foto-portfolio/admin/galleries.php

<?php
/**
 * Gallery overview: create new galleries, list and delete existing ones.
 */
require dirname(__DIR__) . '/app/bootstrap.php';
auth_require();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();
    $action = $_POST['action'] ?? '';

    if ($action === 'create') {
        $title = trim((string)($_POST['title'] ?? ''));
        if ($title === '') {
            flash_set('Please enter a gallery title.', 'error');
            redirect('galleries.php');
        }
        $slug = slugify($title) . '-' . random_token(6);
        $password = (string)($_POST['password'] ?? '');
        $gallery = [
            'slug'          => $slug,
            'title'         => $title,
            'created_at'    => date('Y-m-d H:i:s'),
            'password_hash' => $password !== '' ? password_hash($password, PASSWORD_DEFAULT) : null,
            'expires_at'    => trim((string)($_POST['expires_at'] ?? '')) ?: null,
            // Longest edge the browser downscales uploads to; null = original.
            'max_resolution' => parse_max_resolution($_POST),
            // Drop EXIF/XMP/IPTC from uploads on the way to S3 (app/exif.php).
            'strip_exif'    => !empty($_POST['strip_exif']),
            'images'        => [],
        ];
        // A guest upload link is just a per-gallery secret in the URL; presence
        // of upload_key = guest uploads enabled (revocable from the edit page).
        if (!empty($_POST['allow_uploads'])) {
            $gallery['upload_key'] = random_token(24);
        }
        gallery_save($gallery);
        flash_set('Gallery created. Now add images.');
        redirect('gallery-edit.php?g=' . rawurlencode($slug));
    }

    if ($action === 'delete') {
        $gallery = gallery_load((string)($_POST['slug'] ?? ''));
        if ($gallery !== null) {
            s3_delete_gallery_objects($gallery);
            gallery_delete($gallery['slug']);
            flash_set('Gallery and its S3 images deleted.');
        }
        redirect('galleries.php');
    }
}

$galleries = galleries_all();

admin_header('Galleries', 'galleries');
flash_render();
?>
<h1>Galleries</h1>

<form method="post" class="card">
    <?= csrf_field() ?>
    <input type="hidden" name="action" value="create">
    <h2 style="margin-top:0">New gallery</h2>
    <label for="t">Title</label>
    <input type="text" id="t" name="title" placeholder="Wedding Miller — June 2026" required>
    <label for="p">Password <span style="text-transform:none;letter-spacing:0">(optional — leave blank for a public link)</span></label>
    <input type="text" id="p" name="password" autocomplete="off">
    <label for="ex">Expiry date <span style="text-transform:none;letter-spacing:0">(optional — gallery is hidden after this day)</span></label>
    <input type="date" id="ex" name="expires_at">
    <?php resolution_field() ?>
    <?php strip_exif_field() ?>
    <p class="help"><label style="display:inline;text-transform:none;letter-spacing:0">
        <input type="checkbox" name="allow_uploads" value="1"> Allow guest uploads via a shared link
    </label></p>
    <button type="submit">Create gallery</button>
</form>

<h2>Existing galleries (<?= count($galleries) ?>)</h2>
<?php if (!$galleries): ?>
    <p class="help">No galleries yet.</p>
<?php else: ?>
<div class="card"><table>
    <tr><th>Title</th><th>Images</th><th>Views</th><th>Downloads</th><th>Attributes</th><th>Expires</th><th>Created</th><th style="width:200px">Actions</th></tr>
    <?php foreach ($galleries as $g):
        $expired = gallery_is_expired($g);
        $stats = gallery_stats($g['slug']);
    ?>
    <tr>
        <td><?= e($g['title']) ?></td>
        <td><?= count($g['images'] ?? []) ?></td>
        <td title="<?= $stats['last_viewed_at'] ? 'Last opened ' . e($stats['last_viewed_at']) : 'Never opened' ?>">
            <?= $stats['views'] ?>
        </td>
        <td title="<?= $stats['last_download_at'] ? 'Last download ' . e($stats['last_download_at']) : 'Never downloaded' ?>">
            <?php /* "—" only while downloads never ran: a count survives them being switched off. */ ?>
            <?= empty($g['downloads_enabled']) && $stats['downloads'] === 0 ? '—' : $stats['downloads'] ?>
        </td>
        <td>
            <?= !empty($g['password_hash']) ? '<span class="tag tag-lock">password</span>' : '<span class="tag">open</span>' ?>
            <?= !empty($g['upload_key']) ? ' <span class="tag">uploads</span>' : '' ?>
            <?= isset($g['max_resolution']) ? ' <span class="tag">' . e(resolution_label((int)$g['max_resolution'])) . '</span>' : '' ?>
            <?= !empty($g['strip_exif']) ? ' <span class="tag">no exif</span>' : '' ?>
        </td>
        <td>
            <?= e($g['expires_at'] ?? '—') ?>
            <?= $expired ? ' <span class="tag tag-expired">expired</span>' : '' ?>
        </td>
        <td><?= e(substr($g['created_at'] ?? '', 0, 10)) ?></td>
        <td>
            <a href="gallery-edit.php?g=<?= e(rawurlencode($g['slug'])) ?>">Edit</a> ·
            <a href="../gallery/?g=<?= e(rawurlencode($g['slug'])) ?>" target="_blank" rel="noopener">View ↗</a>
            <form method="post" style="display:inline"
                  onsubmit="return confirm('Delete this gallery AND all its images on S3? This cannot be undone.')">
                <?= csrf_field() ?>
                <input type="hidden" name="action" value="delete">
                <input type="hidden" name="slug" value="<?= e($g['slug']) ?>">
                <button class="btn-danger" style="margin:0;padding:.25rem .7rem">Delete</button>
            </form>
        </td>
    </tr>
    <?php endforeach; ?>
</table></div>
<?php endif; ?>
<?php admin_footer(); ?>