diff --git a/app/ac_dashboard/api/engine/by_source.php b/app/ac_dashboard/api/engine/by_source.php
index b721ba3..edcbd83 100644
--- a/app/ac_dashboard/api/engine/by_source.php
+++ b/app/ac_dashboard/api/engine/by_source.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/ac_dashboard/api/engine/journals.php b/app/ac_dashboard/api/engine/journals.php
index 74d2b8b..4a3f217 100644
--- a/app/ac_dashboard/api/engine/journals.php
+++ b/app/ac_dashboard/api/engine/journals.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/ac_dashboard/api/engine/pl.php b/app/ac_dashboard/api/engine/pl.php
index eedfb66..b17d0b1 100644
--- a/app/ac_dashboard/api/engine/pl.php
+++ b/app/ac_dashboard/api/engine/pl.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/ac_dashboard/api/engine/posting_window.php b/app/ac_dashboard/api/engine/posting_window.php
index 4f1b05c..75a30ef 100644
--- a/app/ac_dashboard/api/engine/posting_window.php
+++ b/app/ac_dashboard/api/engine/posting_window.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/CompanySettingManager.php';
 
diff --git a/app/ac_dashboard/api/engine/recent.php b/app/ac_dashboard/api/engine/recent.php
index f0014f5..7a85982 100644
--- a/app/ac_dashboard/api/engine/recent.php
+++ b/app/ac_dashboard/api/engine/recent.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/ac_dashboard/api/engine/trend.php b/app/ac_dashboard/api/engine/trend.php
index cc08acb..ae41ea5 100644
--- a/app/ac_dashboard/api/engine/trend.php
+++ b/app/ac_dashboard/api/engine/trend.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/ac_dashboard/index.php b/app/ac_dashboard/index.php
index 1822968..835bba2 100644
--- a/app/ac_dashboard/index.php
+++ b/app/ac_dashboard/index.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/account_formulas.php b/app/accounting/account_formulas.php
index fb270db..1e7ab14 100644
--- a/app/accounting/account_formulas.php
+++ b/app/accounting/account_formulas.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/api/engine/account.php b/app/accounting/api/engine/account.php
index dc93c73..3c3eec0 100644
--- a/app/accounting/api/engine/account.php
+++ b/app/accounting/api/engine/account.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
 
diff --git a/app/accounting/api/engine/account_formula.php b/app/accounting/api/engine/account_formula.php
index e593300..c6ba89c 100644
--- a/app/accounting/api/engine/account_formula.php
+++ b/app/accounting/api/engine/account_formula.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin', 'staff']);
 require_once '../../../assets/utils/classes_ac/AccountFormulaManager.php';
diff --git a/app/accounting/api/engine/account_stats.php b/app/accounting/api/engine/account_stats.php
index 84af1e7..4231ec4 100644
--- a/app/accounting/api/engine/account_stats.php
+++ b/app/accounting/api/engine/account_stats.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/UsageGuard.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
diff --git a/app/accounting/api/engine/acquire_op_lock.php b/app/accounting/api/engine/acquire_op_lock.php
index 9d756ff..3c61654 100644
--- a/app/accounting/api/engine/acquire_op_lock.php
+++ b/app/accounting/api/engine/acquire_op_lock.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/OperationLockManager.php';
 
diff --git a/app/accounting/api/engine/department.php b/app/accounting/api/engine/department.php
index 9389191..092656e 100644
--- a/app/accounting/api/engine/department.php
+++ b/app/accounting/api/engine/department.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/DepartmentManager.php';
 
diff --git a/app/accounting/api/engine/department_stats.php b/app/accounting/api/engine/department_stats.php
index 0e5129e..6048214 100644
--- a/app/accounting/api/engine/department_stats.php
+++ b/app/accounting/api/engine/department_stats.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/UsageGuard.php';
 require_once '../../../assets/utils/classes_ac/DepartmentManager.php';
diff --git a/app/accounting/api/engine/get_balance_sheet.php b/app/accounting/api/engine/get_balance_sheet.php
index 20fea7c..1000ea4 100644
--- a/app/accounting/api/engine/get_balance_sheet.php
+++ b/app/accounting/api/engine/get_balance_sheet.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/accounting/api/engine/get_gl_by_source.php b/app/accounting/api/engine/get_gl_by_source.php
index 6a07ee5..e991094 100644
--- a/app/accounting/api/engine/get_gl_by_source.php
+++ b/app/accounting/api/engine/get_gl_by_source.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/GlManager.php';
 require_once '../../../assets/utils/classes_ac/GlQueryManager.php';
diff --git a/app/accounting/api/engine/get_gl_documents.php b/app/accounting/api/engine/get_gl_documents.php
index 8cd291b..e50e25c 100644
--- a/app/accounting/api/engine/get_gl_documents.php
+++ b/app/accounting/api/engine/get_gl_documents.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/GlQueryManager.php';
 
diff --git a/app/accounting/api/engine/get_gl_movement.php b/app/accounting/api/engine/get_gl_movement.php
index 8263bdc..c92652a 100644
--- a/app/accounting/api/engine/get_gl_movement.php
+++ b/app/accounting/api/engine/get_gl_movement.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/accounting/api/engine/get_journal_detail.php b/app/accounting/api/engine/get_journal_detail.php
index e2e310c..9904885 100644
--- a/app/accounting/api/engine/get_journal_detail.php
+++ b/app/accounting/api/engine/get_journal_detail.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/GlQueryManager.php';
 
diff --git a/app/accounting/api/engine/get_journal_listing.php b/app/accounting/api/engine/get_journal_listing.php
index 7a5e5f6..86e44c0 100644
--- a/app/accounting/api/engine/get_journal_listing.php
+++ b/app/accounting/api/engine/get_journal_listing.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/GlQueryManager.php';
 
diff --git a/app/accounting/api/engine/get_pl_statement.php b/app/accounting/api/engine/get_pl_statement.php
index 04796ad..0911a5c 100644
--- a/app/accounting/api/engine/get_pl_statement.php
+++ b/app/accounting/api/engine/get_pl_statement.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/accounting/api/engine/get_trial_balance.php b/app/accounting/api/engine/get_trial_balance.php
index e2e029f..665d28c 100644
--- a/app/accounting/api/engine/get_trial_balance.php
+++ b/app/accounting/api/engine/get_trial_balance.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/accounting/api/engine/get_vat_report.php b/app/accounting/api/engine/get_vat_report.php
index 49c3612..fa95f0a 100644
--- a/app/accounting/api/engine/get_vat_report.php
+++ b/app/accounting/api/engine/get_vat_report.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/accounting/api/engine/log_batch_action.php b/app/accounting/api/engine/log_batch_action.php
index da121ba..5e3e7ed 100644
--- a/app/accounting/api/engine/log_batch_action.php
+++ b/app/accounting/api/engine/log_batch_action.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/BatchActionManager.php';
 
diff --git a/app/accounting/api/engine/manage_account.php b/app/accounting/api/engine/manage_account.php
index e6f15d4..d795e68 100644
--- a/app/accounting/api/engine/manage_account.php
+++ b/app/accounting/api/engine/manage_account.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
 
diff --git a/app/accounting/api/engine/manage_department.php b/app/accounting/api/engine/manage_department.php
index 9a02d73..d22e968 100644
--- a/app/accounting/api/engine/manage_department.php
+++ b/app/accounting/api/engine/manage_department.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/DepartmentManager.php';
 
diff --git a/app/accounting/api/engine/post_gl_entry.php b/app/accounting/api/engine/post_gl_entry.php
index aad8114..8ac4c85 100644
--- a/app/accounting/api/engine/post_gl_entry.php
+++ b/app/accounting/api/engine/post_gl_entry.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/PostingWindowGuard.php';
 require_once '../../../assets/utils/classes_ac/GlManager.php';
diff --git a/app/accounting/api/engine/posting_window.php b/app/accounting/api/engine/posting_window.php
index ac5a550..b4ed19c 100644
--- a/app/accounting/api/engine/posting_window.php
+++ b/app/accounting/api/engine/posting_window.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/CompanySettingManager.php';
 require_role($user_role, ['owner', 'admin']);
diff --git a/app/accounting/api/engine/product_account_mapping.php b/app/accounting/api/engine/product_account_mapping.php
index 2f00e07..be0daae 100644
--- a/app/accounting/api/engine/product_account_mapping.php
+++ b/app/accounting/api/engine/product_account_mapping.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/ProductManager.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
diff --git a/app/accounting/api/engine/release_op_lock.php b/app/accounting/api/engine/release_op_lock.php
index f4d11ec..a63fa52 100644
--- a/app/accounting/api/engine/release_op_lock.php
+++ b/app/accounting/api/engine/release_op_lock.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/OperationLockManager.php';
 
diff --git a/app/accounting/api/engine/remove_account.php b/app/accounting/api/engine/remove_account.php
index fd661bd..6d3909a 100644
--- a/app/accounting/api/engine/remove_account.php
+++ b/app/accounting/api/engine/remove_account.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
 
diff --git a/app/accounting/api/engine/remove_department.php b/app/accounting/api/engine/remove_department.php
index 12d8f75..d913463 100644
--- a/app/accounting/api/engine/remove_department.php
+++ b/app/accounting/api/engine/remove_department.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/DepartmentManager.php';
 
diff --git a/app/accounting/api/engine/retrieve_account.php b/app/accounting/api/engine/retrieve_account.php
index d583846..68d41b9 100644
--- a/app/accounting/api/engine/retrieve_account.php
+++ b/app/accounting/api/engine/retrieve_account.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
 
diff --git a/app/accounting/api/engine/retrieve_department.php b/app/accounting/api/engine/retrieve_department.php
index 3c2638e..485b9ee 100644
--- a/app/accounting/api/engine/retrieve_department.php
+++ b/app/accounting/api/engine/retrieve_department.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/DepartmentManager.php';
 
