<?php
require_once __DIR__ . '/auth.php';
header('X-Frame-Options: SAMEORIGIN');
header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Permissions-Policy: camera=(), microphone=(), geolocation=()');
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
$cspNonce = base64_encode(random_bytes(16));
header("Content-Security-Policy: default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; script-src 'self' 'nonce-{$cspNonce}' https://cdn.jsdelivr.net; font-src 'self' data: https://cdn.jsdelivr.net;");
require_auth();
?>
<!doctype html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title><?= e($pageTitle ?? APP_NAME) ?></title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">
    <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.3/font/bootstrap-icons.css" rel="stylesheet">
    <link href="<?= APP_BASE ?>/assets/css/app.css?v=<?= time() ?>" rel="stylesheet">
</head>
<body>
<div class="app-shell">
    <!-- Mobile Sidebar Overlay -->
    <div class="sidebar-overlay" id="sidebarOverlay"></div>
    
    <?php require __DIR__ . '/sidebar.php'; ?>
    <div class="app-main">
        <header class="topbar">
            <button class="btn btn-light sidebar-toggle d-md-none me-2" type="button" id="mobileMenuBtn">
                <i class="bi bi-list fs-4"></i>
            </button>
            <div class="brand">
                <div class="logo-slot"><img src="<?= APP_BASE ?>/assets/images/fortunes-logo.png" alt="Fortunes" onerror="this.style.display='none'"></div>
                <strong><?= APP_NAME ?></strong>
            </div>
            <div class="topbar-search"><i class="bi bi-search"></i><input type="search" placeholder="Search"></div>
            <button class="icon-btn" type="button" title="Notifications"><i class="bi bi-bell"></i></button>
            <div class="dropdown">
                <button class="btn btn-light dropdown-toggle" data-bs-toggle="dropdown"><i class="bi bi-person-circle me-1"></i><?= e(current_user()['name'] ?? 'User') ?></button>
                <ul class="dropdown-menu dropdown-menu-end">
                    <li><span class="dropdown-item-text small text-muted"><?= e(current_user()['role'] ?? '') ?></span></li>
                    <li><a class="dropdown-item" href="<?= APP_BASE ?>/profile.php">Profile / Account</a></li>
                    <li><hr class="dropdown-divider"></li>
                    <li><a class="dropdown-item" href="<?= APP_BASE ?>/logout.php">Logout</a></li>
                </ul>
            </div>
        </header>
        <main class="content">
            <?php if ($msg = flash('success')): ?><div class="alert alert-success"><?= e($msg) ?></div><?php endif; ?>
            <?php if ($msg = flash('error')): ?><div class="alert alert-danger"><?= e($msg) ?></div><?php endif; ?>
