div TODOs

app/lib/_sql.php

@@ -8,11 +8,19 @@ class SQL {
     public $cnt_get = 0;
     public $cnt_set = 0;
     public function __construct() {
-        require_once ('secret.php');
+        if (defined('DB_HOST') && defined('DB_USER') && defined('DB_PASS') && defined('DB_NAME')) {
+            $this->m = [
+                'host' => DB_HOST,
+                'user' => DB_USER,
+                'pass' => DB_PASS,
+                'data' => DB_NAME
+            ];
+        } else {
+            require_once ('secret.php');
+            $this->m = $_m;
+        }
 
-        $this->m = $_m;
-
-        $this->h = new mysqli ( $_m ['host'], $_m ['user'], $_m ['pass'], $_m ['data'] );
+        $this->h = new mysqli ( $this->m ['host'], $this->m ['user'], $this->m ['pass'], $this->m ['data'] );
         if ($this->h->connect_errno) {
             return false;
         }
@@ -171,4 +179,4 @@ class SQL {
     // echo 'DESTROY';
   }
 }
-?>
+?>

app/lib/auth.php

@@ -2,82 +2,60 @@
 /**
  * app/lib/auth.php
  *
- * Single-User-Authentifizierung
- * - Login / Logout
- * - Session-Check
- * - Optional: Passwortschutz für Admin-Tool
- *
- * KEIN Mehrbenutzer-System
+ * Single-user authentication helpers.
  */
 
-/* =========================
- * Login prüfen
- * ========================= */
-
-/**
- * Prüft, ob der Benutzer eingeloggt ist
- *
- * @return bool
- */
 function isAuthenticated(): bool
 {
-    // TODO: Session-Variable definieren, z.B. $_SESSION['auth'] === true
+    if (!defined('AUTH_REQUIRED') || AUTH_REQUIRED === false) {
+        return true;
+    }
+
     return isset($_SESSION['auth']) && $_SESSION['auth'] === true;
 }
 
-/* =========================
- * Login durchführen
- * ========================= */
-
-/**
- * Führt einen Login durch
- *
- * @param string $password
- * @return bool
- */
 function login(string $password): bool
 {
-    // TODO: Passwort aus config.php vergleichen
-    // TODO: Passwort-Hash verwenden (password_hash / password_verify)
+    $hash = defined('ADMIN_PASSWORD_HASH') ? trim((string)ADMIN_PASSWORD_HASH) : '';
+    if ($hash === '') {
+        return false;
+    }
 
-    /*
-    if (password_verify($password, ADMIN_PASSWORD_HASH)) {
+    if (password_verify($password, $hash)) {
         $_SESSION['auth'] = true;
+        $_SESSION['auth_at'] = time();
         return true;
     }
-    */
 
     return false;
 }
 
-/* =========================
- * Logout
- * ========================= */
-
-/**
- * Loggt den Benutzer aus
- */
 function logout(): void
 {
-    // TODO: Session-Variablen löschen
-    // unset($_SESSION['auth']);
+    unset($_SESSION['auth'], $_SESSION['auth_at']);
 
-    // TODO: Optional komplette Session zerstören
-    // session_destroy();
+    if (session_status() === PHP_SESSION_ACTIVE) {
+        session_regenerate_id(true);
+    }
 }
 
-/* =========================
- * Zugriff erzwingen
- * ========================= */
-
-/**
- * Erzwingt Login, sonst Redirect
- */
 function requireAuth(): void
 {
+    if (!defined('AUTH_REQUIRED') || AUTH_REQUIRED === false) {
+        return;
+    }
+
     if (!isAuthenticated()) {
-        // TODO: Redirect auf Login-Seite
-        // header('Location: /login.php');
+        $isApiRequest = str_starts_with($_SERVER['REQUEST_URI'] ?? '', '/api/');
+        if ($isApiRequest) {
+            http_response_code(401);
+            header('Content-Type: application/json');
+            echo json_encode(['error' => 'Nicht authentifiziert']);
+            exit;
+        }
+
+        $target = defined('LOGIN_PATH') ? LOGIN_PATH : '/login.php';
+        header('Location: ' . $target);
         exit;
     }
 }