diff --git a/app/accounting/api/engine/save_manual_journal.php b/app/accounting/api/engine/save_manual_journal.php
index ae47565..73ff8e8 100644
--- a/app/accounting/api/engine/save_manual_journal.php
+++ b/app/accounting/api/engine/save_manual_journal.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/DocumentNumberManager.php';
 require_once '../../../assets/utils/classes_ac/PostingWindowGuard.php';
diff --git a/app/accounting/balance_sheet.php b/app/accounting/balance_sheet.php
index b685b12..68b55f0 100644
--- a/app/accounting/balance_sheet.php
+++ b/app/accounting/balance_sheet.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/chart_of_accounts.php b/app/accounting/chart_of_accounts.php
index 7f170b8..345924a 100644
--- a/app/accounting/chart_of_accounts.php
+++ b/app/accounting/chart_of_accounts.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/departments.php b/app/accounting/departments.php
index 033fd47..0d23598 100644
--- a/app/accounting/departments.php
+++ b/app/accounting/departments.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/gl_entries.php b/app/accounting/gl_entries.php
index c970b77..82756f2 100644
--- a/app/accounting/gl_entries.php
+++ b/app/accounting/gl_entries.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/gl_movement.php b/app/accounting/gl_movement.php
index ae8a269..bd56062 100644
--- a/app/accounting/gl_movement.php
+++ b/app/accounting/gl_movement.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/journal_listing.php b/app/accounting/journal_listing.php
index efed99a..0fb24a3 100644
--- a/app/accounting/journal_listing.php
+++ b/app/accounting/journal_listing.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/manage_account.php b/app/accounting/manage_account.php
index f5da6c1..eefa1a0 100644
--- a/app/accounting/manage_account.php
+++ b/app/accounting/manage_account.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/manage_department.php b/app/accounting/manage_department.php
index f17f99f..ee938d4 100644
--- a/app/accounting/manage_department.php
+++ b/app/accounting/manage_department.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/pl_statement.php b/app/accounting/pl_statement.php
index 3e5907f..f7f3d99 100644
--- a/app/accounting/pl_statement.php
+++ b/app/accounting/pl_statement.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/posting_window.php b/app/accounting/posting_window.php
index ed4b4c9..a86cee2 100644
--- a/app/accounting/posting_window.php
+++ b/app/accounting/posting_window.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/trial_balance.php b/app/accounting/trial_balance.php
index 9ca2e24..315c3a2 100644
--- a/app/accounting/trial_balance.php
+++ b/app/accounting/trial_balance.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/accounting/vat_report.php b/app/accounting/vat_report.php
index 1aadad4..66b44fe 100644
--- a/app/accounting/vat_report.php
+++ b/app/accounting/vat_report.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/assets/js/custom.js b/app/assets/js/custom.js
index fe9c47e..63c1fa7 100644
--- a/app/assets/js/custom.js
+++ b/app/assets/js/custom.js
@@ -905,6 +905,17 @@ function ajax_request(options) {
       return;
     }
 
+    // Session ended on the server (idle timeout, not signed in, password changed):
+    // drop per-tab data and go back to the sign-in form.
+    const endedCodes = ['session_expired', 'auth_required', 'password_changed'];
+    if (xhr?.status === 401 && endedCodes.includes(xhr?.responseJSON?.code)) {
+      try { sessionStorage.clear(); } catch (e) {}
+      bootbox.alert(escape_html(xhr.responseJSON.message || 'Please sign in again.'), function() {
+        window.location.href = server_url + 'login/index.php';
+      });
+      return;
+    }
+
     // File / payload too large (nginx 413)
     if (xhr?.status === 413) {
       bootbox.alert('The file you selected is too large. Please use an image under 2 MB and try again.');
diff --git a/app/assets/utils/app_access.php b/app/assets/utils/app_access.php
new file mode 100644
index 0000000..f4036fb
--- /dev/null
+++ b/app/assets/utils/app_access.php
@@ -0,0 +1,37 @@
+<?php
+/**
+ * app_access.php — which app (WMS / Accounting) a script belongs to, and whether
+ * the signed-in user's app_access allows it.
+ *
+ * app_access used to only choose which menus the topbar drew; a WMS-only user
+ * could still open the accounting pages and call their APIs directly. db_auth.php
+ * (API engines) and include_topbar.php (pages) now both enforce it through here.
+ */
+
+// Accounting endpoints the WMS screens also call (master-data lookups, the
+// batch operation lock, and the GL panel on purchase invoices).
+const APP_ACCESS_SHARED_ACCOUNTING = [
+    'accounting/api/engine/account.php',
+    'accounting/api/engine/account_formula.php',
+    'accounting/api/engine/department.php',
+    'accounting/api/engine/acquire_op_lock.php',
+    'accounting/api/engine/release_op_lock.php',
+    'accounting/api/engine/get_gl_by_source.php',
+];
+
+/** The app a script under app/ belongs to: 'accounting', or null for WMS/shared. */
+function app_access_app_for(string $script_name): ?string {
+    $path = str_replace('\\', '/', $script_name);
+    $pos  = strpos($path, '/app/');
+    if ($pos === false) return null;
+    $rel = substr($path, $pos + 5);
+
+    if (in_array($rel, APP_ACCESS_SHARED_ACCOUNTING, true)) return null;
+    if (preg_match('#^(accounting|ac_dashboard|revenue|expense|finance|journal)/#', $rel)) return 'accounting';
+    return null;
+}
+
+/** Whether an app_access value ('wms', 'accounting', 'all') includes $app. */
+function app_access_allows(string $access, string $app): bool {
+    return $access === 'all' || $access === $app;
+}
diff --git a/app/assets/utils/db_auth.php b/app/assets/utils/db_auth.php
index ec8e17e..74136b7 100644
--- a/app/assets/utils/db_auth.php
+++ b/app/assets/utils/db_auth.php
@@ -38,6 +38,7 @@ set_exception_handler(function (Throwable $e) {
 require_once __DIR__."/../../config.php";
 require_once __DIR__."/../../dbconn.php";
 require_once __DIR__."/db_helpers.php";
+require_once __DIR__."/app_access.php";
 
 if (!function_exists('require_role')) {
     function require_role(string $user_role, array $allowed): void {
@@ -53,14 +54,14 @@ if(!empty($_SESSION["login_company_id"])){
     // CSRF Validation — add right at the top of the logged-in block
     if($_SERVER['REQUEST_METHOD'] === 'POST'){
         $csrf_token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
-        if(empty($csrf_token) || $csrf_token !== $_SESSION['csrf_token']){
+        if(empty($csrf_token) || !hash_equals((string)($_SESSION['csrf_token'] ?? ''), $csrf_token)){
             http_response_code(403);
             exit(json_encode(["message" => "Invalid request"]));
         }
     }
 
     // validate otp
-    $sql = "SELECT `password`
+    $sql = "SELECT `password`, license, app_access
         FROM user 
         WHERE user_id = :company_id";
     $sth = $pdo1->prepare($sql);
@@ -68,7 +69,8 @@ if(!empty($_SESSION["login_company_id"])){
         ":company_id" => $_SESSION["login_user_id"]
     ]);
     db_check($sth, $answer);
-    $password = $sth->fetchColumn();
+    $user_row = $sth->fetch(PDO::FETCH_ASSOC) ?: [];
+    $password = $user_row['password'] ?? '';
     /** Generate OTP */
     function generateOTP($sercet_key, $time_step = 180, $length = 6){
         $counter = floor($_SESSION["otpTime"] / $time_step);
@@ -83,7 +85,9 @@ if(!empty($_SESSION["login_company_id"])){
     $otp = generateOTP($password);
     
     if( $_SESSION["otp"]!=$otp ){
+        http_response_code(401);
         $answer["message"] = "Your password has been reset, Please logout and login again.";
+        $answer["code"] = "password_changed";
         exit(json_encode($answer));
     }
     
@@ -98,13 +102,29 @@ if(!empty($_SESSION["login_company_id"])){
     $map = $sth->fetchAll(PDO::FETCH_ASSOC);
     
     if( count($map)==0 ){
+        http_response_code(403);
         $answer["message"] = "Your accessibility to this company has been removed.";
+        $answer["code"] = "access_removed";
         exit(json_encode($answer));
     }
 
     $user_role = $map[0]['role'] ?? 'viewer';
     $_SESSION['login_role'] = $user_role;
 
+    // App access (WMS / Accounting), re-read on every request so a change made in
+    // Setting → Users applies at once. Owners hold it on their own user row;
+    // invited users per company (same rule as login_confirm.php).
+    $app_access = (($user_row['license'] ?? 'owner') === 'owner')
+        ? ($user_row['app_access'] ?? 'wms')
+        : ($map[0]['app_access'] ?? 'wms');
+    $_SESSION['login_app_access'] = $app_access;
+
+    $required_app = app_access_app_for($_SERVER['SCRIPT_NAME'] ?? '');
+    if ($required_app !== null && !app_access_allows($app_access, $required_app)) {
+        http_response_code(403);
+        exit(json_encode(['success' => 0, 'message' => 'Your account does not have access to this module.']));
+    }
+
     // Single-session enforcement: if a session_token was issued at login, verify
     // it still matches the DB. A mismatch means a newer login has taken over.
     if (!empty($_SESSION['session_token'])) {
@@ -132,7 +152,12 @@ if(!empty($_SESSION["login_company_id"])){
 // unless the engine explicitly declared itself a pre-auth route.
 if (empty($_SESSION['login_company_id']) && !defined('UNAUTHENTICATED_ROUTE')) {
     http_response_code(401);
-    exit(json_encode(['success' => 0, 'message' => 'Authentication required.']));
+    $expired = !empty($_SESSION['_idle_expired']);
+    exit(json_encode([
+        'success' => 0,
+        'message' => $expired ? 'Your session has expired. Please sign in again.' : 'Authentication required.',
+        'code'    => $expired ? 'session_expired' : 'auth_required',
+    ]));
 }
 
 // set up ANSWER
@@ -153,6 +178,7 @@ if (!is_array($data)) {
     $data = $_POST;
 } else {
     // Truly no data received
+    http_response_code(400);
     $answer["message"] = "Request denied: No valid JSON payload or Form Data detected.";
     exit(json_encode($answer));
 }
diff --git a/app/contact/api/engine/contact.php b/app/contact/api/engine/contact.php
index 7caa1a2..b359be5 100644
--- a/app/contact/api/engine/contact.php
+++ b/app/contact/api/engine/contact.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 
diff --git a/app/contact/api/engine/contact_stats.php b/app/contact/api/engine/contact_stats.php
index 4be20ec..3101b5d 100644
--- a/app/contact/api/engine/contact_stats.php
+++ b/app/contact/api/engine/contact_stats.php
@@ -1,5 +1,5 @@
 <?php 
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
 
