<?php
// header.php – role-aware common chrome for every authenticated page.
require_once __DIR__ . '/auth.php';

$user = current_user();
$currentPage = basename($_SERVER['PHP_SELF']);

function nav_active(string $page, string $current): string {
    return $page === $current ? ' class="active"' : '';
}

$csrfTokenForMeta = csrf_token();
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="csrf-token" content="<?php echo htmlspecialchars($csrfTokenForMeta, ENT_QUOTES); ?>">
<title>OSCE Nexus™</title>
<link rel="stylesheet" href="assets/css/app.css">
<script src="assets/js/app.js"></script>
</head>
<body>
<div class="topbar">
    <div class="brand">
        OSCE Nexus™
        <small>Developed by Khalaf Almazrouei</small>
    </div>
    <div class="user-area">
        <?php if ($user): ?>
            <span>Hello, <?php echo h($user['full_name']); ?>
                <small class="muted">(<?php echo h(perms_role($user)); ?>)</small>
            </span>
            <a href="dashboard.php">Dashboard</a>
            <a href="enroll_face.php">Face Login</a>
            <a href="change_password.php">Change Password</a>
            <a href="logout.php">Logout</a>
        <?php endif; ?>
    </div>
</div>

<?php if ($user): ?>
<div class="navbar">
    <a href="dashboard.php"<?php echo nav_active('dashboard.php', $currentPage); ?>>Home</a>

    <a href="candidates.php"<?php echo nav_active('candidates.php', $currentPage); ?>>Candidates</a>
    <?php if (perms_can_import_candidates($user)): ?>
        <a href="candidates_import.php"<?php echo nav_active('candidates_import.php', $currentPage); ?>>Import</a>
    <?php endif; ?>
    <?php if (perms_can_export_candidates($user)): ?>
        <a href="export_candidates.php"<?php echo nav_active('export_candidates.php', $currentPage); ?>>Export Candidates</a>
    <?php endif; ?>
    <a href="barcode_labels.php"<?php echo nav_active('barcode_labels.php', $currentPage); ?>>Barcodes</a>

    <?php if (perms_can_manage_forms($user)): ?>
        <a href="forms.php"<?php echo nav_active('forms.php', $currentPage); ?>>Forms</a>
    <?php endif; ?>
    <?php if (perms_can_manage_exams($user)): ?>
        <a href="exams.php"<?php echo nav_active('exams.php', $currentPage); ?>>Exams</a>
    <?php endif; ?>

    <a href="grade.php"<?php echo nav_active('grade.php', $currentPage); ?>>Grade</a>

    <a href="export_grades.php"<?php echo nav_active('export_grades.php', $currentPage); ?>>Export Grades</a>

    <?php if (perms_can_view_analytics($user)): ?>
        <a href="analytics.php"<?php echo nav_active('analytics.php', $currentPage); ?>>Analytics</a>
    <?php endif; ?>

    <?php if (perms_can_view_live_dashboard($user)): ?>
        <a href="live_dashboard.php" class="danger<?php if($currentPage==='live_dashboard.php') echo ' active'; ?>">● Live Dashboard</a>
    <?php endif; ?>

    <?php if (perms_can_manage_facilities($user)): ?>
        <a href="facilities.php"<?php echo nav_active('facilities.php', $currentPage); ?>>Facilities</a>
    <?php endif; ?>
    <?php if (perms_can_manage_users($user)): ?>
        <a href="users.php"<?php echo nav_active('users.php', $currentPage); ?>>Users</a>
    <?php endif; ?>
    <?php if (perms_can_view_audit($user)): ?>
        <a href="audit_log.php"<?php echo nav_active('audit_log.php', $currentPage); ?>>Audit</a>
    <?php endif; ?>
</div>
<?php endif; ?>

<div class="container">
