Adminator
37f6238d05
Vorbereitung für den JWT+Redis-Umschalter: alle verstreuten $_SESSION['teacher_id'|admin_id']-Zugriffe laufen jetzt durch Session::-Helper, damit der Backend-Tausch später EINE Datei (Session.php) ist statt 18 Stellen. - Session.php: neue Admin-Helper adminId()/loginAdmin()/logoutAdmin()/ requireAdmin() (mirror der Teacher-Helper). teacherId()/adminId() starten die Session jetzt lazy (Aufrufer müssen Session::start() nicht mehr). - 18 Fundstellen kanalisiert (admin.php, admin-accounts, admin-modules, licenses, levels, waypoints, foto-upload, admin_gate, save_map). - Country.php + app.php cockpit_href: über Session:: mit class_exists-Fallback (Bootstrap/Lib-Kontext, Session evtl. nicht geladen). Verhaltensneutral: 14/14 Lint OK, Helper-Round-Trip 6/6 PASS, Live-Smoke (admin status/modules/accounts/licenses) weist unauth. Requests wie bisher mit 401/403 ab. AUTH_BACKEND bleibt 'session' — Live unverändert. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
61 lines
2.2 KiB
PHP
61 lines
2.2 KiB
PHP
<?php
|
|
/**
|
|
* API: Waypoints (Geo-Koordinaten)
|
|
* GET /api/waypoints → Alle Waypoints
|
|
* GET /api/waypoints?region=tirol → Gefiltert
|
|
* POST /api/waypoints {action} → CRUD (Admin)
|
|
*/
|
|
|
|
$method = $_SERVER['REQUEST_METHOD'];
|
|
$db = Database::get();
|
|
|
|
if ($method === 'GET') {
|
|
$region = $_GET['region'] ?? '';
|
|
$type = $_GET['type'] ?? '';
|
|
$where = '1=1';
|
|
$params = [];
|
|
if ($region) { $where .= ' AND region = ?'; $params[] = $region; }
|
|
if ($type) { $where .= ' AND wp_type = ?'; $params[] = $type; }
|
|
$wps = $db->fetchAll("SELECT id, wp_key, name, lat, lon, region, wp_type, info FROM geo_waypoints WHERE $where ORDER BY region, wp_type, name", $params);
|
|
Response::ok($wps);
|
|
}
|
|
|
|
if ($method === 'POST') {
|
|
$adminId = Session::adminId();
|
|
$teacherId = Session::teacherId();
|
|
if (!$adminId && !$teacherId) Response::error('Nicht autorisiert', 401);
|
|
|
|
$body = json_decode(file_get_contents('php://input'), true);
|
|
$action = $body['action'] ?? '';
|
|
|
|
if ($action === 'save') {
|
|
$wpKey = preg_replace('/[^a-z0-9_]/', '', strtolower(trim($body['wpKey'] ?? '')));
|
|
$name = mb_substr(trim($body['name'] ?? ''), 0, 100);
|
|
$lat = (float)($body['lat'] ?? 0);
|
|
$lon = (float)($body['lon'] ?? 0);
|
|
$region = trim($body['region'] ?? 'vorarlberg');
|
|
$wpType = $body['wpType'] ?? 'village';
|
|
$info = mb_substr(trim($body['info'] ?? ''), 0, 255);
|
|
if (!$wpKey || !$name || !$lat || !$lon) Response::error('wpKey, name, lat, lon erforderlich');
|
|
|
|
$db->execute(
|
|
'INSERT INTO geo_waypoints (wp_key, name, lat, lon, region, wp_type, info)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?)
|
|
ON DUPLICATE KEY UPDATE name=VALUES(name), lat=VALUES(lat), lon=VALUES(lon), region=VALUES(region), wp_type=VALUES(wp_type), info=VALUES(info)',
|
|
[$wpKey, $name, $lat, $lon, $region, $wpType, $info ?: null]
|
|
);
|
|
Response::ok();
|
|
}
|
|
|
|
if ($action === 'delete') {
|
|
$id = (int)($body['id'] ?? 0);
|
|
if (!$id) Response::error('id erforderlich');
|
|
$db->execute('DELETE FROM geo_waypoints WHERE id = ?', [$id]);
|
|
Response::ok();
|
|
}
|
|
|
|
Response::error('Unbekannte Aktion');
|
|
}
|
|
|
|
Response::error('Methode nicht erlaubt', 405);
|