<?php
session_start();

// 1. Prevent caching
header("Cache-Control: no-cache, no-store, must-revalidate");
header("Pragma: no-cache");
header("Expires: 0");

/** * 2. INACTIVITY TIMEOUT LOGIC
 * 1800 seconds = 30 minutes
 */
$timeout_limit = 1800; 

if (isset($_SESSION['last_activity'])) {
    $seconds_inactive = time() - $_SESSION['last_activity'];
    
    if ($seconds_inactive >= $timeout_limit) {
        // Log out the user if they were inactive for too long
        session_unset();
        session_destroy();
        // Redirect to login with a message
        header("Location: index.php?msg=session_expired"); 
        exit();
    }
}
// Update the activity timestamp on every page load
$_SESSION['last_activity'] = time();

/**
 * 3. AUTHENTICATION & SESSION DATA CHECK
 * We now strictly check for the ID, the logged_in flag, AND the admin_user string.
 */
if (
    !isset($_SESSION['admin_id']) || 
    !isset($_SESSION['admin_logged_in']) || 
    !isset($_SESSION['admin_user']) || 
    $_SESSION['admin_logged_in'] !== true
) {
    // If ANY piece of session data is missing, redirect to login page (index.php)
    header("Location: index.php"); 
    exit();
}

/**
 * Note: Database recovery (Step 5) has been removed.
 * The 'admin_user' is pulled directly from $_SESSION in your sidebar.
 */
?>