<?php
/**
 * API bootstrap: session-based auth for same-origin PWA requests.
 */
if (!isset($pdo)) {
    require_once __DIR__ . '/../config/app.php';
    require_once __DIR__ . '/../config/database.php';
}
require_once __DIR__ . '/../includes/session-bootstrap.php';
nazareth_bootstrap_session_cookie();
session_start();
require_once __DIR__ . '/../includes/auth.php';

header('Content-Type: application/json; charset=utf-8');

function requireApiAuth() {
    if (!empty($_SESSION['user_id'])) return;
    http_response_code(401);
    echo json_encode(['error' => 'Unauthorized']);
    exit;
}

function requireApiPermission($permission) {
    requireApiAuth();
    if (function_exists('can') && can($permission)) return;
    http_response_code(403);
    echo json_encode(['error' => 'Forbidden']);
    exit;
}
