Start every session through session.php; idle timeout, app access and auth status codes

app/ac_dashboard/api/engine/by_source.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 

app/ac_dashboard/api/engine/journals.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 

app/ac_dashboard/api/engine/pl.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 

app/ac_dashboard/api/engine/posting_window.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/CompanySettingManager.php';
 

app/ac_dashboard/api/engine/recent.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 

app/ac_dashboard/api/engine/trend.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 

app/ac_dashboard/index.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/account_formulas.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/api/engine/account.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
 

app/accounting/api/engine/account_formula.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin', 'staff']);
 require_once '../../../assets/utils/classes_ac/AccountFormulaManager.php';

app/accounting/api/engine/account_stats.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/UsageGuard.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';

app/accounting/api/engine/acquire_op_lock.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/OperationLockManager.php';
 

app/accounting/api/engine/department.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/DepartmentManager.php';
 

app/accounting/api/engine/department_stats.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/UsageGuard.php';
 require_once '../../../assets/utils/classes_ac/DepartmentManager.php';

app/accounting/api/engine/get_balance_sheet.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 

app/accounting/api/engine/get_gl_by_source.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/GlManager.php';
 require_once '../../../assets/utils/classes_ac/GlQueryManager.php';

app/accounting/api/engine/get_gl_documents.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/GlQueryManager.php';
 

app/accounting/api/engine/get_gl_movement.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 

app/accounting/api/engine/get_journal_detail.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/GlQueryManager.php';
 

app/accounting/api/engine/get_journal_listing.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/GlQueryManager.php';
 

app/accounting/api/engine/get_pl_statement.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 

app/accounting/api/engine/get_trial_balance.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 

app/accounting/api/engine/get_vat_report.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
 

app/accounting/api/engine/log_batch_action.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/BatchActionManager.php';
 

app/accounting/api/engine/manage_account.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
 

app/accounting/api/engine/manage_department.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/DepartmentManager.php';
 

app/accounting/api/engine/post_gl_entry.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/PostingWindowGuard.php';
 require_once '../../../assets/utils/classes_ac/GlManager.php';

app/accounting/api/engine/posting_window.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/CompanySettingManager.php';
 require_role($user_role, ['owner', 'admin']);

app/accounting/api/engine/product_account_mapping.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/ProductManager.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';

app/accounting/api/engine/release_op_lock.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/OperationLockManager.php';
 

app/accounting/api/engine/remove_account.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
 

app/accounting/api/engine/remove_department.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/DepartmentManager.php';
 

app/accounting/api/engine/retrieve_account.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
 

app/accounting/api/engine/retrieve_department.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes_ac/DepartmentManager.php';
 

app/accounting/api/engine/save_manual_journal.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/DocumentNumberManager.php';
 require_once '../../../assets/utils/classes_ac/PostingWindowGuard.php';

app/accounting/balance_sheet.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/chart_of_accounts.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/departments.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/gl_entries.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/gl_movement.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/journal_listing.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/manage_account.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/manage_department.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/pl_statement.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/posting_window.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/trial_balance.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/accounting/vat_report.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/assets/js/custom.js

@@ -905,6 +905,17 @@ function ajax_request(options) {
       return;
     }
 
+    // Session ended on the server (idle timeout, not signed in, password changed):
+    // drop per-tab data and go back to the sign-in form.
+    const endedCodes = ['session_expired', 'auth_required', 'password_changed'];
+    if (xhr?.status === 401 && endedCodes.includes(xhr?.responseJSON?.code)) {
+      try { sessionStorage.clear(); } catch (e) {}
+      bootbox.alert(escape_html(xhr.responseJSON.message || 'Please sign in again.'), function() {
+        window.location.href = server_url + 'login/index.php';
+      });
+      return;
+    }
+
     // File / payload too large (nginx 413)
     if (xhr?.status === 413) {
       bootbox.alert('The file you selected is too large. Please use an image under 2 MB and try again.');

app/assets/utils/app_access.php

@@ -0,0 +1,37 @@
+<?php
+/**
+ * app_access.php — which app (WMS / Accounting) a script belongs to, and whether
+ * the signed-in user's app_access allows it.
+ *
+ * app_access used to only choose which menus the topbar drew; a WMS-only user
+ * could still open the accounting pages and call their APIs directly. db_auth.php
+ * (API engines) and include_topbar.php (pages) now both enforce it through here.
+ */
+
+// Accounting endpoints the WMS screens also call (master-data lookups, the
+// batch operation lock, and the GL panel on purchase invoices).
+const APP_ACCESS_SHARED_ACCOUNTING = [
+    'accounting/api/engine/account.php',
+    'accounting/api/engine/account_formula.php',
+    'accounting/api/engine/department.php',
+    'accounting/api/engine/acquire_op_lock.php',
+    'accounting/api/engine/release_op_lock.php',
+    'accounting/api/engine/get_gl_by_source.php',
+];
+
+/** The app a script under app/ belongs to: 'accounting', or null for WMS/shared. */
+function app_access_app_for(string $script_name): ?string {
+    $path = str_replace('\\', '/', $script_name);
+    $pos  = strpos($path, '/app/');
+    if ($pos === false) return null;
+    $rel = substr($path, $pos + 5);
+
+    if (in_array($rel, APP_ACCESS_SHARED_ACCOUNTING, true)) return null;
+    if (preg_match('#^(accounting|ac_dashboard|revenue|expense|finance|journal)/#', $rel)) return 'accounting';
+    return null;
+}
+
+/** Whether an app_access value ('wms', 'accounting', 'all') includes $app. */
+function app_access_allows(string $access, string $app): bool {
+    return $access === 'all' || $access === $app;
+}

