Tazyeuu
53 lines
1.5 KiB
PHP
53 lines
1.5 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../config/session.php';
|
|
|
|
/**
|
|
* Shared response helper for all API endpoints
|
|
*/
|
|
header('Content-Type: application/json');
|
|
$allowedOrigin = getenv('CORS_ALLOWED_ORIGIN');
|
|
if ($allowedOrigin !== false && $allowedOrigin !== '') {
|
|
header('Access-Control-Allow-Origin: ' . $allowedOrigin);
|
|
header('Vary: Origin');
|
|
header('Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS');
|
|
header('Access-Control-Allow-Headers: Content-Type');
|
|
}
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { http_response_code(204); exit; }
|
|
|
|
function sendSuccess($data, string $message = 'OK', int $code = 200): void {
|
|
http_response_code($code);
|
|
echo json_encode(['status' => 'success', 'message' => $message, 'data' => $data]);
|
|
exit;
|
|
}
|
|
|
|
function sendError(string $message = 'Bad Request', int $code = 400): void {
|
|
http_response_code($code);
|
|
echo json_encode(['status' => 'error', 'message' => $message, 'data' => null]);
|
|
exit;
|
|
}
|
|
|
|
function getInput(): array {
|
|
return json_decode(file_get_contents('php://input'), true) ?? [];
|
|
}
|
|
|
|
function requireApiRole(string $role): void {
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
startAppSession();
|
|
}
|
|
|
|
if (!isset($_SESSION['user_id'], $_SESSION['role'])) {
|
|
sendError('Unauthorized', 401);
|
|
}
|
|
|
|
if ($_SESSION['role'] !== $role) {
|
|
sendError('Forbidden', 403);
|
|
}
|
|
}
|
|
|
|
function requireAdminForMutation(): void {
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
|
|
requireApiRole('admin');
|
|
}
|
|
}
|