<?php
declare(strict_types=1);

require_once __DIR__ . '/../response.php';

function enforce_product_scope(?int $requiredProductId = null): void
{
    if (!isset($_SESSION['product_id'])) {
        error_forbidden('Product scope missing');
    }

    if (!empty($_SESSION['is_global'])) {
        return;
    }

    if ($requiredProductId !== null) {
        if ((int)$_SESSION['product_id'] !== $requiredProductId) {
            error_forbidden('Product access denied');
        }
    }
}