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/contact/api/engine/contact_type.php b/app/contact/api/engine/contact_type.php
index 0a6849e..f07de56 100644
--- a/app/contact/api/engine/contact_type.php
+++ b/app/contact/api/engine/contact_type.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 
diff --git a/app/contact/api/engine/manage_contact.php b/app/contact/api/engine/manage_contact.php
index dfd55a9..7b5a273 100644
--- a/app/contact/api/engine/manage_contact.php
+++ b/app/contact/api/engine/manage_contact.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/FileUploader.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
diff --git a/app/contact/api/engine/manage_contact_type.php b/app/contact/api/engine/manage_contact_type.php
index a0c056c..969bf1f 100644
--- a/app/contact/api/engine/manage_contact_type.php
+++ b/app/contact/api/engine/manage_contact_type.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 
diff --git a/app/contact/api/engine/remove_contact.php b/app/contact/api/engine/remove_contact.php
index 21e1269..699cbee 100644
--- a/app/contact/api/engine/remove_contact.php
+++ b/app/contact/api/engine/remove_contact.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 
diff --git a/app/contact/api/engine/remove_contact_type.php b/app/contact/api/engine/remove_contact_type.php
index 67e774b..c2d1e03 100644
--- a/app/contact/api/engine/remove_contact_type.php
+++ b/app/contact/api/engine/remove_contact_type.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 
diff --git a/app/contact/api/engine/retrieve_contact.php b/app/contact/api/engine/retrieve_contact.php
index 3ee2647..c7d4ade 100644
--- a/app/contact/api/engine/retrieve_contact.php
+++ b/app/contact/api/engine/retrieve_contact.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 
diff --git a/app/contact/api/engine/retrieve_contact_type.php b/app/contact/api/engine/retrieve_contact_type.php
index e514aa6..8366544 100644
--- a/app/contact/api/engine/retrieve_contact_type.php
+++ b/app/contact/api/engine/retrieve_contact_type.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 
diff --git a/app/contact/contact.php b/app/contact/contact.php
index 2a16c52..8724711 100644
--- a/app/contact/contact.php
+++ b/app/contact/contact.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/contact/manage_contact.php b/app/contact/manage_contact.php
index 1a50311..c33e43c 100644
--- a/app/contact/manage_contact.php
+++ b/app/contact/manage_contact.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/contact/manage_contact_type.php b/app/contact/manage_contact_type.php
index 2bdd3ad..963f4cf 100644
--- a/app/contact/manage_contact_type.php
+++ b/app/contact/manage_contact_type.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/dashboard/api/engine_report/low_stock.php b/app/dashboard/api/engine_report/low_stock.php
index 6702e75..96bde4a 100644
--- a/app/dashboard/api/engine_report/low_stock.php
+++ b/app/dashboard/api/engine_report/low_stock.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
 
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
diff --git a/app/dashboard/api/engine_report/reports_stats.php b/app/dashboard/api/engine_report/reports_stats.php
index 70cc027..64b2e16 100644
--- a/app/dashboard/api/engine_report/reports_stats.php
+++ b/app/dashboard/api/engine_report/reports_stats.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
diff --git a/app/dashboard/index.php b/app/dashboard/index.php
index 52b1567..ac0ae9f 100644
--- a/app/dashboard/index.php
+++ b/app/dashboard/index.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/dashboard/low_stock_products.php b/app/dashboard/low_stock_products.php
index b7b580b..1f52e68 100644
--- a/app/dashboard/low_stock_products.php
+++ b/app/dashboard/low_stock_products.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/expense/api/engine/convert_purchase_request.php b/app/expense/api/engine/convert_purchase_request.php
index b225d69..010e0bd 100644
--- a/app/expense/api/engine/convert_purchase_request.php
+++ b/app/expense/api/engine/convert_purchase_request.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
 require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
diff --git a/app/expense/api/engine/delete_supplier_credit_note.php b/app/expense/api/engine/delete_supplier_credit_note.php
index b65a1e4..b28bed8 100644
--- a/app/expense/api/engine/delete_supplier_credit_note.php
+++ b/app/expense/api/engine/delete_supplier_credit_note.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/expense/api/engine/manage_purchase_request.php b/app/expense/api/engine/manage_purchase_request.php
index fe32206..cbf27c7 100644
--- a/app/expense/api/engine/manage_purchase_request.php
+++ b/app/expense/api/engine/manage_purchase_request.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
 require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/expense/api/engine/manage_supplier_credit_note.php b/app/expense/api/engine/manage_supplier_credit_note.php
index 3241d16..7937754 100644
--- a/app/expense/api/engine/manage_supplier_credit_note.php
+++ b/app/expense/api/engine/manage_supplier_credit_note.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/expense/api/engine/retrieve_purchase_request.php b/app/expense/api/engine/retrieve_purchase_request.php
index b7a98f4..82f1696 100644
--- a/app/expense/api/engine/retrieve_purchase_request.php
+++ b/app/expense/api/engine/retrieve_purchase_request.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
 
diff --git a/app/expense/api/engine/update_purchase_request_status.php b/app/expense/api/engine/update_purchase_request_status.php
index 01689c2..85c7035 100644
--- a/app/expense/api/engine/update_purchase_request_status.php
+++ b/app/expense/api/engine/update_purchase_request_status.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
 require_role($user_role, ['owner', 'admin', 'staff']);
diff --git a/app/expense/manage_purchase_invoice.php b/app/expense/manage_purchase_invoice.php
index e65ae1b..0bd147f 100644
--- a/app/expense/manage_purchase_invoice.php
+++ b/app/expense/manage_purchase_invoice.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/expense/manage_purchase_order.php b/app/expense/manage_purchase_order.php
index 1e6d522..78b3d33 100644
--- a/app/expense/manage_purchase_order.php
+++ b/app/expense/manage_purchase_order.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/expense/manage_purchase_request.php b/app/expense/manage_purchase_request.php
index 4d9a607..e9883a9 100644
--- a/app/expense/manage_purchase_request.php
+++ b/app/expense/manage_purchase_request.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/expense/manage_supplier_credit_note.php b/app/expense/manage_supplier_credit_note.php
index 5129299..d3f8a05 100644
--- a/app/expense/manage_supplier_credit_note.php
+++ b/app/expense/manage_supplier_credit_note.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/expense/purchase_invoice.php b/app/expense/purchase_invoice.php
index f0013ce..5b3a1b9 100644
--- a/app/expense/purchase_invoice.php
+++ b/app/expense/purchase_invoice.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/expense/purchase_order.php b/app/expense/purchase_order.php
index 6f1a71c..7904ecd 100644
--- a/app/expense/purchase_order.php
+++ b/app/expense/purchase_order.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/expense/purchase_request.php b/app/expense/purchase_request.php
index f5a3c39..b9d16b0 100644
--- a/app/expense/purchase_request.php
+++ b/app/expense/purchase_request.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/finance/api/engine/delete_payment.php b/app/finance/api/engine/delete_payment.php
index db37bd6..8785ed1 100644
--- a/app/finance/api/engine/delete_payment.php
+++ b/app/finance/api/engine/delete_payment.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/PaymentManager.php';
diff --git a/app/finance/api/engine/delete_payment_billing.php b/app/finance/api/engine/delete_payment_billing.php
index c51d52f..f947aa3 100644
--- a/app/finance/api/engine/delete_payment_billing.php
+++ b/app/finance/api/engine/delete_payment_billing.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/PaymentBillingManager.php';
diff --git a/app/finance/api/engine/delete_receipt.php b/app/finance/api/engine/delete_receipt.php
index 1deee8a..67828bb 100644
--- a/app/finance/api/engine/delete_receipt.php
+++ b/app/finance/api/engine/delete_receipt.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/ReceiptManager.php';
diff --git a/app/finance/api/engine/delete_receipt_billing.php b/app/finance/api/engine/delete_receipt_billing.php
index 262ea0d..962f70e 100644
--- a/app/finance/api/engine/delete_receipt_billing.php
+++ b/app/finance/api/engine/delete_receipt_billing.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/ReceiptBillingManager.php';
diff --git a/app/finance/api/engine/manage_payment.php b/app/finance/api/engine/manage_payment.php
index 5aff3bc..b2ed81f 100644
--- a/app/finance/api/engine/manage_payment.php
+++ b/app/finance/api/engine/manage_payment.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/finance/api/engine/manage_payment_billing.php b/app/finance/api/engine/manage_payment_billing.php
index bc3c0c1..c6de323 100644
--- a/app/finance/api/engine/manage_payment_billing.php
+++ b/app/finance/api/engine/manage_payment_billing.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/PaymentBillingManager.php';
diff --git a/app/finance/api/engine/manage_receipt.php b/app/finance/api/engine/manage_receipt.php
index 3fc6a3a..9b8cadc 100644
--- a/app/finance/api/engine/manage_receipt.php
+++ b/app/finance/api/engine/manage_receipt.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/finance/api/engine/manage_receipt_billing.php b/app/finance/api/engine/manage_receipt_billing.php
index e535e5a..9313a16 100644
--- a/app/finance/api/engine/manage_receipt_billing.php
+++ b/app/finance/api/engine/manage_receipt_billing.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/ReceiptBillingManager.php';
diff --git a/app/finance/manage_payment.php b/app/finance/manage_payment.php
index b51a310..f2bd8b3 100644
--- a/app/finance/manage_payment.php
+++ b/app/finance/manage_payment.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
 
   // A detail-only page: payments are created from the Payments list, so with no
diff --git a/app/finance/manage_payment_billing.php b/app/finance/manage_payment_billing.php
index 55958a3..f1a4f6c 100644
--- a/app/finance/manage_payment_billing.php
+++ b/app/finance/manage_payment_billing.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
 
   // A detail-only page: payment billings are created from their list, so with
diff --git a/app/finance/manage_receipt.php b/app/finance/manage_receipt.php
index 68945d1..5d989ad 100644
--- a/app/finance/manage_receipt.php
+++ b/app/finance/manage_receipt.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
 
   // A detail-only page: receipts are created from the Receipts list, so with no
diff --git a/app/finance/manage_receipt_billing.php b/app/finance/manage_receipt_billing.php
index f8d94b0..48c87c8 100644
--- a/app/finance/manage_receipt_billing.php
+++ b/app/finance/manage_receipt_billing.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
 
