<?php
declare(strict_types=1);

namespace App\Middleware;

use Core\Middleware;
use Core\Session;

/**
 * Require a logged-in session for web requests; redirect to login otherwise.
 *
 * Kept intentionally lean at bootstrap. Later phases will add:
 *   - permission refresh from DB per request
 *   - user_sessions heartbeat + admin-forced sign-out detection
 *   - page-view telemetry
 */
final class AuthSession implements Middleware
{
    public function handle(array $context): void
    {
        if (!Session::check()) {
            Session::flash('login_msg', 'Please sign in to continue.');
            redirect('/Login');
        }
    }
}
