Adminator
37f6238d05
Vorbereitung für den JWT+Redis-Umschalter: alle verstreuten $_SESSION['teacher_id'|admin_id']-Zugriffe laufen jetzt durch Session::-Helper, damit der Backend-Tausch später EINE Datei (Session.php) ist statt 18 Stellen. - Session.php: neue Admin-Helper adminId()/loginAdmin()/logoutAdmin()/ requireAdmin() (mirror der Teacher-Helper). teacherId()/adminId() starten die Session jetzt lazy (Aufrufer müssen Session::start() nicht mehr). - 18 Fundstellen kanalisiert (admin.php, admin-accounts, admin-modules, licenses, levels, waypoints, foto-upload, admin_gate, save_map). - Country.php + app.php cockpit_href: über Session:: mit class_exists-Fallback (Bootstrap/Lib-Kontext, Session evtl. nicht geladen). Verhaltensneutral: 14/14 Lint OK, Helper-Round-Trip 6/6 PASS, Live-Smoke (admin status/modules/accounts/licenses) weist unauth. Requests wie bisher mit 401/403 ab. AUTH_BACKEND bleibt 'session' — Live unverändert. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
71 lines
2.4 KiB
PHP
71 lines
2.4 KiB
PHP
<?php
|
|
/**
|
|
* API: Level-Konfiguration (Admin)
|
|
* GET /api/levels?game_id=heli_start → Alle Levels eines Spiels
|
|
* POST /api/levels {action} → Level erstellen/bearbeiten/löschen
|
|
*/
|
|
|
|
$method = $_SERVER['REQUEST_METHOD'];
|
|
$db = Database::get();
|
|
|
|
if ($method === 'GET') {
|
|
$gameId = $_GET['game_id'] ?? '';
|
|
if (!$gameId) Response::error('game_id erforderlich');
|
|
|
|
$levels = $db->fetchAll(
|
|
'SELECT id, game_id, level_name, scenario, params, sort_order FROM game_levels WHERE game_id = ? ORDER BY sort_order, id',
|
|
[$gameId]
|
|
);
|
|
// Parse JSON params
|
|
foreach ($levels as &$l) {
|
|
$l['params'] = json_decode($l['params'], true);
|
|
}
|
|
Response::ok($levels);
|
|
}
|
|
|
|
if ($method === 'POST') {
|
|
// Admin check
|
|
$adminId = Session::adminId();
|
|
$teacherId = Session::teacherId();
|
|
if (!$adminId && !$teacherId) Response::error('Nicht autorisiert', 401);
|
|
|
|
$body = json_decode(file_get_contents('php://input'), true);
|
|
$action = $body['action'] ?? '';
|
|
|
|
if ($action === 'save') {
|
|
$gameId = $body['gameId'] ?? '';
|
|
$levelName = mb_substr(trim($body['levelName'] ?? ''), 0, 64);
|
|
$scenario = $body['scenario'] ?? '';
|
|
$params = json_encode($body['params'] ?? []);
|
|
$sortOrder = (int)($body['sortOrder'] ?? 0);
|
|
$levelId = (int)($body['levelId'] ?? 0);
|
|
|
|
if (!$gameId || !$levelName || !$scenario) Response::error('gameId, levelName und scenario erforderlich');
|
|
|
|
if ($levelId) {
|
|
$db->execute(
|
|
'UPDATE game_levels SET level_name = ?, scenario = ?, params = ?, sort_order = ?, updated_at = NOW() WHERE id = ?',
|
|
[$levelName, $scenario, $params, $sortOrder, $levelId]
|
|
);
|
|
} else {
|
|
$db->execute(
|
|
'INSERT INTO game_levels (game_id, level_name, scenario, params, sort_order) VALUES (?, ?, ?, ?, ?)',
|
|
[$gameId, $levelName, $scenario, $params, $sortOrder]
|
|
);
|
|
$levelId = (int)$db->lastInsertId();
|
|
}
|
|
Response::ok(['id' => $levelId]);
|
|
}
|
|
|
|
if ($action === 'delete') {
|
|
$levelId = (int)($body['levelId'] ?? 0);
|
|
if (!$levelId) Response::error('levelId erforderlich');
|
|
$db->execute('DELETE FROM game_levels WHERE id = ?', [$levelId]);
|
|
Response::ok();
|
|
}
|
|
|
|
Response::error('Unbekannte Aktion');
|
|
}
|
|
|
|
Response::error('Methode nicht erlaubt', 405);
|