<?php
// Secure session bootstrap for OnePanel
declare(strict_types=1);

if (session_status() === PHP_SESSION_ACTIVE) { return; }

$secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
$cookieParams = session_get_cookie_params();

session_set_cookie_params([
  'lifetime' => 0,
  'path' => $cookieParams['path'] ?? '/',
  'domain' => $cookieParams['domain'] ?? '',
  'secure' => $secure,
  'httponly' => true,
  'samesite' => 'Lax',
]);

ini_set('session.use_strict_mode', '1');
ini_set('session.use_only_cookies', '1');

session_start();

// Basic idle timeout (30 min). Tune as needed.
$now = time();
if (!isset($_SESSION['_op_last_activity'])) {
  $_SESSION['_op_last_activity'] = $now;
} else if (($now - (int)$_SESSION['_op_last_activity']) > 1800) {
  session_unset();
  session_destroy();
  session_start();
}
$_SESSION['_op_last_activity'] = $now;
