foto-portfolio/admin/gallery-edit.php

<?php
/**
 * Per-gallery editor: settings, share link, proxied bulk uploader
 * (browser → webhost → S3), and image removal.
 */
require dirname(__DIR__) . '/app/bootstrap.php';
auth_require();

$gallery = gallery_load((string)($_GET['g'] ?? ''));
if ($gallery === null) {
    flash_set('Gallery not found.', 'error');
    redirect('galleries.php');
}
$slug = $gallery['slug'];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();
    $action = $_POST['action'] ?? '';

    if ($action === 'settings') {
        $gallery['title'] = trim((string)($_POST['title'] ?? '')) ?: $gallery['title'];
        $gallery['expires_at'] = trim((string)($_POST['expires_at'] ?? '')) ?: null;
        // Unlike the fields above there is no keep-current fallback: the select
        // always posts, and an empty value genuinely means "back to Original".
        $gallery['max_resolution'] = parse_max_resolution($_POST);
        // Same for the checkbox: unticked means it is simply absent from $_POST.
        $gallery['strip_exif'] = !empty($_POST['strip_exif']);
        if (!empty($_POST['remove_password'])) {
            $gallery['password_hash'] = null;
        } elseif (($pw = (string)($_POST['password'] ?? '')) !== '') {
            $gallery['password_hash'] = password_hash($pw, PASSWORD_DEFAULT);
        }
        gallery_save($gallery);
        flash_set('Gallery settings saved.');
        redirect('gallery-edit.php?g=' . rawurlencode($slug));
    }

    if ($action === 'uploads') {
        $mode = (string)($_POST['mode'] ?? '');
        if ($mode === 'enable' && empty($gallery['upload_key'])) {
            $gallery['upload_key'] = random_token(24);
            gallery_save($gallery);
            flash_set('Guest uploads enabled.');
        } elseif ($mode === 'regenerate') {
            $gallery['upload_key'] = random_token(24);
            gallery_save($gallery);
            flash_set('New upload link generated; the old link no longer works.');
        } elseif ($mode === 'disable') {
            $gallery['upload_key'] = null;
            gallery_save($gallery);
            flash_set('Guest uploads disabled.');
        }
        redirect('gallery-edit.php?g=' . rawurlencode($slug));
    }

    if ($action === 'downloads') {
        $gallery['downloads_enabled'] = !empty($_POST['enabled']);
        gallery_save($gallery);
        if ($gallery['downloads_enabled']) {
            // Queue the first build; the background worker picks it up once the
            // gallery has been quiet for archive.settle_seconds.
            archive_mark_dirty($slug, $gallery);
            flash_set('Downloads enabled. The archive will be built in the background.');
        } else {
            archive_delete($slug);
            flash_set('Downloads disabled and the archive removed.');
        }
        redirect('gallery-edit.php?g=' . rawurlencode($slug));
    }

    // Topic management. Assignment is not here: it runs through topics-api.php,
    // because drag-and-drop cannot reload the page after every drop.
    if (str_starts_with($action, 'topic-')) {
        $id = (string)($_POST['id'] ?? '');
        if ($action === 'topic-add') {
            $added = gallery_topic_add($slug, (string)($_POST['name'] ?? ''));
            flash_set(
                $added !== null ? 'Topic "' . $added['name'] . '" added.' : 'Give the topic a name.',
                $added !== null ? 'ok' : 'error'
            );
        } elseif ($action === 'topic-rename') {
            gallery_topic_rename($slug, $id, (string)($_POST['name'] ?? ''));
            flash_set('Topic renamed.');
        } elseif ($action === 'topic-delete') {
            // The images survive; they simply stop belonging to a topic and
            // reappear in the untopiced section at the top.
            gallery_topic_delete($slug, $id);
            flash_set('Topic removed. Its images are now without a topic.');
        } elseif ($action === 'topic-move') {
            gallery_topic_move($slug, $id, (string)($_POST['dir'] ?? ''));
        }
        redirect('gallery-edit.php?g=' . rawurlencode($slug));
    }

    if ($action === 'delete-image') {
        $key = (string)($_POST['key'] ?? '');
        foreach ($gallery['images'] ?? [] as $i => $img) {
            if (($img['key'] ?? '') === $key) {
                s3_delete($img['key']);
                if (!empty($img['thumb'])) {
                    s3_delete($img['thumb']);
                }
                array_splice($gallery['images'], $i, 1);
                gallery_save($gallery);
                // The archive no longer matches the gallery's contents.
                archive_mark_dirty($slug, $gallery);
                flash_set('Image deleted.');
                break;
            }
        }
        redirect('gallery-edit.php?g=' . rawurlencode($slug));
    }
}

