validate-session-ajax.php

<?php
/**
 * AJAX SESSION VALIDATOR (WITH ONE-DEVICE MODE CHECK)
 * File: validate-session-ajax.php
 * Returns JSON response indicating if session is valid
 * 
 * NEW: Now checks if user has one_device_mode enabled before validating
 */

session_start();
header('Content-Type: application/json');

// Suppress errors
error_reporting(0);
@ini_set('display_errors', 0);

$response = ['status' => 'invalid'];

// Check if user is logged in
if (isset($_SESSION['staff_user']) && isset($_SESSION['user_id']) && isset($_SESSION['session_token'])) {
    
    include 'db_connect.php';
    
    $session_token = $_SESSION['session_token'];
    $user_id = $_SESSION['user_id'];
    
    // ✅ NEW: Check if user has one_device_mode enabled
    $check_sql = "SELECT session_token, one_device_mode FROM staff_users WHERE id = " . intval($user_id) . " LIMIT 1";
    $check_result = @mysqli_query($conn, $check_sql);
    
    if ($check_result && mysqli_num_rows($check_result) > 0) {
        $db_row = mysqli_fetch_assoc($check_result);
        $db_session_token = $db_row['session_token'];
        $one_device_mode = $db_row['one_device_mode'] ?? 'enabled'; // Default to enabled if column doesn't exist
        
        // ✅ If one_device_mode is disabled, user can have multiple sessions
        if ($one_device_mode === 'disabled') {
            // Multi-device allowed - session is always valid
            $response = ['status' => 'valid', 'mode' => 'multi-device'];
        } else {
            // ✅ One-device mode enabled - check session token
            if ($session_token === $db_session_token) {
                // Session is valid
                $response = ['status' => 'valid', 'mode' => 'single-device'];
            } else {
                // Device conflict - session invalid
                $response = ['status' => 'invalid', 'reason' => 'device_conflict'];
                
                // Destroy session
                session_unset();
                session_destroy();
                session_start();
                $_SESSION['logout_reason'] = 'device_conflict';
            }
        }
    } else {
        // User not found in database
        $response = ['status' => 'invalid', 'reason' => 'user_not_found'];
        session_unset();
        session_destroy();
    }
    
    @mysqli_close($conn);
}

echo json_encode($response);
exit();
?>