✏ EDIT: bootstrap.php

<?php
// bootstrap.php centralises common API logic: starting sessions,
// including the database connection and providing helper functions for
// sending consistent JSON responses and enforcing authentication.

if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

header('Content-Type: application/json');

// Allow cross-origin requests in development. These headers make the
// API consumable from different origins (e.g. when running the UI on
// another port) and handle preflight OPTIONS requests gracefully.
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Headers: Content-Type');
header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    exit;
}

require_once __DIR__ . '/../config/db.php';

/**
 * Return a JSON response and terminate the script. Data is returned
 * only when no error is present. The ok flag indicates success.
 *
 * @param mixed $data
 * @param string|null $error
 */
function respond($data = null, $error = null)
{
    echo json_encode([
        'ok' => $error === null,
        'data' => $error === null ? $data : null,
        'error' => $error,
    ]);
    exit;
}

/**
 * Require that a user is logged in. If no session exists, respond
 * with an error. Returns the user array when authenticated.
 */
function require_login()
{
    if (empty($_SESSION['user'])) {
        respond(null, 'Not authenticated');
    }
    return $_SESSION['user'];
}

/**
 * Require that the current user is an administrator. If the user is
 * not logged in or not an admin, respond with an error.
 */
function require_admin()
{
    $user = require_login();
    if ($user['role'] !== 'ADMIN') {
        respond(null, 'Admin only');
    }
    return $user;
}

[✗] CANCEL