// Build the share link from the page the admin is currently on, not from config,
// so it matches whatever host/path this app is actually served under.
$scheme  = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
$host    = $_SERVER['HTTP_HOST'] ?? 'localhost';
// The site root is one directory up from admin/ (cf. the "../gallery/" link below).
$basePath = str_replace('\\', '/', dirname(dirname($_SERVER['SCRIPT_NAME'] ?? '/admin/gallery-edit.php')));
$basePath = rtrim($basePath, '/');
$shareUrl = $scheme . '://' . $host . $basePath . '/gallery/?g=' . rawurlencode($slug);
// Guest upload link (only when a key is set). Same host/path derivation as above.
$uploadUrl = !empty($gallery['upload_key'])
    ? $scheme . '://' . $host . $basePath . '/upload.php?g=' . rawurlencode($slug)
        . '&k=' . rawurlencode($gallery['upload_key'])
    : '';

// Topics split the gallery into sections; a gallery with none renders exactly
// as it did before they existed.
$topics = gallery_topics($gallery);

admin_header($gallery['title'], 'galleries');
flash_render();
?>
<h1><?= e($gallery['title']) ?></h1>
<p class="help" style="margin-bottom:1.5rem">
    Share link: <a href="../gallery/?g=<?= e(rawurlencode($slug)) ?>" target="_blank" rel="noopener"><?= e($shareUrl) ?></a>
</p>

<div class="card">
    <h2 style="margin-top:0">Upload images</h2>
    <?php if ($topics !== []): ?>
        <!-- Uploading straight into a topic; the alternative is assigning a few
             hundred photos one at a time after the fact. -->
        <label for="upload-topic">Upload into</label>
        <select id="upload-topic">
            <option value="">No topic</option>
            <?php foreach ($topics as $topic): ?>
                <option value="<?= e($topic['id']) ?>"><?= e($topic['name']) ?></option>
            <?php endforeach; ?>
        </select>
    <?php endif; ?>
    <div class="dropzone" id="dropzone"
         data-api="api.php"
         data-slug="<?= e($slug) ?>"
         data-csrf="<?= e(csrf_token()) ?>"
         data-thumb-size="<?= (int)config('uploads.thumb_size', 600) ?>"
         data-thumb-quality="<?= e((string)config('uploads.thumb_quality', 0.8)) ?>"
         data-concurrency="<?= (int)config('uploads.concurrency', 3) ?>"
         data-max-resolution="<?= (int)($gallery['max_resolution'] ?? 0) ?>"
         data-resize-quality="<?= e((string)config('uploads.resize_quality', 0.9)) ?>">
        Drop images here or click to select.<br>
        <small>Uploaded through the site to S3, <?= e(upload_treatment_text($gallery)) ?>.</small>
    </div>
    <input type="file" id="file-input" accept="image/*" multiple style="display:none">
    <div class="upload-list" id="upload-list"></div>
</div>

<div class="card">
    <h2 style="margin-top:0">Guest uploads</h2>
    <?php if ($uploadUrl !== ''): ?>
        <p class="help" style="margin-bottom:1rem">
            Share this link so guests can upload into this gallery without an admin
            account. It is key-protected and honors the gallery's password and
            expiry, if set.
        </p>
        <p style="margin-bottom:1rem">
            <a href="<?= e($uploadUrl) ?>" target="_blank" rel="noopener"><?= e($uploadUrl) ?></a>
        </p>
        <form method="post" style="display:inline"
              onsubmit="return confirm('Generate a new link? The current link will stop working.')">
            <?= csrf_field() ?>
            <input type="hidden" name="action" value="uploads">
            <input type="hidden" name="mode" value="regenerate">
            <button style="margin:0">Regenerate link</button>
        </form>
        <form method="post" style="display:inline"
              onsubmit="return confirm('Disable guest uploads? The link will stop working.')">
            <?= csrf_field() ?>
            <input type="hidden" name="action" value="uploads">
            <input type="hidden" name="mode" value="disable">
            <button class="btn-danger" style="margin:0">Disable</button>
        </form>
    <?php else: ?>
        <p class="help" style="margin-bottom:1rem">
            Guest uploads are disabled. Enable them to get a shareable link that
            lets people upload into this gallery without an admin account.
        </p>
        <form method="post">
            <?= csrf_field() ?>
            <input type="hidden" name="action" value="uploads">
            <input type="hidden" name="mode" value="enable">
            <button style="margin:0">Enable guest uploads</button>
        </form>
    <?php endif; ?>
</div>

<?php $status = archive_status($gallery); ?>
<div class="card" id="archive-card"
     data-api="archive-api.php"
     data-slug="<?= e($slug) ?>"
     data-csrf="<?= e(csrf_token()) ?>">
    <h2 style="margin-top:0">Download all</h2>
    <p class="help" style="margin-bottom:1rem">
        Offers visitors a single ZIP of every photo. It is assembled once and
        stored on S3, so the download itself never runs through this webhost —
        and it is rebuilt automatically whenever images are added or removed.
        While a rebuild is pending the button on the gallery is disabled, so
        nobody receives an archive that is missing the newest photos.
    </p>

