<?php
declare(strict_types=1);

$staff = $_SESSION['staff'] ?? null;

if (!$staff || empty($staff['id'])) {
  header("Location: " . APP_BASE . "/staff/login.php?next=" . urlencode(APP_BASE . "/admin/usuarios.php"));
  exit;
}

$role = (string)($staff['role'] ?? '');
if ($role !== 'ADMIN') {
  http_response_code(403);
  echo "Acesso negado (ADMIN).";
  exit;
}
