<?php
include '../db.php';
include '../auth.php';

if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

// Check if user is logged in
if (!isset($_SESSION['role_id'])) {
    echo json_encode(['has_right' => false, 'message' => 'Not logged in']);
    exit;
}

$role_id = $_SESSION['role_id'];

// Check if user has the "Edit Sale Price in POS" right
$right_name = 'Edit Sale Price in POS';
$query = $conn->prepare("
    SELECT 1 FROM role_rights 
    JOIN rights ON role_rights.right_id = rights.id 
    WHERE role_rights.role_id = ? AND LOWER(rights.name) = LOWER(?)
    LIMIT 1
");
$query->bind_param("is", $role_id, $right_name);
$query->execute();
$query->store_result();

$has_right = $query->num_rows > 0;

header('Content-Type: application/json');
echo json_encode([
    'has_right' => $has_right,
    'message' => $has_right ? 'User has price editing rights' : 'User does not have price editing rights'
]);
?>