    <form method="post" style="margin-bottom:1rem">
        <?= csrf_field() ?>
        <input type="hidden" name="action" value="downloads">
        <input type="hidden" name="enabled" value="<?= empty($gallery['downloads_enabled']) ? '1' : '0' ?>">
        <?php if (empty($gallery['downloads_enabled'])): ?>
            <button style="margin:0">Enable downloads</button>
        <?php else: ?>
            <button class="btn-danger" style="margin:0"
                    onclick="return confirm('Disable downloads and delete the archive from S3?')">
                Disable downloads
            </button>
        <?php endif; ?>
    </form>

    <?php if (!empty($gallery['downloads_enabled'])): ?>
        <p id="archive-status" class="help" style="margin-bottom:.6rem">
            <?php if ($status['archive'] && !$status['stale']): ?>
                Ready · <?= e(human_bytes((int)$status['archive']['size'])) ?>
                · <?= (int)$status['archive']['count'] ?> photos
                · built <?= e($status['archive']['built_at']) ?>
            <?php elseif ($status['building']): ?>
                Building — <?= (int)$status['done'] ?> of <?= (int)$status['total'] ?> photos done.
            <?php elseif ($status['queued'] && $status['due_in'] > 0): ?>
                Queued — the rebuild starts in about <?= (int)ceil($status['due_in'] / 60) ?> min.
            <?php elseif ($status['queued']): ?>
                Queued — the rebuild starts shortly.
            <?php elseif ($status['archive']): ?>
                Out of date — the archive does not match the current images.
            <?php else: ?>
                No archive yet.
            <?php endif; ?>
        </p>

        <div id="archive-bar" class="archive-bar" hidden><span></span></div>

        <button id="archive-build" style="margin:0"
                <?= $status['building'] ? 'data-resume="1"' : '' ?>>
            <?= $status['building'] ? 'Resume build' : ($status['archive'] ? 'Rebuild now' : 'Build now') ?>
        </button>
        <button id="archive-cancel" class="btn-ghost" style="margin:0" hidden>Cancel</button>
        <script src="../assets/archive.js" defer></script>
    <?php endif; ?>
</div>

<form method="post" class="card">
    <?= csrf_field() ?>
    <input type="hidden" name="action" value="settings">
    <h2 style="margin-top:0">Settings</h2>
    <label for="t">Title</label>
    <input type="text" id="t" name="title" value="<?= e($gallery['title']) ?>">
    <label for="ex">Expiry date (blank = never)</label>
    <input type="date" id="ex" name="expires_at" value="<?= e($gallery['expires_at'] ?? '') ?>">
    <?php resolution_field(isset($gallery['max_resolution']) ? (int)$gallery['max_resolution'] : null) ?>
    <?php strip_exif_field(!empty($gallery['strip_exif'])) ?>
    <label for="p">Set new password (blank = keep current)</label>
    <input type="text" id="p" name="password" autocomplete="off">
    <?php if (!empty($gallery['password_hash'])): ?>
        <p class="help"><label style="display:inline;text-transform:none;letter-spacing:0">
            <input type="checkbox" name="remove_password" value="1"> Remove password protection
        </label></p>
    <?php endif; ?>
    <button type="submit">Save settings</button>
</form>

