foto-portfolio/app/bootstrap.php

<?php
/**
 * Application bootstrap. Every public entry script includes this first.
 */

declare(strict_types=1);

define('APP_ROOT', dirname(__DIR__));
define('DATA_DIR', APP_ROOT . '/data');
define('MEDIA_DIR', APP_ROOT . '/media');
define('CONFIG_DIR', APP_ROOT . '/config');

if (!is_file(CONFIG_DIR . '/config.php')) {
    http_response_code(500);
    exit('Missing config/config.php — copy config/config.sample.php and adjust it.');
}

$GLOBALS['config'] = require CONFIG_DIR . '/config.php';

date_default_timezone_set(config('site.timezone', 'UTC'));

require APP_ROOT . '/app/storage.php';
require APP_ROOT . '/app/csrf.php';
require APP_ROOT . '/app/auth.php';
require APP_ROOT . '/app/s3.php';
require APP_ROOT . '/app/markdown.php';
require APP_ROOT . '/app/partials.php';

/**
 * Read a config value by dot path, e.g. config('s3.bucket').
 */
function config(string $path, mixed $default = null): mixed
{
    $value = $GLOBALS['config'];
    foreach (explode('.', $path) as $part) {
        if (!is_array($value) || !array_key_exists($part, $value)) {
            return $default;
        }
        $value = $value[$part];
    }
    return $value;
}

/**
 * Prefix a link or asset path with the way back to the site root, so the shared
 * public partials work from any depth. Pages in the document root need no
 * prefix; pages in a subfolder (gallery/) define SITE_BASE as '../' before
 * including this file. Relative rather than absolute, because the app may be
 * installed in a subdirectory of the domain.
 */
function base(string $path = ''): string
{
    return (defined('SITE_BASE') ? SITE_BASE : '') . $path;
}

/** HTML-escape for output. */
function e(?string $s): string
{
    return htmlspecialchars($s ?? '', ENT_QUOTES, 'UTF-8');
}

/** Start the session with hardened cookie settings (idempotent). */
function session_boot(): void
{
    if (session_status() === PHP_SESSION_ACTIVE) {
        return;
    }
    session_set_cookie_params([
        'lifetime' => 0,
        'path'     => '/',
        'secure'   => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
        'httponly' => true,
        'samesite' => 'Lax',
    ]);
    session_name('fpsid');
    session_start();
}

/** Redirect and stop. */
function redirect(string $url): never
{
    header('Location: ' . $url);
    exit;
}

/** Send a JSON response and stop (used by admin/api.php). */
function json_response(array $payload, int $status = 200): never
{
    http_response_code($status);
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    exit;
}