app/assets/utils/db_auth.php

@@ -38,6 +38,7 @@ set_exception_handler(function (Throwable $e) {
 require_once __DIR__."/../../config.php";
 require_once __DIR__."/../../dbconn.php";
 require_once __DIR__."/db_helpers.php";
+require_once __DIR__."/app_access.php";
 
 if (!function_exists('require_role')) {
     function require_role(string $user_role, array $allowed): void {
@@ -53,14 +54,14 @@ if(!empty($_SESSION["login_company_id"])){
     // CSRF Validation — add right at the top of the logged-in block
     if($_SERVER['REQUEST_METHOD'] === 'POST'){
         $csrf_token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
-        if(empty($csrf_token) || $csrf_token !== $_SESSION['csrf_token']){
+        if(empty($csrf_token) || !hash_equals((string)($_SESSION['csrf_token'] ?? ''), $csrf_token)){
             http_response_code(403);
             exit(json_encode(["message" => "Invalid request"]));
         }
     }
 
     // validate otp
-    $sql = "SELECT `password`
+    $sql = "SELECT `password`, license, app_access
         FROM user 
         WHERE user_id = :company_id";
     $sth = $pdo1->prepare($sql);
@@ -68,7 +69,8 @@ if(!empty($_SESSION["login_company_id"])){
         ":company_id" => $_SESSION["login_user_id"]
     ]);
     db_check($sth, $answer);
-    $password = $sth->fetchColumn();
+    $user_row = $sth->fetch(PDO::FETCH_ASSOC) ?: [];
+    $password = $user_row['password'] ?? '';
     /** Generate OTP */
     function generateOTP($sercet_key, $time_step = 180, $length = 6){
         $counter = floor($_SESSION["otpTime"] / $time_step);
@@ -83,7 +85,9 @@ if(!empty($_SESSION["login_company_id"])){
     $otp = generateOTP($password);
     
     if( $_SESSION["otp"]!=$otp ){
+        http_response_code(401);
         $answer["message"] = "Your password has been reset, Please logout and login again.";
+        $answer["code"] = "password_changed";
         exit(json_encode($answer));
     }
     
@@ -98,13 +102,29 @@ if(!empty($_SESSION["login_company_id"])){
     $map = $sth->fetchAll(PDO::FETCH_ASSOC);
     
     if( count($map)==0 ){
+        http_response_code(403);
         $answer["message"] = "Your accessibility to this company has been removed.";
+        $answer["code"] = "access_removed";
         exit(json_encode($answer));
     }
 
     $user_role = $map[0]['role'] ?? 'viewer';
     $_SESSION['login_role'] = $user_role;
 
+    // App access (WMS / Accounting), re-read on every request so a change made in
+    // Setting → Users applies at once. Owners hold it on their own user row;
+    // invited users per company (same rule as login_confirm.php).
+    $app_access = (($user_row['license'] ?? 'owner') === 'owner')
+        ? ($user_row['app_access'] ?? 'wms')
+        : ($map[0]['app_access'] ?? 'wms');
+    $_SESSION['login_app_access'] = $app_access;
+
+    $required_app = app_access_app_for($_SERVER['SCRIPT_NAME'] ?? '');
+    if ($required_app !== null && !app_access_allows($app_access, $required_app)) {
+        http_response_code(403);
+        exit(json_encode(['success' => 0, 'message' => 'Your account does not have access to this module.']));
+    }
+
     // Single-session enforcement: if a session_token was issued at login, verify
     // it still matches the DB. A mismatch means a newer login has taken over.
     if (!empty($_SESSION['session_token'])) {
@@ -132,7 +152,12 @@ if(!empty($_SESSION["login_company_id"])){
 // unless the engine explicitly declared itself a pre-auth route.
 if (empty($_SESSION['login_company_id']) && !defined('UNAUTHENTICATED_ROUTE')) {
     http_response_code(401);
-    exit(json_encode(['success' => 0, 'message' => 'Authentication required.']));
+    $expired = !empty($_SESSION['_idle_expired']);
+    exit(json_encode([
+        'success' => 0,
+        'message' => $expired ? 'Your session has expired. Please sign in again.' : 'Authentication required.',
+        'code'    => $expired ? 'session_expired' : 'auth_required',
+    ]));
 }
 
