<?php
// ============================================================
// transit/connect_admin.php — بوابة لوحة الويب (مشرف المؤسسة)
// المصادقة عبر session token (هاتف + OTP) — مستقلة عن JWT
// ============================================================

require_once __DIR__ . '/../core/bootstrap.php';
require_once __DIR__ . '/functions.php';

// CORS لواجهة الويب
$adminOrigins = array_map('trim', explode(',',
    getenv('TRANSIT_ADMIN_ORIGINS') ?: 'https://transit.siromove.com,https://admin.siromove.com'
));
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
if (in_array($origin, $adminOrigins)) {
    header("Access-Control-Allow-Origin: $origin");
    header('Access-Control-Allow-Credentials: true');
}
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { http_response_code(200); exit; }

// Rate limiting على جلسات لوحة المشرف
$limiter = new RateLimiter($redis);
$limiter->enforce(RateLimiter::identifier(), 'api');

// اتصال Transit DB
try {
    $transit_con = Database::get('transit');
} catch (Exception $e) {
    http_response_code(503);
    echo json_encode(['status' => 'failure', 'message' => 'Transit service unavailable']);
    exit;
}

// التحقق من الـ session (يُعيد ['admin_id'=>X, 'org_id'=>Y])
$transit_admin = transitAuthAdmin();
$transit_admin_id = (int)$transit_admin['admin_id'];
$transit_org_id   = (int)$transit_admin['org_id'];