   // A detail-only page: receipt billings are created from their list, so with
diff --git a/app/finance/payment.php b/app/finance/payment.php
index c6e0bbe..0521787 100644
--- a/app/finance/payment.php
+++ b/app/finance/payment.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/finance/payment_billing.php b/app/finance/payment_billing.php
index 8d05abc..af65735 100644
--- a/app/finance/payment_billing.php
+++ b/app/finance/payment_billing.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/finance/receipt.php b/app/finance/receipt.php
index 49c6abd..34b2d4b 100644
--- a/app/finance/receipt.php
+++ b/app/finance/receipt.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/finance/receipt_billing.php b/app/finance/receipt_billing.php
index 071dbf0..ef50f64 100644
--- a/app/finance/receipt_billing.php
+++ b/app/finance/receipt_billing.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/ics/api/engine/approve_stock.php b/app/ics/api/engine/approve_stock.php
index eb209bf..2190c1f 100644
--- a/app/ics/api/engine/approve_stock.php
+++ b/app/ics/api/engine/approve_stock.php
@@ -11,7 +11,7 @@
  *   warehouse    int     warehouse_id (to resolve the dynamic table)
  *   type         string  'in' | 'out' | 'transfer'
  */
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/StockManager.php';
 require_once '../../../assets/utils/classes/WarehouseManager.php';
diff --git a/app/ics/api/engine/barcode_lookup.php b/app/ics/api/engine/barcode_lookup.php
index 6db0793..d6edb5a 100644
--- a/app/ics/api/engine/barcode_lookup.php
+++ b/app/ics/api/engine/barcode_lookup.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/CompanySettingManager.php';
     require_once '../../../assets/utils/classes/BarcodeManager.php';
diff --git a/app/ics/api/engine/contact_search.php b/app/ics/api/engine/contact_search.php
index 34cd88e..972be11 100644
--- a/app/ics/api/engine/contact_search.php
+++ b/app/ics/api/engine/contact_search.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 
diff --git a/app/ics/api/engine/delete_stock_in.php b/app/ics/api/engine/delete_stock_in.php
index 144fd2d..cdc9906 100644
--- a/app/ics/api/engine/delete_stock_in.php
+++ b/app/ics/api/engine/delete_stock_in.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine/delete_stock_out.php b/app/ics/api/engine/delete_stock_out.php
index 2d48838..c8780fc 100644
--- a/app/ics/api/engine/delete_stock_out.php
+++ b/app/ics/api/engine/delete_stock_out.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine/delete_stock_transfer.php b/app/ics/api/engine/delete_stock_transfer.php
index 3a97103..f5f66b5 100644
--- a/app/ics/api/engine/delete_stock_transfer.php
+++ b/app/ics/api/engine/delete_stock_transfer.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine/location_barcode_label.php b/app/ics/api/engine/location_barcode_label.php
index 74ece1b..b50f0a7 100644
--- a/app/ics/api/engine/location_barcode_label.php
+++ b/app/ics/api/engine/location_barcode_label.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/BarcodeManager.php';
 
diff --git a/app/ics/api/engine/manage_stock_in.php b/app/ics/api/engine/manage_stock_in.php
index 15e64b0..25e820c 100644
--- a/app/ics/api/engine/manage_stock_in.php
+++ b/app/ics/api/engine/manage_stock_in.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
     require_once '../../../assets/utils/classes/StockManager.php';
diff --git a/app/ics/api/engine/manage_stock_out.php b/app/ics/api/engine/manage_stock_out.php
index c344f87..90ff66d 100644
--- a/app/ics/api/engine/manage_stock_out.php
+++ b/app/ics/api/engine/manage_stock_out.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
     require_once '../../../assets/utils/classes/StockManager.php';
diff --git a/app/ics/api/engine/manage_stock_transfer.php b/app/ics/api/engine/manage_stock_transfer.php
index b63b209..fcad6ae 100644
--- a/app/ics/api/engine/manage_stock_transfer.php
+++ b/app/ics/api/engine/manage_stock_transfer.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
     require_once '../../../assets/utils/classes/StockManager.php';
diff --git a/app/ics/api/engine/product_search.php b/app/ics/api/engine/product_search.php
index af9c3b2..0b3f631 100644
--- a/app/ics/api/engine/product_search.php
+++ b/app/ics/api/engine/product_search.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ProductManager.php';
 
diff --git a/app/ics/api/engine/retrieve_active_lot.php b/app/ics/api/engine/retrieve_active_lot.php
index 2f6c351..de94e32 100644
--- a/app/ics/api/engine/retrieve_active_lot.php
+++ b/app/ics/api/engine/retrieve_active_lot.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine/retrieve_active_serial.php b/app/ics/api/engine/retrieve_active_serial.php
index c8b1efb..3abcce5 100644
--- a/app/ics/api/engine/retrieve_active_serial.php
+++ b/app/ics/api/engine/retrieve_active_serial.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine/retrieve_aisle.php b/app/ics/api/engine/retrieve_aisle.php
index 3608a1d..835a1fa 100644
--- a/app/ics/api/engine/retrieve_aisle.php
+++ b/app/ics/api/engine/retrieve_aisle.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine/retrieve_bin.php b/app/ics/api/engine/retrieve_bin.php
index a2d211b..cb26ba1 100644
--- a/app/ics/api/engine/retrieve_bin.php
+++ b/app/ics/api/engine/retrieve_bin.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine/retrieve_bin_stock.php b/app/ics/api/engine/retrieve_bin_stock.php
index 1736df9..d69f525 100644
--- a/app/ics/api/engine/retrieve_bin_stock.php
+++ b/app/ics/api/engine/retrieve_bin_stock.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine/retrieve_lot.php b/app/ics/api/engine/retrieve_lot.php
index 23cb109..476f7c1 100644
--- a/app/ics/api/engine/retrieve_lot.php
+++ b/app/ics/api/engine/retrieve_lot.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine/retrieve_stock_by_source.php b/app/ics/api/engine/retrieve_stock_by_source.php
index df47eef..9737b1a 100644
--- a/app/ics/api/engine/retrieve_stock_by_source.php
+++ b/app/ics/api/engine/retrieve_stock_by_source.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/StockSourceManager.php';
 
diff --git a/app/ics/api/engine/retrieve_stock_in.php b/app/ics/api/engine/retrieve_stock_in.php
index 4ce56f5..5e12c10 100644
--- a/app/ics/api/engine/retrieve_stock_in.php
+++ b/app/ics/api/engine/retrieve_stock_in.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/StockManager.php';
 
diff --git a/app/ics/api/engine/retrieve_stock_out.php b/app/ics/api/engine/retrieve_stock_out.php
index 42a9b5a..35f7866 100644
--- a/app/ics/api/engine/retrieve_stock_out.php
+++ b/app/ics/api/engine/retrieve_stock_out.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/StockManager.php';
 
diff --git a/app/ics/api/engine/retrieve_stock_transfer.php b/app/ics/api/engine/retrieve_stock_transfer.php
index 4caba54..a6ddc88 100644
--- a/app/ics/api/engine/retrieve_stock_transfer.php
+++ b/app/ics/api/engine/retrieve_stock_transfer.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/StockManager.php';
 
diff --git a/app/ics/api/engine/retrieve_warehouse.php b/app/ics/api/engine/retrieve_warehouse.php
index 89afaff..084ce0f 100644
--- a/app/ics/api/engine/retrieve_warehouse.php
+++ b/app/ics/api/engine/retrieve_warehouse.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine/retrieve_zone.php b/app/ics/api/engine/retrieve_zone.php
index 85cf588..b014a67 100644
--- a/app/ics/api/engine/retrieve_zone.php
+++ b/app/ics/api/engine/retrieve_zone.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine/sku_barcode_label.php b/app/ics/api/engine/sku_barcode_label.php
index abf38a3..98c92d9 100644
--- a/app/ics/api/engine/sku_barcode_label.php
+++ b/app/ics/api/engine/sku_barcode_label.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/BarcodeManager.php';
 
diff --git a/app/ics/api/engine/sku_label_lots.php b/app/ics/api/engine/sku_label_lots.php
index 0732dce..2f99eea 100644
--- a/app/ics/api/engine/sku_label_lots.php
+++ b/app/ics/api/engine/sku_label_lots.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/BarcodeManager.php';
 
diff --git a/app/ics/api/engine/sku_label_products.php b/app/ics/api/engine/sku_label_products.php
index 2e0076b..3d17af9 100644
--- a/app/ics/api/engine/sku_label_products.php
+++ b/app/ics/api/engine/sku_label_products.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/BarcodeManager.php';
 
diff --git a/app/ics/api/engine/stock_in.php b/app/ics/api/engine/stock_in.php
index d1729a0..c022d58 100644
--- a/app/ics/api/engine/stock_in.php
+++ b/app/ics/api/engine/stock_in.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/StockManager.php';
 
diff --git a/app/ics/api/engine/stock_out.php b/app/ics/api/engine/stock_out.php
index 98fcfae..8dcb03f 100644
--- a/app/ics/api/engine/stock_out.php
+++ b/app/ics/api/engine/stock_out.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/StockManager.php';
 
diff --git a/app/ics/api/engine/stock_transfer.php b/app/ics/api/engine/stock_transfer.php
index d139505..acfad79 100644
--- a/app/ics/api/engine/stock_transfer.php
+++ b/app/ics/api/engine/stock_transfer.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/StockManager.php';
 
diff --git a/app/ics/api/engine/validate_scan_location.php b/app/ics/api/engine/validate_scan_location.php
index 19a8691..a614716 100644
--- a/app/ics/api/engine/validate_scan_location.php
+++ b/app/ics/api/engine/validate_scan_location.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/ics/api/engine_report/product_stats.php b/app/ics/api/engine_report/product_stats.php
index 5f9e62d..84d8918 100644
--- a/app/ics/api/engine_report/product_stats.php
+++ b/app/ics/api/engine_report/product_stats.php
@@ -1,5 +1,5 @@
 <?php 
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
 
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/ics/api/engine_report/stock_activity.php b/app/ics/api/engine_report/stock_activity.php
index 2a91ab0..eac663b 100644
--- a/app/ics/api/engine_report/stock_activity.php
+++ b/app/ics/api/engine_report/stock_activity.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
 
diff --git a/app/ics/api/engine_report/stock_movement.php b/app/ics/api/engine_report/stock_movement.php
index 68c2528..8d04d2f 100644
--- a/app/ics/api/engine_report/stock_movement.php
+++ b/app/ics/api/engine_report/stock_movement.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
 
diff --git a/app/ics/api/engine_report/stock_trend.php b/app/ics/api/engine_report/stock_trend.php
index 7a4ac19..c470c67 100644
--- a/app/ics/api/engine_report/stock_trend.php
+++ b/app/ics/api/engine_report/stock_trend.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
 
diff --git a/app/ics/api/engine_report/warehouse_balance.php b/app/ics/api/engine_report/warehouse_balance.php
index de51951..18f1891 100644
--- a/app/ics/api/engine_report/warehouse_balance.php
+++ b/app/ics/api/engine_report/warehouse_balance.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
 
diff --git a/app/ics/api/engine_report/warehouse_overview.php b/app/ics/api/engine_report/warehouse_overview.php
index 51af305..0961245 100644
--- a/app/ics/api/engine_report/warehouse_overview.php
+++ b/app/ics/api/engine_report/warehouse_overview.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
 