<div class="card">
    <h2 style="margin-top:0">Topics</h2>
    <p class="help" style="margin-bottom:1rem">
        Topics split the gallery into sections — the days of a trip, the stops of
        a shoot. They are optional: images without a topic always come first, and
        a gallery with no topics looks exactly as it always did. Guests upload
        into "<?= e(GALLERY_GUEST_TOPIC_NAME) ?>", which appears by itself the
        first time someone uses the guest link.
    </p>
    <?php if ($topics !== []): ?>
        <table style="margin-bottom:1rem">
            <tr><th>Topic</th><th style="width:180px">Order</th><th style="width:90px"></th></tr>
            <?php foreach ($topics as $i => $topic): ?>
            <tr>
                <td>
                    <form method="post" style="display:flex;gap:.5rem;align-items:center"><?= csrf_field() ?>
                        <input type="hidden" name="action" value="topic-rename">
                        <input type="hidden" name="id" value="<?= e($topic['id']) ?>">
                        <input type="text" name="name" value="<?= e($topic['name']) ?>"
                               maxlength="80" style="margin:0;flex:1">
                        <button class="btn-ghost" style="margin:0;padding:.3rem .7rem">Rename</button>
                    </form>
                </td>
                <td>
                    <form method="post" style="display:inline"><?= csrf_field() ?>
                        <input type="hidden" name="action" value="topic-move">
                        <input type="hidden" name="id" value="<?= e($topic['id']) ?>">
                        <input type="hidden" name="dir" value="up">
                        <button class="btn-ghost" style="margin:0;padding:.3rem .7rem" <?= $i === 0 ? 'disabled' : '' ?>>↑</button>
                    </form>
                    <form method="post" style="display:inline"><?= csrf_field() ?>
                        <input type="hidden" name="action" value="topic-move">
                        <input type="hidden" name="id" value="<?= e($topic['id']) ?>">
                        <input type="hidden" name="dir" value="down">
                        <button class="btn-ghost" style="margin:0;padding:.3rem .7rem" <?= $i === count($topics) - 1 ? 'disabled' : '' ?>>↓</button>
                    </form>
                </td>
                <td>
                    <form method="post" style="display:inline"
                          onsubmit="return confirm('Remove this topic? Its images are kept and move back to no topic.')"><?= csrf_field() ?>
                        <input type="hidden" name="action" value="topic-delete">
                        <input type="hidden" name="id" value="<?= e($topic['id']) ?>">
                        <button class="btn-danger" style="margin:0;padding:.3rem .7rem">Delete</button>
                    </form>
                </td>
            </tr>
            <?php endforeach; ?>
        </table>
    <?php endif; ?>
    <form method="post"><?= csrf_field() ?>
        <input type="hidden" name="action" value="topic-add">
        <label for="topic-name">New topic</label>
        <input type="text" id="topic-name" name="name" maxlength="80" placeholder="e.g. Day 1 – Reykjavík">
        <button type="submit">Add topic</button>
    </form>
</div>

<h2>Images (<span id="img-count"><?= count($gallery['images'] ?? []) ?></span>)</h2>
<?php
// Grouped for editing, empty topics included: an empty section is still a drop
// target, and without it a new topic could never receive its first image.
$groups = gallery_groups($gallery, true);
// Position in the flat images array, which is what decides the order inside a
// section. Handed to the browser so a dragged image can be dropped into the
// place the page will show it in after the next reload, rather than at the end.
$order = array_flip(array_column($gallery['images'] ?? [], 'key'));
?>
<div class="topic-blocks" id="topic-blocks"
     data-api="topics-api.php"
     data-slug="<?= e($slug) ?>"
     data-csrf="<?= e(csrf_token()) ?>">
    <?php foreach ($groups as $group): $topic = $group['topic']; ?>
    <section class="topic-block" data-topic="<?= e($topic['id'] ?? '') ?>">
        <?php if ($topics !== []): ?>
            <h3 class="topic-block-head">
                <?= $topic === null ? 'No topic' : e($topic['name']) ?>
                <span class="topic-count"><?= count($group['images']) ?></span>
            </h3>
        <?php endif; ?>
        <div class="thumb-row">
            <?php foreach ($group['images'] as $img): ?>
            <figure draggable="true" data-key="<?= e($img['key']) ?>" data-order="<?= (int)($order[$img['key']] ?? 0) ?>">
                <img src="<?= e(s3_presign_get($img['thumb'] ?? $img['key'])) ?>" alt="" loading="lazy" draggable="false">
                <figcaption title="<?= e($img['name'] ?? '') ?>"><?= e($img['name'] ?? '') ?></figcaption>
                <button type="button" class="thumb-menu-btn" aria-haspopup="true" aria-expanded="false"
                        title="Assign topic or delete">⋯</button>
                <div class="thumb-menu" hidden>
                    <?php if ($topics !== []): ?>
                        <p class="thumb-menu-label">Assign topic</p>
                        <button type="button" class="topic-pick<?= $topic === null ? ' is-current' : '' ?>" data-topic="">No topic</button>
                        <?php foreach ($topics as $t): ?>
                            <button type="button" class="topic-pick<?= ($topic['id'] ?? null) === $t['id'] ? ' is-current' : '' ?>"
                                    data-topic="<?= e($t['id']) ?>"><?= e($t['name']) ?></button>
                        <?php endforeach; ?>
                    <?php else: ?>
                        <p class="thumb-menu-label">Add a topic above to sort images into sections.</p>
                    <?php endif; ?>
                    <!-- Deletion stays a real form post: same server path, same
                         confirmation, and it keeps working without the menu JS. -->
                    <form method="post" onsubmit="return confirm('Delete this image from S3?')">
                        <?= csrf_field() ?>
                        <input type="hidden" name="action" value="delete-image">
                        <input type="hidden" name="key" value="<?= e($img['key']) ?>">
                        <button class="thumb-menu-danger">Delete</button>
                    </form>
                </div>
            </figure>
            <?php endforeach; ?>
        </div>
    </section>
    <?php endforeach; ?>
</div>

<script src="../assets/admin.js"></script>
<script src="../assets/topics.js"></script>
<?php admin_footer(); ?>