<?php
// auth.php - Protect all pages

session_start();

// If user is not logged in
if (!isset($_SESSION['user_id'])) {
    header("Location: login.php");
    exit();
}

// OPTIONAL: Role checking
// Uncomment if needed
/*
$allowed_roles = ['admin', 'cashier'];

if (!in_array($_SESSION['role'], $allowed_roles)) {
    echo "<h3 style='color:red;text-align:center;'>ACCESS DENIED</h3>";
    exit();
}
*/
?>