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
diff --git a/app/ics/api/engine_report/warehouse_stats.php b/app/ics/api/engine_report/warehouse_stats.php
index 3c5014c..708e71b 100644
--- a/app/ics/api/engine_report/warehouse_stats.php
+++ b/app/ics/api/engine_report/warehouse_stats.php
@@ -1,5 +1,5 @@
 <?php 
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
 
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/ics/location_barcode_label.php b/app/ics/location_barcode_label.php
index 3f22556..21418dd 100644
--- a/app/ics/location_barcode_label.php
+++ b/app/ics/location_barcode_label.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   if (!in_array($_SESSION['login_role'] ?? 'viewer', ['owner', 'admin', 'staff'], true)) {
     http_response_code(403);
diff --git a/app/ics/manage_stock_in.php b/app/ics/manage_stock_in.php
index 184d97d..f8dc07d 100644
--- a/app/ics/manage_stock_in.php
+++ b/app/ics/manage_stock_in.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   if (!in_array($_SESSION['login_role'] ?? 'viewer', ['owner', 'admin', 'staff'], true)) {
     http_response_code(403);
diff --git a/app/ics/manage_stock_out.php b/app/ics/manage_stock_out.php
index fe893e3..0d00cb2 100644
--- a/app/ics/manage_stock_out.php
+++ b/app/ics/manage_stock_out.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   if (!in_array($_SESSION['login_role'] ?? 'viewer', ['owner', 'admin', 'staff'], true)) {
     http_response_code(403);
diff --git a/app/ics/manage_stock_transfer.php b/app/ics/manage_stock_transfer.php
index 9ad43e7..9939f5b 100644
--- a/app/ics/manage_stock_transfer.php
+++ b/app/ics/manage_stock_transfer.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   if (!in_array($_SESSION['login_role'] ?? 'viewer', ['owner', 'admin', 'staff'], true)) {
     http_response_code(403);
diff --git a/app/ics/sku_barcode_label.php b/app/ics/sku_barcode_label.php
index 6787712..a630015 100644
--- a/app/ics/sku_barcode_label.php
+++ b/app/ics/sku_barcode_label.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   if (!in_array($_SESSION['login_role'] ?? 'viewer', ['owner', 'admin', 'staff'], true)) {
     http_response_code(403);
diff --git a/app/ics/stock_in.php b/app/ics/stock_in.php
index ec55a47..230f173 100644
--- a/app/ics/stock_in.php
+++ b/app/ics/stock_in.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/ics/stock_out.php b/app/ics/stock_out.php
index dd0af98..f4c1add 100644
--- a/app/ics/stock_out.php
+++ b/app/ics/stock_out.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/ics/stock_overview.php b/app/ics/stock_overview.php
index 8c8f564..af89fd6 100644
--- a/app/ics/stock_overview.php
+++ b/app/ics/stock_overview.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/ics/stock_transfer.php b/app/ics/stock_transfer.php
index 6c66970..625ce21 100644
--- a/app/ics/stock_transfer.php
+++ b/app/ics/stock_transfer.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/include_topbar.php b/app/include_topbar.php
index a031eac..9771533 100644
--- a/app/include_topbar.php
+++ b/app/include_topbar.php
@@ -19,6 +19,18 @@ if(empty($_SESSION["login_company_id"])){
 }
 
 require 'preset.php';
+require_once __DIR__ . '/assets/utils/app_access.php';
+
+// Accounting pages require accounting app access; the menus below only hide the
+// links, this stops a WMS-only user who opens the URL directly.
+$_page_app = app_access_app_for($_SERVER['SCRIPT_NAME'] ?? '');
+if ($_page_app !== null && !app_access_allows($_SESSION['login_app_access'] ?? 'wms', $_page_app)) {
+    while (ob_get_level() > 0) {
+        ob_end_clean();
+    }
+    header('Location: '.$server_url.'dashboard/index.php');
+    exit;
+}
 
 // ── User display data from session ────────────────────────────────────────────
 $topbar_name       = htmlspecialchars(trim(($_SESSION['login_name'] ?? '') . ' ' . ($_SESSION['login_surname'] ?? '')), ENT_QUOTES, 'UTF-8');
@@ -367,6 +379,7 @@ function log_out() {
     checkRequired: 0,
     action: 'read',
     onSuccess: function(res) {
+      try { sessionStorage.clear(); } catch (e) {}
       window.location.href = server_url + 'index.php';
     }
   });
diff --git a/app/inventory/api/engine/manage_category.php b/app/inventory/api/engine/manage_category.php
index 21380d0..76c21da 100644
--- a/app/inventory/api/engine/manage_category.php
+++ b/app/inventory/api/engine/manage_category.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ProductManager.php';
 
diff --git a/app/inventory/api/engine/manage_product.php b/app/inventory/api/engine/manage_product.php
index 43388b7..b18eb81 100644
--- a/app/inventory/api/engine/manage_product.php
+++ b/app/inventory/api/engine/manage_product.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/FileUploader.php';
     require_once '../../../assets/utils/classes/ProductManager.php';
diff --git a/app/inventory/api/engine/manage_storage.php b/app/inventory/api/engine/manage_storage.php
index 5368238..80e7663 100644
--- a/app/inventory/api/engine/manage_storage.php
+++ b/app/inventory/api/engine/manage_storage.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
     require_once '../../../assets/utils/classes/CompanySettingManager.php';
diff --git a/app/inventory/api/engine/manage_warehouse.php b/app/inventory/api/engine/manage_warehouse.php
index 21b3365..82f44b2 100644
--- a/app/inventory/api/engine/manage_warehouse.php
+++ b/app/inventory/api/engine/manage_warehouse.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/inventory/api/engine/manager.php b/app/inventory/api/engine/manager.php
index c7ccd1f..498d7ac 100644
--- a/app/inventory/api/engine/manager.php
+++ b/app/inventory/api/engine/manager.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UserManager.php';
 
diff --git a/app/inventory/api/engine/product.php b/app/inventory/api/engine/product.php
index 0816ea7..c518b6e 100644
--- a/app/inventory/api/engine/product.php
+++ b/app/inventory/api/engine/product.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ProductManager.php';
 
diff --git a/app/inventory/api/engine/product_category.php b/app/inventory/api/engine/product_category.php
index 2f4b31c..e0c340a 100644
--- a/app/inventory/api/engine/product_category.php
+++ b/app/inventory/api/engine/product_category.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ProductManager.php';
 
diff --git a/app/inventory/api/engine/product_stats.php b/app/inventory/api/engine/product_stats.php
index 8fbe8a1..f6905b7 100644
--- a/app/inventory/api/engine/product_stats.php
+++ b/app/inventory/api/engine/product_stats.php
@@ -1,5 +1,5 @@
 <?php 
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
 
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/inventory/api/engine/remove_category.php b/app/inventory/api/engine/remove_category.php
index 7e908b6..c81aeea 100644
--- a/app/inventory/api/engine/remove_category.php
+++ b/app/inventory/api/engine/remove_category.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ProductManager.php';
 
diff --git a/app/inventory/api/engine/remove_product.php b/app/inventory/api/engine/remove_product.php
index ac5d61a..1a84d55 100644
--- a/app/inventory/api/engine/remove_product.php
+++ b/app/inventory/api/engine/remove_product.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ProductManager.php';
 
diff --git a/app/inventory/api/engine/remove_storage.php b/app/inventory/api/engine/remove_storage.php
index ac7cb41..54fcc26 100644
--- a/app/inventory/api/engine/remove_storage.php
+++ b/app/inventory/api/engine/remove_storage.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/inventory/api/engine/remove_warehouse.php b/app/inventory/api/engine/remove_warehouse.php
index e6cc7fe..2036892 100644
--- a/app/inventory/api/engine/remove_warehouse.php
+++ b/app/inventory/api/engine/remove_warehouse.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/inventory/api/engine/retrieve_category.php b/app/inventory/api/engine/retrieve_category.php
index 693262e..7a6c6fb 100644
--- a/app/inventory/api/engine/retrieve_category.php
+++ b/app/inventory/api/engine/retrieve_category.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ProductManager.php';
 
diff --git a/app/inventory/api/engine/retrieve_product.php b/app/inventory/api/engine/retrieve_product.php
index c90e70d..7748d2a 100644
--- a/app/inventory/api/engine/retrieve_product.php
+++ b/app/inventory/api/engine/retrieve_product.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ProductManager.php';
 
diff --git a/app/inventory/api/engine/retrieve_storage.php b/app/inventory/api/engine/retrieve_storage.php
index 836d4e9..8fe925d 100644
--- a/app/inventory/api/engine/retrieve_storage.php
+++ b/app/inventory/api/engine/retrieve_storage.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/inventory/api/engine/retrieve_warehouse.php b/app/inventory/api/engine/retrieve_warehouse.php
index cf178ed..e4b29bc 100644
--- a/app/inventory/api/engine/retrieve_warehouse.php
+++ b/app/inventory/api/engine/retrieve_warehouse.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/inventory/api/engine/storage.php b/app/inventory/api/engine/storage.php
index 7ace205..190f7dd 100644
--- a/app/inventory/api/engine/storage.php
+++ b/app/inventory/api/engine/storage.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/inventory/api/engine/warehouse.php b/app/inventory/api/engine/warehouse.php
index eeb2049..c5c6fcb 100644
--- a/app/inventory/api/engine/warehouse.php
+++ b/app/inventory/api/engine/warehouse.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 
diff --git a/app/inventory/api/engine/warehouse_stats.php b/app/inventory/api/engine/warehouse_stats.php
index 7c63745..654f2be 100644
--- a/app/inventory/api/engine/warehouse_stats.php
+++ b/app/inventory/api/engine/warehouse_stats.php
@@ -1,5 +1,5 @@
 <?php 
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
 
