<?php
namespace App\Core;

class OrgScope
{
    public static function enforce(string &$sql): void
    {
        if (!isset($_SESSION['role'])) return;

        // Superadmin sees everything
        if ($_SESSION['role'] === 'super_admin') {
            return;
        }

        if (!isset($_SESSION['org_id'])) {
            throw new \Exception("Organization not selected.");
        }

        if (stripos($sql, 'where') !== false) {
            $sql .= " AND org_id = :org_id";
        } else {
            $sql .= " WHERE org_id = :org_id";
        }
    }
}
