<?php
	include_once($_SERVER['DOCUMENT_ROOT'].'/_ps2020/_global/dir_root.php');
	include($_SERVER['DOCUMENT_ROOT'] ."/_ps2020/config/connect.php");

	session_start();
	
	$signed_in = isset($_SESSION['userID']) ? true : false;

	if ($signed_in){
		$pgProhibit = array('sign-in', 'sign-up', 'sign-out');
		$is_forbidden = false;
            
            foreach($pgProhibit as $arrVal) {
                if ( strpos($_SERVER['PHP_SELF'], $arrVal) !== false ){  //if url contain the val in the array
                    $is_forbidden = true;
                }
            }

			
			// check 'Account-Verification' - if account verified
				if ( strpos($_SERVER['PHP_SELF'], 'verify-email') == false && strpos($_SERVER['PHP_SELF'], 'account-disabled') == false ){
					$result = $conn->query("SELECT * FROM user_account WHERE user_id='".$_SESSION['userID']."'");
						
						if($result) {
							while ( $row = $result->fetch_assoc() ){

								if ( $row['active'] == 0 ){
									header('location: '.dir_root.'verify-email.php');
								}
								else if ( $row['active'] < 0 ){
									header('location: '.dir_root.'account-disabled.php');
								}

								$_SESSION['user'] = $row['username'];
								$_SESSION['email'] = $row['email'];
								$_SESSION['accountType'] = $row['accountType'];
							}
						}

						if($result->num_rows == 0){
							session_unset();
							header('Location: '.$_SERVER['REQUEST_URI']);
						}
				}

			// check 'User-Authorities' to access the 'Function pages' (from database)
				$is_accessible = false;
				$result = $conn->query("SELECT * FROM function");
					
					if($result) {
						while ( $row = $result->fetch_assoc() ){

							// check 'current URL' with the url in the databse
							$url_trimmed = str_replace('.php', '', $row['function_url']); //eliminate '.php'
							if ( strpos($_SERVER['PHP_SELF'], $url_trimmed) !== false ){
								
								// check if 'current URL' is allowed by current 'account-type'
								$val = explode(',', $row['accountType']);
								foreach ( $val as $v){

									if ( $_SESSION['accountType'] == $v[0] ){ // redirect to 'dashboard' if not allowed to access page
										$is_accessible = true;
									}
								}

								if (!$is_accessible){
									header('location: '.dir_root.'account/dashboard.php');
								}

							}
						}
					}

				$conn->close();


		if ($is_forbidden){
			header('location: '.dir_root.'account/dashboard.php');
		}
	}
	else{
		$pgPrivate = array('dashboard', 'profile');
		$is_Private = false;
            
            foreach($pgPrivate as $arrVal) {
                if ( strpos($_SERVER['PHP_SELF'], $arrVal) !== false ){  //if url contain the val in the array
                    $is_Private = true;
                }
            }

            
            // set 'Function pages' as 'Private' (get list of function pages from database)
            $result = $conn->query("SELECT * FROM function");
				
				if($result) {
					while ( $row = $result->fetch_assoc() ){

						// check 'current URL' with the url in the databse
						$url_trimmed = str_replace('.php', '', $row['function_url']); //eliminate '.php'
						
						if ( strpos($_SERVER['PHP_SELF'], $url_trimmed) !== false ){
							$is_Private = true;
						}
					}
				}

		if ($is_Private){
			header('location: '.dir_root.'sign-in.php');
		}
	}
?>