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/inventory/manage_category.php b/app/inventory/manage_category.php
index c30d896..212a671 100644
--- a/app/inventory/manage_category.php
+++ b/app/inventory/manage_category.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/inventory/manage_product.php b/app/inventory/manage_product.php
index d091dfe..a193f2c 100644
--- a/app/inventory/manage_product.php
+++ b/app/inventory/manage_product.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   if (!in_array($_SESSION['login_role'] ?? 'viewer', ['owner', 'admin'], true)) {
     http_response_code(403);
diff --git a/app/inventory/manage_storage.php b/app/inventory/manage_storage.php
index bdb563e..5d0dc70 100644
--- a/app/inventory/manage_storage.php
+++ b/app/inventory/manage_storage.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   if (!in_array($_SESSION['login_role'] ?? 'viewer', ['owner', 'admin'], true)) {
     http_response_code(403);
diff --git a/app/inventory/manage_warehouse.php b/app/inventory/manage_warehouse.php
index d211850..562726b 100644
--- a/app/inventory/manage_warehouse.php
+++ b/app/inventory/manage_warehouse.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   if (!in_array($_SESSION['login_role'] ?? 'viewer', ['owner', 'admin'], true)) {
     http_response_code(403);
diff --git a/app/inventory/product.php b/app/inventory/product.php
index 4005a4b..7ea3386 100644
--- a/app/inventory/product.php
+++ b/app/inventory/product.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/inventory/warehouse.php b/app/inventory/warehouse.php
index 90307f8..c0f3e43 100644
--- a/app/inventory/warehouse.php
+++ b/app/inventory/warehouse.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   if (!in_array($_SESSION['login_role'] ?? 'viewer', ['owner', 'admin'], true)) {
     http_response_code(403);
diff --git a/app/journal/index.php b/app/journal/index.php
index edd0b61..e9c0a2c 100644
--- a/app/journal/index.php
+++ b/app/journal/index.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/journal/new.php b/app/journal/new.php
index 9a67953..e498b43 100644
--- a/app/journal/new.php
+++ b/app/journal/new.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/login/api/engine/back.php b/app/login/api/engine/back.php
index 9b5daac..cf48fbd 100644
--- a/app/login/api/engine/back.php
+++ b/app/login/api/engine/back.php
@@ -34,7 +34,8 @@ if (!empty($_SESSION['login_user_id'])) {
 // Intentional 1-second delay — prevents timing attacks on session enumeration
 sleep(1);
 
-session_destroy();
+// Clears the session data, deletes the session file and expires the cookie.
+session_end_completely();
 
 $answer["success"] = 1;
 exit(json_encode($answer));
\ No newline at end of file
diff --git a/app/order/api/engine/cancel_order.php b/app/order/api/engine/cancel_order.php
index 3a63187..be6f23f 100644
--- a/app/order/api/engine/cancel_order.php
+++ b/app/order/api/engine/cancel_order.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin']);
     require_once '../../../assets/utils/classes/OrderManager.php';
diff --git a/app/order/api/engine/cancel_return.php b/app/order/api/engine/cancel_return.php
index 1167c84..4937c61 100644
--- a/app/order/api/engine/cancel_return.php
+++ b/app/order/api/engine/cancel_return.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin']);
     require_once '../../../assets/utils/classes/ReturnManager.php';
diff --git a/app/order/api/engine/confirm_order.php b/app/order/api/engine/confirm_order.php
index e42d523..d684b06 100644
--- a/app/order/api/engine/confirm_order.php
+++ b/app/order/api/engine/confirm_order.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/OrderManager.php';
diff --git a/app/order/api/engine/confirm_return.php b/app/order/api/engine/confirm_return.php
index 05623f5..b4cf28c 100644
--- a/app/order/api/engine/confirm_return.php
+++ b/app/order/api/engine/confirm_return.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/ReturnManager.php';
diff --git a/app/order/api/engine/delete_invoice.php b/app/order/api/engine/delete_invoice.php
index 19b7516..85986e5 100644
--- a/app/order/api/engine/delete_invoice.php
+++ b/app/order/api/engine/delete_invoice.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/order/api/engine/delete_order.php b/app/order/api/engine/delete_order.php
index 26af20c..1cc985f 100644
--- a/app/order/api/engine/delete_order.php
+++ b/app/order/api/engine/delete_order.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/OrderManager.php';
diff --git a/app/order/api/engine/delete_return.php b/app/order/api/engine/delete_return.php
index e2b2484..3500b7b 100644
--- a/app/order/api/engine/delete_return.php
+++ b/app/order/api/engine/delete_return.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/ReturnManager.php';
diff --git a/app/order/api/engine/issue_invoice.php b/app/order/api/engine/issue_invoice.php
index ca5c010..b4565b4 100644
--- a/app/order/api/engine/issue_invoice.php
+++ b/app/order/api/engine/issue_invoice.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/order/api/engine/manage_invoice.php b/app/order/api/engine/manage_invoice.php
index 3280d0c..d91fdc2 100644
--- a/app/order/api/engine/manage_invoice.php
+++ b/app/order/api/engine/manage_invoice.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/order/api/engine/manage_order.php b/app/order/api/engine/manage_order.php
index 005174c..22d0621 100644
--- a/app/order/api/engine/manage_order.php
+++ b/app/order/api/engine/manage_order.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/order/api/engine/manage_return.php b/app/order/api/engine/manage_return.php
index 68d502a..dcc6092 100644
--- a/app/order/api/engine/manage_return.php
+++ b/app/order/api/engine/manage_return.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/ReturnManager.php';
diff --git a/app/order/api/engine/proceed_to_credit_note.php b/app/order/api/engine/proceed_to_credit_note.php
index 3e8dedc..1912549 100644
--- a/app/order/api/engine/proceed_to_credit_note.php
+++ b/app/order/api/engine/proceed_to_credit_note.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/order/api/engine/proceed_to_invoice.php b/app/order/api/engine/proceed_to_invoice.php
index 5d7c724..d8bc29c 100644
--- a/app/order/api/engine/proceed_to_invoice.php
+++ b/app/order/api/engine/proceed_to_invoice.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/order/api/engine/retrieve_invoice.php b/app/order/api/engine/retrieve_invoice.php
index 83fdf12..8169c64 100644
--- a/app/order/api/engine/retrieve_invoice.php
+++ b/app/order/api/engine/retrieve_invoice.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/InvoiceManager.php';
 
diff --git a/app/order/api/engine/retrieve_order.php b/app/order/api/engine/retrieve_order.php
index 611652c..5bb0823 100644
--- a/app/order/api/engine/retrieve_order.php
+++ b/app/order/api/engine/retrieve_order.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/OrderManager.php';
 
diff --git a/app/order/api/engine/retrieve_return.php b/app/order/api/engine/retrieve_return.php
index 48f6ccc..3ef0adf 100644
--- a/app/order/api/engine/retrieve_return.php
+++ b/app/order/api/engine/retrieve_return.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ReturnManager.php';
 
diff --git a/app/order/api/engine/update_invoice_status.php b/app/order/api/engine/update_invoice_status.php
index c180539..df608fb 100644
--- a/app/order/api/engine/update_invoice_status.php
+++ b/app/order/api/engine/update_invoice_status.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/order/api/engine/update_order_status.php b/app/order/api/engine/update_order_status.php
index 680bbd1..0dc6730 100644
--- a/app/order/api/engine/update_order_status.php
+++ b/app/order/api/engine/update_order_status.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/OrderManager.php';
diff --git a/app/order/api/engine/void_invoice.php b/app/order/api/engine/void_invoice.php
index d01946e..c560e03 100644
--- a/app/order/api/engine/void_invoice.php
+++ b/app/order/api/engine/void_invoice.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin']);
     require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/order/invoice.php b/app/order/invoice.php
index 1c711cf..ad6f821 100644
--- a/app/order/invoice.php
+++ b/app/order/invoice.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/order/manage_invoice.php b/app/order/manage_invoice.php
index 54f4f69..5edae95 100644
--- a/app/order/manage_invoice.php
+++ b/app/order/manage_invoice.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/order/manage_order.php b/app/order/manage_order.php
index a780942..7055a72 100644
--- a/app/order/manage_order.php
+++ b/app/order/manage_order.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/order/manage_return.php b/app/order/manage_return.php
index 5de63f7..d235709 100644
--- a/app/order/manage_return.php
+++ b/app/order/manage_return.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/order/order.php b/app/order/order.php
index bf67b4c..fd9bb65 100644
--- a/app/order/order.php
+++ b/app/order/order.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/order/print_invoice.php b/app/order/print_invoice.php
index 5746221..f91acb1 100644
--- a/app/order/print_invoice.php
+++ b/app/order/print_invoice.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../dbconn.php';
   require '../assets/utils/db_helpers.php';
diff --git a/app/order/return.php b/app/order/return.php
index 29ab4ba..94e5e9f 100644
--- a/app/order/return.php
+++ b/app/order/return.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/po/api/engine/cancel_po.php b/app/po/api/engine/cancel_po.php
index 6d308e4..85bdc3e 100644
--- a/app/po/api/engine/cancel_po.php
+++ b/app/po/api/engine/cancel_po.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin']);
     require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
diff --git a/app/po/api/engine/cancel_supplier_return.php b/app/po/api/engine/cancel_supplier_return.php
index 5abdbf6..71d7032 100644
--- a/app/po/api/engine/cancel_supplier_return.php
+++ b/app/po/api/engine/cancel_supplier_return.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/SupplierReturnManager.php';
diff --git a/app/po/api/engine/close_po.php b/app/po/api/engine/close_po.php
index 8f8b267..f2bcd29 100644
--- a/app/po/api/engine/close_po.php
+++ b/app/po/api/engine/close_po.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
diff --git a/app/po/api/engine/confirm_po.php b/app/po/api/engine/confirm_po.php
index 415c324..6fd2a27 100644
--- a/app/po/api/engine/confirm_po.php
+++ b/app/po/api/engine/confirm_po.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
diff --git a/app/po/api/engine/confirm_supplier_return.php b/app/po/api/engine/confirm_supplier_return.php
index c0396c7..7d071ff 100644
--- a/app/po/api/engine/confirm_supplier_return.php
+++ b/app/po/api/engine/confirm_supplier_return.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/SupplierReturnManager.php';
diff --git a/app/po/api/engine/delete_po.php b/app/po/api/engine/delete_po.php
index 8d52eb2..f5e76fd 100644
--- a/app/po/api/engine/delete_po.php
+++ b/app/po/api/engine/delete_po.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
diff --git a/app/po/api/engine/delete_purchase_request.php b/app/po/api/engine/delete_purchase_request.php
index ae035a4..8c95d9e 100644
--- a/app/po/api/engine/delete_purchase_request.php
+++ b/app/po/api/engine/delete_purchase_request.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
diff --git a/app/po/api/engine/delete_supplier_return.php b/app/po/api/engine/delete_supplier_return.php
index 9ec38b2..bed1eed 100644
--- a/app/po/api/engine/delete_supplier_return.php
+++ b/app/po/api/engine/delete_supplier_return.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/SupplierReturnManager.php';
diff --git a/app/po/api/engine/manage_po.php b/app/po/api/engine/manage_po.php
index 2c89d5e..b943c4a 100644
--- a/app/po/api/engine/manage_po.php
+++ b/app/po/api/engine/manage_po.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/po/api/engine/manage_supplier_return.php b/app/po/api/engine/manage_supplier_return.php
index e1edd52..276ca9f 100644
--- a/app/po/api/engine/manage_supplier_return.php
+++ b/app/po/api/engine/manage_supplier_return.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/SupplierReturnManager.php';
diff --git a/app/po/api/engine/proceed_to_purchase_invoice.php b/app/po/api/engine/proceed_to_purchase_invoice.php
index d01566f..488eb58 100644
--- a/app/po/api/engine/proceed_to_purchase_invoice.php
+++ b/app/po/api/engine/proceed_to_purchase_invoice.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/po/api/engine/proceed_to_supplier_credit_note.php b/app/po/api/engine/proceed_to_supplier_credit_note.php
index 7a444cb..920ab6a 100644
--- a/app/po/api/engine/proceed_to_supplier_credit_note.php
+++ b/app/po/api/engine/proceed_to_supplier_credit_note.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/po/api/engine/receive_po.php b/app/po/api/engine/receive_po.php
index 3b75c8a..8ca1b9d 100644
--- a/app/po/api/engine/receive_po.php
+++ b/app/po/api/engine/receive_po.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
diff --git a/app/po/api/engine/retrieve_po.php b/app/po/api/engine/retrieve_po.php
index 2562dbb..5881caf 100644
--- a/app/po/api/engine/retrieve_po.php
+++ b/app/po/api/engine/retrieve_po.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
 