 // set up ANSWER
@@ -153,6 +178,7 @@ if (!is_array($data)) {
     $data = $_POST;
 } else {
     // Truly no data received
+    http_response_code(400);
     $answer["message"] = "Request denied: No valid JSON payload or Form Data detected.";
     exit(json_encode($answer));
 }

app/contact/api/engine/contact.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 

app/contact/api/engine/contact_stats.php

@@ -1,5 +1,5 @@
 <?php 
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
 
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';

app/contact/api/engine/contact_type.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 

app/contact/api/engine/manage_contact.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/FileUploader.php';
     require_once '../../../assets/utils/classes/ContactManager.php';

app/contact/api/engine/manage_contact_type.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 

app/contact/api/engine/remove_contact.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 

app/contact/api/engine/remove_contact_type.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 

app/contact/api/engine/retrieve_contact.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 

app/contact/api/engine/retrieve_contact_type.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 

app/contact/contact.php

@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/contact/manage_contact.php

@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 

app/contact/manage_contact_type.php

@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 

app/dashboard/api/engine_report/low_stock.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
 
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ReportManager.php';

app/dashboard/api/engine_report/reports_stats.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UsageGuard.php';
     require_once '../../../assets/utils/classes/ReportManager.php';

app/dashboard/index.php

@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/dashboard/low_stock_products.php

@@ -1,5 +1,5 @@
 <?php 
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/expense/api/engine/convert_purchase_request.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
 require_once '../../../assets/utils/classes/PurchaseRequestManager.php';

app/expense/api/engine/delete_supplier_credit_note.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/InvoiceManager.php';

app/expense/api/engine/manage_purchase_request.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
 require_once '../../../assets/utils/classes/UsageGuard.php';

app/expense/api/engine/manage_supplier_credit_note.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/InvoiceManager.php';

app/expense/api/engine/retrieve_purchase_request.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
 

app/expense/api/engine/update_purchase_request_status.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
 require_role($user_role, ['owner', 'admin', 'staff']);

app/expense/manage_purchase_invoice.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 

app/expense/manage_purchase_order.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 

app/expense/manage_purchase_request.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 

app/expense/manage_supplier_credit_note.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 

app/expense/purchase_invoice.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/expense/purchase_order.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/expense/purchase_request.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/finance/api/engine/delete_payment.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/PaymentManager.php';

app/finance/api/engine/delete_payment_billing.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/PaymentBillingManager.php';

app/finance/api/engine/delete_receipt.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/ReceiptManager.php';

app/finance/api/engine/delete_receipt_billing.php

@@ -1,5 +1,5 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_role($user_role, ['owner', 'admin']);
 require_once '../../../assets/utils/classes/ReceiptBillingManager.php';

app/finance/api/engine/manage_payment.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/UsageGuard.php';

app/finance/api/engine/manage_payment_billing.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/PaymentBillingManager.php';

app/finance/api/engine/manage_receipt.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/UsageGuard.php';

app/finance/api/engine/manage_receipt_billing.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_role($user_role, ['owner', 'admin', 'staff']);
     require_once '../../../assets/utils/classes/ReceiptBillingManager.php';

app/finance/manage_payment.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
 
   // A detail-only page: payments are created from the Payments list, so with no

app/finance/manage_payment_billing.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
 
   // A detail-only page: payment billings are created from their list, so with

app/finance/manage_receipt.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
 
   // A detail-only page: receipts are created from the Receipts list, so with no

app/finance/manage_receipt_billing.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
 
   // A detail-only page: receipt billings are created from their list, so with

app/finance/payment.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 

app/finance/payment_billing.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/finance/receipt.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 

app/finance/receipt_billing.php

@@ -1,5 +1,5 @@
 <?php
-  session_start();
+  require_once __DIR__ . '/../session.php';
   require '../config.php';
   require '../include_header.php';
 ?>

app/ics/api/engine/approve_stock.php

@@ -11,7 +11,7 @@
  *   warehouse    int     warehouse_id (to resolve the dynamic table)
  *   type         string  'in' | 'out' | 'transfer'
  */
-session_start();
+require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/StockManager.php';
 require_once '../../../assets/utils/classes/WarehouseManager.php';

app/ics/api/engine/barcode_lookup.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/CompanySettingManager.php';
     require_once '../../../assets/utils/classes/BarcodeManager.php';

app/ics/api/engine/contact_search.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/ContactManager.php';
 

app/ics/api/engine/delete_stock_in.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';
 

app/ics/api/engine/delete_stock_out.php

@@ -1,5 +1,5 @@
 <?php
-    session_start();
+    require_once __DIR__ . '/../../../session.php';
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/WarehouseManager.php';