<?php
require_once './includes/config.php';
require_once './auth/middleware.php';

header('Content-Type: application/json');

if (!isset($_SERVER['HTTP_X_CSRF_TOKEN']) || 
    !hash_equals($_SESSION['csrf_token'], $_SERVER['HTTP_X_CSRF_TOKEN'])) {
    http_response_code(403);
    die(json_encode(['valid' => false]));
}

$valid = isset($_SESSION['user_id']) && 
         (time() - $_SESSION['last_activity']) < SESSION_TIMEOUT;

echo json_encode([
    'valid' => $valid,
    'time_left' => SESSION_TIMEOUT - (time() - $_SESSION['last_activity'])
]);