diff --git a/app/po/api/engine/retrieve_supplier_return.php b/app/po/api/engine/retrieve_supplier_return.php
index a6aecb2..369b176 100644
--- a/app/po/api/engine/retrieve_supplier_return.php
+++ b/app/po/api/engine/retrieve_supplier_return.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/SupplierReturnManager.php';
 
diff --git a/app/po/api/engine/update_po_payment.php b/app/po/api/engine/update_po_payment.php
index c1ad4dd..424da43 100644
--- a/app/po/api/engine/update_po_payment.php
+++ b/app/po/api/engine/update_po_payment.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
diff --git a/app/po/invoice.php b/app/po/invoice.php
index eb3d5c8..25a5eef 100644
--- a/app/po/invoice.php
+++ b/app/po/invoice.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/po/manage_po.php b/app/po/manage_po.php
index aa75577..283626c 100644
--- a/app/po/manage_po.php
+++ b/app/po/manage_po.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/po/manage_purchase_invoice.php b/app/po/manage_purchase_invoice.php
index 548809c..da11247 100644
--- a/app/po/manage_purchase_invoice.php
+++ b/app/po/manage_purchase_invoice.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/po/manage_supplier_return.php b/app/po/manage_supplier_return.php
index 317a9ad..7509252 100644
--- a/app/po/manage_supplier_return.php
+++ b/app/po/manage_supplier_return.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/po/po.php b/app/po/po.php
index 9a5c3d9..9516f01 100644
--- a/app/po/po.php
+++ b/app/po/po.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/po/supplier_returns.php b/app/po/supplier_returns.php
index 911a6f5..3eaed25 100644
--- a/app/po/supplier_returns.php
+++ b/app/po/supplier_returns.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/reports/api/engine_report/bin_log.php b/app/reports/api/engine_report/bin_log.php
index 297bb13..f54a251 100644
--- a/app/reports/api/engine_report/bin_log.php
+++ b/app/reports/api/engine_report/bin_log.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/reports/api/engine_report/bin_occupancy.php b/app/reports/api/engine_report/bin_occupancy.php
index 443af1d..8e98a04 100644
--- a/app/reports/api/engine_report/bin_occupancy.php
+++ b/app/reports/api/engine_report/bin_occupancy.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/reports/api/engine_report/expired_stock.php b/app/reports/api/engine_report/expired_stock.php
index 42d8474..42eb093 100644
--- a/app/reports/api/engine_report/expired_stock.php
+++ b/app/reports/api/engine_report/expired_stock.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
 
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
diff --git a/app/reports/api/engine_report/lot_stock_log.php b/app/reports/api/engine_report/lot_stock_log.php
index acb1fdb..e4e6e76 100644
--- a/app/reports/api/engine_report/lot_stock_log.php
+++ b/app/reports/api/engine_report/lot_stock_log.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/reports/api/engine_report/product_lot.php b/app/reports/api/engine_report/product_lot.php
index 854a708..1430da4 100644
--- a/app/reports/api/engine_report/product_lot.php
+++ b/app/reports/api/engine_report/product_lot.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/reports/api/engine_report/stock_movement.php b/app/reports/api/engine_report/stock_movement.php
index cdbf678..96e0c8f 100644
--- a/app/reports/api/engine_report/stock_movement.php
+++ b/app/reports/api/engine_report/stock_movement.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/reports/api/engine_report/stock_movement_sku.php b/app/reports/api/engine_report/stock_movement_sku.php
index 3815843..1b1c7d6 100644
--- a/app/reports/api/engine_report/stock_movement_sku.php
+++ b/app/reports/api/engine_report/stock_movement_sku.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 
diff --git a/app/reports/expired_stock.php b/app/reports/expired_stock.php
index 7e49b42..93f9f59 100644
--- a/app/reports/expired_stock.php
+++ b/app/reports/expired_stock.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/reports/occupy_rack.php b/app/reports/occupy_rack.php
index 908745b..b699413 100644
--- a/app/reports/occupy_rack.php
+++ b/app/reports/occupy_rack.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/reports/product_lot.php b/app/reports/product_lot.php
index bccb40c..7503783 100644
--- a/app/reports/product_lot.php
+++ b/app/reports/product_lot.php
@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/reports/stock_movement.php b/app/reports/stock_movement.php
index a2f4874..a5ee3b2 100644
--- a/app/reports/stock_movement.php
+++ b/app/reports/stock_movement.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../session.php';
     require '../config.php';
     require '../include_header.php';
 ?>
diff --git a/app/revenue/api/engine/convert_quotation.php b/app/revenue/api/engine/convert_quotation.php
index 5ad14ad..1451111 100644
--- a/app/revenue/api/engine/convert_quotation.php
+++ b/app/revenue/api/engine/convert_quotation.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/OrderManager.php';
 require_once '../../../assets/utils/classes/QuotationManager.php';
diff --git a/app/revenue/api/engine/delete_credit_note.php b/app/revenue/api/engine/delete_credit_note.php
index c355848..6f13ad3 100644
--- a/app/revenue/api/engine/delete_credit_note.php
+++ b/app/revenue/api/engine/delete_credit_note.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/revenue/api/engine/delete_quotation.php b/app/revenue/api/engine/delete_quotation.php
index 7730f94..1a4be17 100644
--- a/app/revenue/api/engine/delete_quotation.php
+++ b/app/revenue/api/engine/delete_quotation.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/QuotationManager.php';
diff --git a/app/revenue/api/engine/manage_credit_note.php b/app/revenue/api/engine/manage_credit_note.php
index 91a5c7a..afcead8 100644
--- a/app/revenue/api/engine/manage_credit_note.php
+++ b/app/revenue/api/engine/manage_credit_note.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/InvoiceManager.php';
diff --git a/app/revenue/api/engine/manage_order.php b/app/revenue/api/engine/manage_order.php
index 536afa3..478452e 100644
--- a/app/revenue/api/engine/manage_order.php
+++ b/app/revenue/api/engine/manage_order.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/UsageGuard.php';
 require_once '../../../assets/utils/classes/OrderManager.php';
diff --git a/app/revenue/api/engine/manage_quotation.php b/app/revenue/api/engine/manage_quotation.php
index 4c08d9e..a50f64e 100644
--- a/app/revenue/api/engine/manage_quotation.php
+++ b/app/revenue/api/engine/manage_quotation.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/UsageGuard.php';
 require_once '../../../assets/utils/classes/QuotationManager.php';
diff --git a/app/revenue/api/engine/proceed_to_invoice.php b/app/revenue/api/engine/proceed_to_invoice.php
index 99e7563..88f2dbc 100644
--- a/app/revenue/api/engine/proceed_to_invoice.php
+++ b/app/revenue/api/engine/proceed_to_invoice.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/OrderManager.php';
diff --git a/app/revenue/api/engine/quotation_stats.php b/app/revenue/api/engine/quotation_stats.php
index 80d6644..d818c02 100644
--- a/app/revenue/api/engine/quotation_stats.php
+++ b/app/revenue/api/engine/quotation_stats.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/QuotationManager.php';
 
diff --git a/app/revenue/api/engine/retrieve_quotation.php b/app/revenue/api/engine/retrieve_quotation.php
index 0102fc2..9fcc408 100644
--- a/app/revenue/api/engine/retrieve_quotation.php
+++ b/app/revenue/api/engine/retrieve_quotation.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/QuotationManager.php';
 
diff --git a/app/revenue/api/engine/update_quotation_status.php b/app/revenue/api/engine/update_quotation_status.php
index 94c8d5b..58243f1 100644
--- a/app/revenue/api/engine/update_quotation_status.php
+++ b/app/revenue/api/engine/update_quotation_status.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/QuotationManager.php';
 
diff --git a/app/revenue/invoice.php b/app/revenue/invoice.php
index fc310db..91006fb 100644
--- a/app/revenue/invoice.php
+++ b/app/revenue/invoice.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/revenue/manage_credit_note.php b/app/revenue/manage_credit_note.php
index a290f8e..4ba61d1 100644
--- a/app/revenue/manage_credit_note.php
+++ b/app/revenue/manage_credit_note.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/revenue/manage_invoice.php b/app/revenue/manage_invoice.php
index 40f3406..55a6c56 100644
--- a/app/revenue/manage_invoice.php
+++ b/app/revenue/manage_invoice.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/revenue/manage_order.php b/app/revenue/manage_order.php
index 535430c..cf0c556 100644
--- a/app/revenue/manage_order.php
+++ b/app/revenue/manage_order.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/revenue/manage_quotation.php b/app/revenue/manage_quotation.php
index abc4aa8..8250a73 100644
--- a/app/revenue/manage_quotation.php
+++ b/app/revenue/manage_quotation.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 
diff --git a/app/revenue/order.php b/app/revenue/order.php
index afc2312..3bb37c4 100644
--- a/app/revenue/order.php
+++ b/app/revenue/order.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/revenue/quotation.php b/app/revenue/quotation.php
index 27b1fcf..776005a 100644
--- a/app/revenue/quotation.php
+++ b/app/revenue/quotation.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/session.php b/app/session.php
index 3651670..b9766e2 100644
--- a/app/session.php
+++ b/app/session.php
@@ -1,5 +1,7 @@
 <?php
 // app/session.php
+// Every page and API engine starts its session through this file, so the cookie
+// flags and the idle timeout below apply to the whole app, not only the login routes.
 ob_start(); // ensure output buffering is on regardless of php.ini — prevents stray output from corrupting JSON API responses
 
