<?php
if (session_status() !== PHP_SESSION_ACTIVE) session_start();
require_once __DIR__ . '/auth_paths.php';

function requireRole(array $roles) {
  $role = $_SESSION['role'] ?? 'guest';
  if (!in_array($role, $roles, true)) {
    header('Location: ' . ah_login_url());
    exit;
  }
}

function hasPermission(string $perm): bool {
  $role = $_SESSION['role'] ?? 'guest';
  $permissions = is_array($_SESSION['permissions'] ?? null) ? $_SESSION['permissions'] : [];
  if (in_array($role, ['master','admin'], true)) return true;
  return ah_user_can_access_page((string)$role, $permissions, $perm);
}
