<?php
// Set session lifetime to 2 hours
ini_set('session.gc_maxlifetime', 7200);
session_set_cookie_params([
  'lifetime' => 7200,
  'path' => '/',              // ✅ site-wide session
  'secure' => false,          // set to true if using HTTPS
  'httponly' => true,
  'samesite' => 'Lax'
]);

if (session_status() !== PHP_SESSION_ACTIVE) {
  session_start();
}

// Inactivity timeout (30 minutes)
$timeout = 1800;
if (isset($_SESSION['last_activity']) && time() - $_SESSION['last_activity'] > $timeout) {
  session_unset();
  session_destroy();
}
$_SESSION['last_activity'] = time();
?>