 // The buffer is still flushed, so notices would still land in front of the JSON
@@ -8,6 +10,11 @@ ob_start(); // ensure output buffering is on regardless of php.ini — prevents
 ini_set('display_errors', '0');
 ini_set('log_errors', '1');
 
+// Signed-in sessions end after this many seconds without a request.
+if (!defined('SESSION_IDLE_SECONDS')) {
+    define('SESSION_IDLE_SECONDS', 1800);
+}
+
 if (session_status() === PHP_SESSION_NONE) {
 
     // Derive cookie path dynamically from the current script location.
@@ -20,7 +27,12 @@ if (session_status() === PHP_SESSION_NONE) {
     $parts     = explode('/', trim($_SERVER['SCRIPT_NAME'], '/'));
     $repo_name = '/' . $parts[0] . '/';   // e.g. /wms/
 
+    // HTTPS directly, or TLS terminated by a reverse proxy in front of Apache.
+    $is_https = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on')
+             || strtolower($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https';
+
     ini_set('session.use_strict_mode', 1);
+    ini_set('session.use_only_cookies', 1);
     ini_set('session.gc_maxlifetime', 3600);
     ini_set('session.cookie_path', $repo_name);
     ini_set('session.cookie_httponly', 1);
@@ -29,9 +41,44 @@ if (session_status() === PHP_SESSION_NONE) {
         'lifetime' => 0,
         'path'     => $repo_name,
         'domain'   => '',
-        'secure'   => isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on',
+        'secure'   => $is_https,
         'httponly' => true,
         'samesite' => 'Lax',
     ]);
     session_start();
-}
\ No newline at end of file
+
+    // Idle timeout: a signed-in session untouched for SESSION_IDLE_SECONDS is
+    // cleared here, so pages redirect to the login form and API engines answer
+    // 401 (db_auth.php) exactly as for a visitor who never signed in.
+    if (!empty($_SESSION['login_company_id'])) {
+        $last = (int)($_SESSION['_last_activity'] ?? 0);
+        if ($last > 0 && (time() - $last) > SESSION_IDLE_SECONDS) {
+            $_SESSION = [];
+            session_regenerate_id(true);
+            $_SESSION['_idle_expired'] = true;
+        } else {
+            $_SESSION['_last_activity'] = time();
+        }
+    }
+}
+
+/**
+ * End the current session completely: server data, the session file and the
+ * browser cookie. Used by logout and by any flow that must force a new sign-in.
+ */
+if (!function_exists('session_end_completely')) {
+    function session_end_completely(): void {
+        if (session_status() !== PHP_SESSION_ACTIVE) return;
+        $_SESSION = [];
+        $p = session_get_cookie_params();
+        setcookie(session_name(), '', [
+            'expires'  => time() - 42000,
+            'path'     => $p['path'],
+            'domain'   => $p['domain'],
+            'secure'   => $p['secure'],
+            'httponly' => $p['httponly'],
+            'samesite' => $p['samesite'] ?? 'Lax',
+        ]);
+        session_destroy();
+    }
+}
diff --git a/app/setting/api/engine/change_password.php b/app/setting/api/engine/change_password.php
index 363dea0..4b6dcc2 100644
--- a/app/setting/api/engine/change_password.php
+++ b/app/setting/api/engine/change_password.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/PasswordManager.php';
 
diff --git a/app/setting/api/engine/company_setting.php b/app/setting/api/engine/company_setting.php
index 93be509..765a286 100644
--- a/app/setting/api/engine/company_setting.php
+++ b/app/setting/api/engine/company_setting.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/CompanySettingManager.php';
 
diff --git a/app/setting/api/engine/document_types.php b/app/setting/api/engine/document_types.php
index aa901db..dd7c576 100644
--- a/app/setting/api/engine/document_types.php
+++ b/app/setting/api/engine/document_types.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/DocumentNumberManager.php';
 
diff --git a/app/setting/api/engine/gl_maintenance.php b/app/setting/api/engine/gl_maintenance.php
index 4289b20..4b5d26f 100644
--- a/app/setting/api/engine/gl_maintenance.php
+++ b/app/setting/api/engine/gl_maintenance.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes_ac/EtlManager.php';
diff --git a/app/setting/api/engine/manage_company.php b/app/setting/api/engine/manage_company.php
index 678d041..eb9f336 100644
--- a/app/setting/api/engine/manage_company.php
+++ b/app/setting/api/engine/manage_company.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/CompanyProfileManager.php';
 
diff --git a/app/setting/api/engine/manage_profile.php b/app/setting/api/engine/manage_profile.php
index 094b761..1687776 100644
--- a/app/setting/api/engine/manage_profile.php
+++ b/app/setting/api/engine/manage_profile.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/FileUploader.php';
     require_once '../../../assets/utils/classes/UserManager.php';
diff --git a/app/setting/api/engine/manage_smtp.php b/app/setting/api/engine/manage_smtp.php
index 1dbabb0..f0e92df 100644
--- a/app/setting/api/engine/manage_smtp.php
+++ b/app/setting/api/engine/manage_smtp.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/SmtpManager.php';
 
diff --git a/app/setting/api/engine/manage_users.php b/app/setting/api/engine/manage_users.php
index 606303f..791ef2c 100644
--- a/app/setting/api/engine/manage_users.php
+++ b/app/setting/api/engine/manage_users.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/app_registry.php';
     require_once '../../../assets/utils/classes/UserManager.php';
diff --git a/app/setting/api/engine/request_reset_otp.php b/app/setting/api/engine/request_reset_otp.php
index 986e885..fc9f655 100644
--- a/app/setting/api/engine/request_reset_otp.php
+++ b/app/setting/api/engine/request_reset_otp.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     define('UNAUTHENTICATED_ROUTE', true);
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/PasswordResetManager.php';
diff --git a/app/setting/api/engine/reset_password_otp.php b/app/setting/api/engine/reset_password_otp.php
index d4daa40..3e9c84f 100644
--- a/app/setting/api/engine/reset_password_otp.php
+++ b/app/setting/api/engine/reset_password_otp.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     define('UNAUTHENTICATED_ROUTE', true);
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/PasswordResetManager.php';
diff --git a/app/setting/api/engine/retrieve_company.php b/app/setting/api/engine/retrieve_company.php
index 2b0e3cd..2f21b99 100644
--- a/app/setting/api/engine/retrieve_company.php
+++ b/app/setting/api/engine/retrieve_company.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/CompanyProfileManager.php';
 
diff --git a/app/setting/api/engine/retrieve_profile.php b/app/setting/api/engine/retrieve_profile.php
index 6464f4e..173bd09 100644
--- a/app/setting/api/engine/retrieve_profile.php
+++ b/app/setting/api/engine/retrieve_profile.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UserManager.php';
 
diff --git a/app/setting/api/engine/retrieve_smtp.php b/app/setting/api/engine/retrieve_smtp.php
index db09c0c..5a34ec7 100644
--- a/app/setting/api/engine/retrieve_smtp.php
+++ b/app/setting/api/engine/retrieve_smtp.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/SmtpManager.php';
 
diff --git a/app/setting/api/engine/retrieve_users.php b/app/setting/api/engine/retrieve_users.php
index aaf86a6..e3f9b4e 100644
--- a/app/setting/api/engine/retrieve_users.php
+++ b/app/setting/api/engine/retrieve_users.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UserManager.php';
 
diff --git a/app/setting/api/engine/search_users.php b/app/setting/api/engine/search_users.php
index 44ff051..b0c6941 100644
--- a/app/setting/api/engine/search_users.php
+++ b/app/setting/api/engine/search_users.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UserManager.php';
 
diff --git a/app/setting/api/engine/stock_maintenance.php b/app/setting/api/engine/stock_maintenance.php
index 3e5d9ee..dbd66f9 100644
--- a/app/setting/api/engine/stock_maintenance.php
+++ b/app/setting/api/engine/stock_maintenance.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/EtlStockManager.php';
diff --git a/app/setting/api/engine/switch_branch.php b/app/setting/api/engine/switch_branch.php
index 47a3eb7..db0ef3f 100644
--- a/app/setting/api/engine/switch_branch.php
+++ b/app/setting/api/engine/switch_branch.php
@@ -9,7 +9,7 @@
  * carries company_id = the CURRENT company (prepare_form_data in custom.js),
  * so reading it made a switch silently re-select the company already active.
  */
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/UserManager.php';
 
diff --git a/app/setting/api/engine/test_smtp.php b/app/setting/api/engine/test_smtp.php
index 6c3d926..ef436cc 100644
--- a/app/setting/api/engine/test_smtp.php
+++ b/app/setting/api/engine/test_smtp.php
@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/SmtpManager.php';
 
diff --git a/app/setting/company.php b/app/setting/company.php
index 2a60c6e..9f03070 100644
--- a/app/setting/company.php
+++ b/app/setting/company.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/setting/document_types.php b/app/setting/document_types.php
index 0a6b4df..ff5a0f9 100644
--- a/app/setting/document_types.php
+++ b/app/setting/document_types.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/setting/gl_maintenance.php b/app/setting/gl_maintenance.php
index 011cffb..79c470a 100644
--- a/app/setting/gl_maintenance.php
+++ b/app/setting/gl_maintenance.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/setting/profile.php b/app/setting/profile.php
index 269fe6c..a5eaa1e 100644
--- a/app/setting/profile.php
+++ b/app/setting/profile.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/setting/smtp.php b/app/setting/smtp.php
index 5ce9851..4d99154 100644
--- a/app/setting/smtp.php
+++ b/app/setting/smtp.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/setting/stock_maintenance.php b/app/setting/stock_maintenance.php
index d0ea5e1..809b844 100644
--- a/app/setting/stock_maintenance.php
+++ b/app/setting/stock_maintenance.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/setting/system_config.php b/app/setting/system_config.php
index 22a4f73..f5e7bcd 100644
--- a/app/setting/system_config.php
+++ b/app/setting/system_config.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>
diff --git a/app/setting/users.php b/app/setting/users.php
index 9b394bd..f130a69 100644
--- a/app/setting/users.php
+++ b/app/setting/users.php
@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require_once '../assets/utils/app_registry.php';
   require '../include_header.php';