<?php
if (session_status() !== PHP_SESSION_ACTIVE) {
  session_set_cookie_params(['lifetime'=>0,'path'=>'/','httponly'=>true,'samesite'=>'Lax']);
  session_start();
}

define('APP_ETC','/etc/snowpanel');
define('APP_VAR','/var/lib/snowpanel');
define('APP_CFG_ETC', APP_ETC.'/app.json');
define('APP_CFG_VAR', APP_VAR.'/app.json');

function app_cfg_path() {
  if (is_file(APP_CFG_ETC)) return APP_CFG_ETC;
  if (is_file(APP_CFG_VAR)) return APP_CFG_VAR;
  return APP_CFG_ETC;
}

function app_is_installed() {
  $p = app_cfg_path();
  if (!is_file($p)) return false;
  $j = json_decode((string)@file_get_contents($p), true);
  return is_array($j) && !empty($j['admin_user']) && !empty($j['admin_pass']);
}

function app_load_config() {
  $p = app_cfg_path();
  $j = json_decode((string)@file_get_contents($p), true);
  return is_array($j) ? $j : [];
}

function app_save_config(array $cfg) {
  $target = APP_CFG_ETC;
  $dir = dirname($target);
  if (!is_dir($dir)) @mkdir($dir, 0770, true);
  $ok = @file_put_contents($target, json_encode($cfg, JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES), LOCK_EX) !== false;
  if (!$ok) {
    $target = APP_CFG_VAR;
    $dir = dirname($target);
    if (!is_dir($dir)) @mkdir($dir, 0770, true);
    $ok = @file_put_contents($target, json_encode($cfg, JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES), LOCK_EX) !== false;
  }
  if ($ok) {
    @chgrp(dirname($target), 'www-data'); @chmod(dirname($target), 0770);
    @chgrp($target, 'www-data'); @chmod($target, 0660);
  }
  return $ok;
}

function auth_login($u,$p) {
  $cfg = app_load_config();
  $ok = ($cfg['admin_user'] ?? '') === $u && password_verify($p, $cfg['admin_pass'] ?? '');
  if ($ok) { $_SESSION['uid'] = $u; $_SESSION['ts'] = time(); }
  return $ok;
}

function auth_require() {
  if (empty($_SESSION['uid'])) { header('Location: /login.php'); exit; }
}

function auth_logout() {
  $_SESSION = [];
  if (ini_get('session.use_cookies')) {
    $p = session_get_cookie_params();
    setcookie(session_name(), '', time()-42000, $p['path'] ?? '/', $p['domain'] ?? '', !empty($p['secure']), !empty($p['httponly']));
  }
  @session_destroy();
}