exam/admin/change_password.php',
        '/exam/admin/logout.php',
    ],

    'admin' => [
        '/exam/admin/dashboard.php',
        '/exam/admin/users.php',
        '/exam/admin/courses.php',
        '/exam/admin/create_exam.php',
        '/exam/admin/add_question.php',
        '/exam/admin/add_question_select.php',
        '/exam/admin/bulk_upload_questions.php',
        '/exam/admin/add_student.php',
        '/exam/admin/bulk_exam_attempt.php',
        '/exam/admin/student_created_list.php',
        '/exam/admin/results.php',
        '/exam/admin/change_password.php',
        '/exam/admin/logout.php',
    ],

    'staff' => [
        '/exam/admin/dashboard.php',
        '/exam/admin/add_student.php',
        '/exam/admin/bulk_exam_attempt.php',
        '/exam/admin/student_created_list.php',
        '/exam/admin/change_password.php',
        '/exam/admin/logout.php',
    ],
];

if (!isset($ROLE_PERMISSIONS[$role])) {
    $role = 'staff';
}

if (!in_array($script, $ROLE_PERMISSIONS[$role], true)) {
    http_response_code(403);
    echo "<!doctype html>
    <html>
    <head>
      <meta charset='utf-8'>
      <meta name='viewport' content='width=device-width, initial-scale=1'>
      <link href='../assets/css/bootstrap.min.css' rel='stylesheet'>
      <title>403 Forbidden</title>
    </head>
    <body class='bg-light d-flex align-items-center' style='min-height:100vh'>
      <div class='container text-center'>
        <h3 class='mb-2'>Access Denied</h3>
        <p class='text-muted'>You do not have permission to access this page.</p>
        <a href='dashboard.php' class='btn btn-outline-primary'>Back to Dashboard</a>
      </div>
    </body>
    </html>";
    exit;
}

function require_role(array $allowed): void {
    $role = strtolower((string)($_SESSION['admin_role'] ?? 'staff'));
    $allowed = array_map(fn($r) => strtolower((string)$r), $allowed);

    if (!in_array($role, $allowed, true)) {
        http_response_code(403);
        echo "<!doctype html>
        <html>
        <head>
          <meta charset='utf-8'>
          <meta name='viewport' content='width=device-width, initial-scale=1'>
          <link href='../assets/css/bootstrap.min.css' rel='stylesheet'>
          <title>403 Forbidden</title>
        </head>
        <body class='bg-light d-flex align-items-center' style='min-height:100vh'>
          <div class='container text-center'>
            <h3 class='mb-2'>Access Denied</h3>
            <p class='text-muted'>You do not have permission to access this page.</p>
            <a href='dashboard.php' class='btn btn-outline-primary'>Back to Dashboard</a>
          </div>
        </body>
        </html>";
        exit;
    }
}