📂 File Browser

📁 Directories

📄 Files

📄 Source: users.php

<?php
require_once __DIR__ . '/../auth.php';
require_once __DIR__ . '/../lib/net.php';

header('Content-Type: application/json');
require_auth_json();

$method  = $_SERVER['REQUEST_METHOD'];
$user    = $GLOBALS['__USER'];
$isOwner = !empty($user['is_owner']);
$isLan   = $GLOBALS['__LAN'];

if (!$isOwner && !$isLan) {
    http_response_code(403);
    echo json_encode(['ok' => false, 'error' => 'Only the owner or LAN can manage accounts']);
    exit;
}

if ($method === 'GET') {
    $data = users_load();
    $safe = array_map(fn($u) => [
        'username'     => $u['username'],
        'is_owner'     => !empty($u['is_owner']),
        'device_bound' => !empty($u['device_bound']),
        'created_at'   => $u['created_at'] ?? null,
    ], $data['users']);
    echo json_encode(['ok' => true, 'users' => $safe]);
    exit;
}

if ($method === 'POST') {
    $action = $_POST['action'] ?? '';

    if ($action === 'create') {
        $username = trim($_POST['username'] ?? '');
        $password = $_POST['password'] ?? '';
        $bound    = !empty($_POST['device_bound']);
        if ($username === '' || strlen($password) < 6) {
            http_response_code(400);
            echo json_encode(['ok' => false, 'error' => 'Username required, password >= 6 chars']);
            exit;
        }
        $ok = users_create($username, $password, $bound);
        echo json_encode(['ok' => $ok, 'error' => $ok ? null : 'User already exists']);
        exit;
    }

    if ($action === 'delete') {
        $username = $_POST['username'] ?? '';
        $ok = users_delete($username);
        echo json_encode(['ok' => $ok]);
        exit;
    }

    if ($action === 'unbind') {
        $username = $_POST['username'] ?? '';
        users_unbind_device($username);
        echo json_encode(['ok' => true]);
        exit;
    }

    http_response_code(400);
    echo json_encode(['ok' => false, 'error' => 'Unknown action']);
    exit;
}

http_response_code(405);
echo json_encode(['ok' => false, 'error' => 'Method not allowed']);