File manager

File manager - Edit - /home/webapp69.cm.in.th/u69319090037/Shop/api/api/api.php

Back
<?php /** * REST API Controller * CMTC Shopping / require_once __DIR__ . '/../config/db.php'; require_once __DIR__ . '/../functions/helpers.php'; $database = new Database(); $db = $database->getConnection(); $route = $_GET['route'] ?? ''; // Simple Token-based Auth validation function validate_token($db) { $headers = getallheaders(); $auth_header = $headers['Authorization'] ?? $headers['authorization'] ?? ''; if (preg_match('/Bearer\s(\S+)/', $auth_header, $matches)) { $token = $matches[1]; // Decode token. Format: base64(username:user_id) $decoded = base64_decode($token); if ($decoded) { $parts = explode(':', $decoded); if (count($parts) === 2) { $username = $parts[0]; $user_id = intval($parts[1]); // Confirm against DB $stmt = $db->prepare("SELECT id, username, role_id FROM users WHERE id = ? AND username = ? AND status = 'active' LIMIT 1"); $stmt->execute([$user_id, $username]); $user = $stmt->fetch(); if ($user) { return $user; } } } } return false; } // Route Router switch ($route) { case 'login': if ($_SERVER['REQUEST_METHOD'] !== 'POST') { api_response(false, "Method not allowed", [], 405); } $input = json_decode(file_get_contents('php://input'), true); $username = trim($input['username'] ?? ''); $password = $input['password'] ?? ''; if (empty($username) \|\| empty($password)) { api_response(false, "Username and password required", [], 400); } $stmt = $db->prepare("SELECT FROM users WHERE username = ? LIMIT 1"); $stmt->execute([$username]); $user = $stmt->fetch(); if ($user && password_verify($password, $user['password'])) { if ($user['status'] !== 'active') { api_response(false, "Account is disabled", [], 403); } // Generate a simple token: base64(username:user_id) $token = base64_encode($user['username'] . ':' . $user['id']); api_response(true, "Authentication successful", [ 'token' => $token, 'user' => [ 'id' => $user['id'], 'username' => $user['username'], 'firstname' => $user['firstname'], 'lastname' => $user['lastname'], 'email' => $user['email'], 'role_id' => $user['role_id'] ] ]); } else { api_response(false, "Invalid credentials", [], 401); } break; case 'products': if ($_SERVER['REQUEST_METHOD'] !== 'GET') { api_response(false, "Method not allowed", [], 405); } $stmt = $db->query("SELECT id, sku, name, price, promo_price, status FROM products WHERE status = 'active' ORDER BY id DESC"); $products = $stmt->fetchAll(); api_response(true, "Products fetched successfully", $products); break; case 'orders': if ($_SERVER['REQUEST_METHOD'] !== 'GET') { api_response(false, "Method not allowed", [], 405); } $user = validate_token($db); if (!$user) { api_response(false, "Unauthorized", [], 401); } $stmt = $db->prepare("SELECT id, order_no, total_amount, net_amount, status, created_at FROM orders WHERE user_id = ? ORDER BY id DESC"); $stmt->execute([$user['id']]); $orders = $stmt->fetchAll(); api_response(true, "Orders fetched successfully", $orders); break; case 'profile': if ($_SERVER['REQUEST_METHOD'] !== 'GET') { api_response(false, "Method not allowed", [], 405); } $user = validate_token($db); if (!$user) { api_response(false, "Unauthorized", [], 401); } // Fetch detailed profile $stmt = $db->prepare(" SELECT u.id, u.username, u.prefix, u.firstname, u.lastname, u.email, u.phone, u.avatar, r.name as role_name, d.name as department_name, u.created_at FROM users u JOIN user_roles r ON u.role_id = r.id LEFT JOIN departments d ON u.department_id = d.id WHERE u.id = ? LIMIT 1 "); $stmt->execute([$user['id']]); $profile = $stmt->fetch(); api_response(true, "Profile fetched successfully", $profile); break; case 'get_ai_recommendations': $gender = $_POST['gender'] ?? 