function log_activity($action, $meta=''){
  global $pdo;
  try{
    $uid = $_SESSION['admin_id'] ?? null;
    $ip  = $_SERVER['REMOTE_ADDR'] ?? '';
    $ua  = $_SERVER['HTTP_USER_AGENT'] ?? '';
    $stmt = $pdo->prepare("INSERT INTO activity_log (user_id, action, meta, ip, user_agent) VALUES (?,?,?,?,?)");
    $stmt->execute([$uid, $action, $meta, $ip, $ua]);
  } catch(Exception $e){}
}

function has_role($role){
  global $pdo;
  $uid = $_SESSION['admin_id'] ?? 0;
  if(!$uid) return false;
  $stmt = $pdo->prepare("SELECT r.name FROM roles r JOIN user_roles ur ON ur.role_id=r.id WHERE ur.user_id=?");
  $stmt->execute([$uid]);
  $roles = array_map(fn($x)=>$x['name'], $stmt->fetchAll());
  return in_array($role, $roles, true);
}

function require_role($roles){
  if(!is_array($roles)) $roles = [$roles];
  foreach($roles as $r){
    if(has_role($r)) return;
  }
  http_response_code(403);
  echo "<div style='padding:24px;font-family:Tahoma'>403 Forbidden</div>";
  exit;
}

/* --------------------------------------------------------------------------
| CSRF Protection
|-------------------------------------------------------------------------- */
function csrf_token() {
    if (empty($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf_token'];
}
function csrf_field() {
    echo '<input type="hidden" name="csrf_token" value="'.h(csrf_token()).'">';
}
function csrf_verify() {
    $sent = $_POST['csrf_token'] ?? '';
    $sess = $_SESSION['csrf_token'] ?? '';
    if (!$sent || !$sess || !hash_equals($sess, $sent)) {
        http_response_code(403);
        echo '403 Forbidden (CSRF)';
        exit;
    }
}

/* --------------------------------------------------------------------------
| Simple Page Cache (optional)
|-------------------------------------------------------------------------- */
function cache_page($key, $ttl_seconds = 60) {
    $dir = __DIR__ . '/../storage/cache_pages';
    if (!is_dir($dir)) @mkdir($dir, 0755, true);
    $file = $dir . '/' . preg_replace('~[^a-zA-Z0-9_\-]~','_', $key) . '.html';
    if (file_exists($file) && (time() - filemtime($file)) < $ttl_seconds) {
        readfile($file);
        exit;
    }
    ob_start();
    register_shutdown_function(function() use ($file) {
        $out = ob_get_contents();
        if ($out !== false) @file_put_contents($file, $out);
        ob_end_flush();
    });
}

/* --------------------------------------------------------------------------
| Brute-force protection helpers
|-------------------------------------------------------------------------- */
function login_attempts_bootstrap() {
    global $pdo;
    try {
        $pdo->exec("CREATE TABLE IF NOT EXISTS login_attempts (
            id INT AUTO_INCREMENT PRIMARY KEY,
            username VARCHAR(190) NULL,
            ip VARCHAR(64) NULL,
            success TINYINT(1) NOT NULL DEFAULT 0,
            created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
            KEY idx_user_ip_time (username, ip, created_at)
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4");
    } catch (Throwable $e) {}
}

function login_is_blocked($username, $ip) {
    global $pdo;
    login_attempts_bootstrap();
    $max = defined('LOGIN_MAX_ATTEMPTS') ? (int)LOGIN_MAX_ATTEMPTS : 5;
    $mins = defined('LOGIN_BLOCK_MINUTES') ? (int)LOGIN_BLOCK_MINUTES : 15;
    try {
        $stmt = $pdo->prepare("SELECT COUNT(*) FROM login_attempts
                               WHERE success=0 AND created_at >= (NOW() - INTERVAL ? MINUTE)
                               AND (ip=? OR (username IS NOT NULL AND username=?))");
        $stmt->execute([$mins, $ip, $username]);
        return ((int)$stmt->fetchColumn()) >= $max;
    } catch (Throwable $e) {
        return false;
    }
}

function login_record_attempt($username, $ip, $success) {
    global $pdo;
    login_attempts_bootstrap();
    try {
        $stmt = $pdo->prepare("INSERT INTO login_attempts (username, ip, success) VALUES (?,?,?)");
        $stmt->execute([$username ?: null, $ip ?: null, $success ? 1 : 0]);
    } catch (Throwable $e) {}
}

function require_any_role($roles) {
    if (!is_array($roles)) $roles = [$roles];
    foreach ($roles as $r) if (has_role($r)) return;
    http_response_code(403);
    echo "403 Forbidden";
    exit;
}

