<?php
session_start();
$origin=$_SERVER['HTTP_ORIGIN']??'';
$allowed=["https://enerliths.com","http://localhost:5173"]; 
if(in_array($origin,$allowed,true)) header("Access-Control-Allow-Origin: $origin");
header("Vary: Origin");
header("Access-Control-Allow-Credentials: true");
header("Access-Control-Allow-Headers: Content-Type");
header("Access-Control-Allow-Methods: GET, POST, OPTIONS");
header("Content-Type: application/json");
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') exit();
if (!isset($_SESSION['valid']) || $_SESSION['valid'] !== true || ($_SESSION['role'] ?? 'user') !== 'admin') {
  http_response_code(403); echo json_encode(["success" => false, "message" => "Administrator access required"]); exit();
}
require_once("../config/db.php");
?>
