<?php
/**
 * Fichier  : index.php
 * Auteur   : KREMER Régis
 * Version  : 2.3.0
 * Date     : 2026-02-26
 * Description : Point d'entrée principal, routing des vues
 *
 * Changelog :
 *   v2.1.0 (2026-02-21) — Version initiale auditée et sécurisée
 *   v2.1.1 (2026-02-21) — Corrections sécurité (CSRF, MIME, session, migrateSuppliers)
 *   v2.2.0 (2026-02-21) — Permissions magasins, bons de commande, rapport d'écart,
 *   v2.3.0 (2026-02-26) — Lot 1: ajout page Emplacements (locations).
 *                      import CSV, historique prix, bon de livraison multi-lignes
 */
require_once __DIR__.'/config.php';
startSession();
requireAuth(); // redirects to login.php if not logged in

// Allowed pages whitelist
$allowed = [ 'dashboard','products','warehouses','locations','movements','inventory','scanner','barcodes','reports','analytics','lots','settings','users','alerts','suppliers','brands','orders','kits','reservations','help','license'] ;
$page = $_GET['page'] ?? 'dashboard';
if(!in_array($page, $allowed)) $page = 'dashboard';

// Role guard: non-admin can only access: dashboard, scanner, movements, products (read-only)
$user = currentUser();
if(($user['role']??'')!=='admin'){
    $userAllowed = [ 'dashboard','scanner','movements','products','orders','kits','reservations','help','license'] ;
    if(!in_array($page, $userAllowed)) $page = 'dashboard';
}

// Read theme from cookie (default: light — stable UX)
$theme = 'light';
if(isset($_COOKIE['sm_theme']) && in_array($_COOKIE['sm_theme'],['dark','light']))
    $theme = $_COOKIE['sm_theme'];

require_once APP_ROOT.'/views/layout.php';
?>