/* --------------------------------------------------------------------------
| Settings (DB key/value)
|-------------------------------------------------------------------------- */
function settings_bootstrap() {
    global $pdo;
    try {
        $pdo->exec("CREATE TABLE IF NOT EXISTS settings (
            `key` VARCHAR(190) PRIMARY KEY,
            `value` TEXT NULL,
            updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4");
    } catch (Throwable $e) {}
}

function setting($key, $default = '') {
    global $pdo;
    settings_bootstrap();
    try {
        $stmt = $pdo->prepare("SELECT value FROM settings WHERE `key`=? LIMIT 1");
        $stmt->execute([$key]);
        $v = $stmt->fetchColumn();
        if ($v === false || $v === null || $v === '') return $default;
        return $v;
    } catch (Throwable $e) {
        return $default;
    }
}

function set_setting($key, $value) {
    global $pdo;
    settings_bootstrap();
    try {
        $stmt = $pdo->prepare("INSERT INTO settings (`key`,`value`) VALUES (?,?)
                               ON DUPLICATE KEY UPDATE `value`=VALUES(`value`)");
        $stmt->execute([$key, $value]);
        return true;
    } catch (Throwable $e) {
        return false;
    }
}
<!DOCTYPE html>
<html lang="en" dir="ltr">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>روابي</title>
<meta name="description" content="حلول أمان متكاملة بمعايير احترافية">
<link rel="icon" type="image/png" href="/assets/img/favicon.png">
<link rel="stylesheet" href="/assets/css/style.css">

    <meta name="description" content="Supply, installation, execution and maintenance of fire alarm &amp; firefighting systems and safety equipment. Your protection is our priority.">
  <link rel="canonical" href="https://rawabiksa.com/register.php">
  <meta property="og:title" content="Client Registration">
  <meta property="og:description" content="Supply, installation, execution and maintenance of fire alarm &amp; firefighting systems and safety equipment. Your protection is our priority.">
  <meta property="og:type" content="website">
  <meta property="og:url" content="https://rawabiksa.com/register.php">
  <meta property="og:site_name" content="روابي السلامة الأمنية">
  <script type="application/ld+json">
  {"@context":"https://schema.org","@type":"Organization","name":"مؤسسة روابي السلامة الأمنية","url":"https://rawabiksa.com","email":"info@rawabiksa.com","telephone":"0598880777","slogan":"حمايتكم أولوياتنا"}  </script>

</head>
<body>
<header class="hdr">
  <div class="container hdr__row">
    <div class="brand">
      <div class="brand__name">روابي</div>
      <div class="brand__tagline">حلول أمان متكاملة بمعايير احترافية</div>
    </div>
    <div class="hdr__actions">
      <a class="btn btn--ghost" href="?lang=ar">AR</a>
      <a class="btn btn--ghost" href="?lang=en">EN</a>
      <a class="btn btn--primary" href="/contact.php">Request a Quote</a>
    </div>
  </div>
</header>

<nav class="nav">
  <div class="container nav__row">
    <a href="/index.php">Home</a>
    <a href="/about.php">About</a>
    <a href="/systems.php">Systems</a>
    <a href="/services.php">Services</a>
    <a href="/projects.php">Projects</a>
    <a href="/partners.php">Partners</a>
    <a href="/contact.php">Contact</a>
    <span class="nav__spacer"></span>
    <a class="nav__admin" href="/login.php">Admin</a>
  </div>
</nav>

<main class="main">
<div class="container">
<section class="section">
  <div class="container" style="max-width:560px">
    <div class="card" style="padding:22px">
      <div style="display:flex;justify-content:center;margin-bottom:14px">
        <img src="/assets/img/logo.svg" alt="Rawabi" style="height:54px;max-width:240px;width:auto">
      </div>
      <h2 style="margin:0 0 10px 0">Client Registration</h2>
      <p style="opacity:.85;margin-top:0">Client registration will be enabled once the portal is approved.</p>
      <div class="notice" style="margin:14px 0">For now, request a quote and we will contact you shortly.</div>
      <a class="btn btn--primary" href="/contact.php">Request a Quote</a>
      <a class="btn" style="margin-inline-start:10px" href="/login.php">Login</a>
    </div>
  </div>
</section>

</div>
</main>

<footer class="ftr">
  <div class="container ftr__grid">
    <div>
      <div class="ftr__title">Contact</div>
      <div class="ftr__line">Phone: 0598880777</div>
      <div class="ftr__line">Email: info@rawabiksa.com</div>
      <div class="ftr__line">WhatsApp: 966598880777</div>
      <div class="ftr__line">Website: www.RawabiKSA.com</div>
    </div>
    <div>
      <div class="ftr__title">Your Protection Is Our Priority</div>
      <div class="ftr__small">© 2026 Rawabi</div>
      <div class="ftr__small">CR: 2051065405 | VAT: 300393184100003</div>
    </div>
  </div>
</footer>

<script src="/assets/js/app.js"></script>
</body>
</html>