'female'; $occasion = $_POST['occasion'] ?? 'wedding'; $size = $_POST['size'] ?? 'M'; // Build dynamic search patterns $gender_keywords = []; if ($gender === 'female') { $gender_keywords = ['สตรี', 'หญิง', 'เดรส', 'ราตรี', 'กระโปรง', 'dress', 'skirt', 'lady', 'woman']; } elseif ($gender === 'male') { $gender_keywords = ['บุรุษ', 'ชาย', 'สูท', 'คอปก', 'เชิ้ต', 'กางเกง', 'suit', 'shirt', 'men', 'man']; } $occasion_keywords = []; if ($occasion === 'wedding') { $occasion_keywords = ['แต่งงาน', 'วิวาห์', 'wedding', 'เจ้าสาว', 'เจ้าบ่าว', 'เพื่อนเจ้าสาว']; } elseif ($occasion === 'gala') { $occasion_keywords = ['ราตรี', 'กาล่า', 'gala', 'หรู', 'premium', 'luxury']; } elseif ($occasion === 'party') { $occasion_keywords = ['ปาร์ตี้', 'สังสรรค์', 'party', 'เลื่อม', 'ฉลอง']; } elseif ($occasion === 'casual') { $occasion_keywords = ['ทำงาน', 'สุภาพ', 'casual', 'เที่ยว', 'สบาย']; } // Fetch active products $sql = "SELECT p.*, c.name as category_name, (SELECT image_path FROM product_images WHERE product_id = p.id ORDER BY is_main DESC, id ASC LIMIT 1) as main_image, (SELECT GROUP_CONCAT(size_name) FROM product_sizes WHERE product_id = p.id) as sizes FROM products p LEFT JOIN categories c ON p.category_id = c.id WHERE p.status = 'active'"; $stmt = $db->query($sql); $all_products = $stmt->fetchAll(); $recommended = []; foreach ($all_products as $prod) { $score = 0; $name_desc = mb_strtolower($prod['name'] . ' ' . $prod['description'] . ' ' . ($prod['category_name'] ?? '')); // Score based on gender foreach ($gender_keywords as $kw) { if (mb_strpos($name_desc, mb_strtolower($kw)) !== false) { $score += 5; } } // Score based on occasion foreach ($occasion_keywords as $kw) { if (mb_strpos($name_desc, mb_strtolower($kw)) !== false) { $score += 8; } } // Match size (bonus score if the recommended size is available) if (!empty($prod['sizes'])) { $prod_sizes = array_map('trim', explode(',', mb_strtoupper($prod['sizes']))); if (in_array(mb_strtoupper($size), $prod_sizes)) { $score += 10; } } $prod['match_score'] = $score; $recommended[] = $prod; } // Sort by score descending, limit to 6 products usort($recommended, function($a, $b) { return $b['match_score'] <=> $a['match_score']; }); $recommended = array_slice($recommended, 0, 6); header('Content-Type: application/json'); echo json_encode(['success' => true, 'data' => $recommended]); exit(); case 'upload': if ($_SERVER['REQUEST_METHOD'] !== 'POST') { api_response(false, "Method not allowed", [], 405); } $type = $_POST['type'] ?? 'products'; $allowed_types = ['products', 'news', 'slips', 'avatars', 'general']; if (!in_array($type, $allowed_types)) { $type = 'products'; } if (!isset($_FILES['file']) && !isset($_FILES['image'])) { api_response(false, "No file uploaded (use 'file' or 'image' field)", [], 400); } $file = $_FILES['file'] ?? $_FILES['image']; $prefix = ($type === 'products') ? 'prod' : substr($type, 0, 4); $result = upload_image($file, $type, $prefix); if ($result['success']) { api_response(true, "Image uploaded successfully", [ 'filename' => $result['filename'], 'path' => $result['relative_path'], 'url' => $result['url'] ]); } else { api_response(false, $result['error'], [], 400); } break; default: api_response(false, "API route not found", [], 404); break; } ?>

| ver. 1.4 | Github | . | PHP 7.4.33 | Generation time: 0.23 | proxy | phpinfo | Settings