foto-portfolio/app/bootstrap.php

<?php
/**
 * Application bootstrap. Every public entry script includes this first.
 */

declare(strict_types=1);

define('APP_ROOT', dirname(__DIR__));
define('DATA_DIR', APP_ROOT . '/data');
define('MEDIA_DIR', APP_ROOT . '/media');
define('CONFIG_DIR', APP_ROOT . '/config');

if (!is_file(CONFIG_DIR . '/config.php')) {
    http_response_code(500);
    exit('Missing config/config.php — copy config/config.sample.php and adjust it.');
}

$GLOBALS['config'] = require CONFIG_DIR . '/config.php';

// APP_VERSION. Its own file because the release build script rewrites it and
// the manage client reads it back — see app/version.php.
require APP_ROOT . '/app/version.php';

date_default_timezone_set(config('site.timezone', 'UTC'));

require APP_ROOT . '/app/storage.php';
require APP_ROOT . '/app/csrf.php';
require APP_ROOT . '/app/auth.php';
require APP_ROOT . '/app/exif.php';
require APP_ROOT . '/app/s3.php';
require APP_ROOT . '/app/zip.php';
require APP_ROOT . '/app/archive.php';
require APP_ROOT . '/app/migrate.php';
require APP_ROOT . '/app/markdown.php';
require APP_ROOT . '/app/partials.php';
require APP_ROOT . '/app/manage.php';

/**
 * Read a config value by dot path, e.g. config('s3.bucket').
 */
function config(string $path, mixed $default = null): mixed
{
    $value = $GLOBALS['config'];
    foreach (explode('.', $path) as $part) {
        if (!is_array($value) || !array_key_exists($part, $value)) {
            return $default;
        }
        $value = $value[$part];
    }
    return $value;
}

/**
 * Prefix a link or asset path with the way back to the site root, so the shared
 * public partials work from any depth. Pages in the document root need no
 * prefix; pages in a subfolder (gallery/) define SITE_BASE as '../' before
 * including this file. Relative rather than absolute, because the app may be
 * installed in a subdirectory of the domain.
 */
function base(string $path = ''): string
{
    return (defined('SITE_BASE') ? SITE_BASE : '') . $path;
}

/** HTML-escape for output. */
function e(?string $s): string
{
    return htmlspecialchars($s ?? '', ENT_QUOTES, 'UTF-8');
}

/**
 * Byte count as something a client can judge at a glance. Gallery archives run
 * to gigabytes, so the size belongs on the download button itself.
 */
function human_bytes(int $bytes): string
{
    $units = ['B', 'KB', 'MB', 'GB', 'TB'];
    $i = 0;
    $value = (float)$bytes;
    while ($value >= 1024 && $i < count($units) - 1) {
        $value /= 1024;
        $i++;
    }
    return ($value >= 10 || $i === 0 ? round($value) : round($value, 1)) . ' ' . $units[$i];
}

/** Start the session with hardened cookie settings (idempotent). */
function session_boot(): void
{
    if (session_status() === PHP_SESSION_ACTIVE) {
        return;
    }
    session_set_cookie_params([
        'lifetime' => 0,
        'path'     => '/',
        'secure'   => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
        'httponly' => true,
        'samesite' => 'Lax',
    ]);
    session_name('fpsid');
    session_start();
}

/**
 * URL of a script in this installation, for the server to call itself.
 *
 * site.base_url is preferred when it has been filled in, because it does not
 * depend on the request's Host header. Otherwise the URL is derived from the
 * current request, mapping APP_ROOT against DOCUMENT_ROOT so an app installed
 * in a subdirectory still resolves. Null means the URL cannot be determined —
 * the caller then has to do the work inline instead of dispatching it.
 */
function self_url(string $pathAndQuery): ?string
{
    $configured = rtrim((string)config('site.base_url', ''), '/');
    if ($configured !== '' && !str_contains($configured, 'example.com')) {
        return $configured . $pathAndQuery;
    }

    $host = (string)($_SERVER['HTTP_HOST'] ?? '');
    $root = rtrim(str_replace('\\', '/', (string)($_SERVER['DOCUMENT_ROOT'] ?? '')), '/');
    $app  = str_replace('\\', '/', APP_ROOT);
    if ($host === '' || $root === '' || !str_starts_with($app, $root)) {
        return null;
    }
    $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
    return $scheme . '://' . $host . rtrim(substr($app, strlen($root)), '/') . $pathAndQuery;
}

/**
 * Fire a request at one of this installation's own background scripts and hang
 * up without waiting for it. Those scripts set ignore_user_abort(), so they run
 * on regardless.
 *
 * A timeout is the expected, successful outcome: it means the request was
 * delivered and the script is busy with it. A *completed* response only counts
 * as success if it is the script's own 204 — anything else (a 404 from a wrong
 * key or a misconfigured base URL) means nothing is running, and saying so lets
 * the caller fall back to doing the work inline instead of silently stalling.
 */
function self_dispatch(?string $url, int $timeoutMs = 1000): bool
{
    if ($url === null || !function_exists('curl_init')) {
        return false;
    }
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER    => true,
        CURLOPT_NOSIGNAL          => true,
        CURLOPT_CONNECTTIMEOUT_MS => $timeoutMs,
        CURLOPT_TIMEOUT_MS        => $timeoutMs,
    ]);
    curl_exec($ch);
    $errno = curl_errno($ch);
    $status = (int)curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    return $errno === CURLE_OPERATION_TIMEOUTED || ($errno === 0 && $status === 204);
}

/** Redirect and stop. */
function redirect(string $url): never
{
    header('Location: ' . $url);
    exit;
}

/** Send a JSON response and stop (used by admin/api.php). */
function json_response(array $payload, int $status = 200): never
{
    http_response_code($status);
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    exit;
}