revise backend

Web/includes/auth.php

@@ -0,0 +1,28 @@
+<?php
+/** Shared session checks. Database, form and session keys retain their legacy names. */
+function requireLogin(string $loginUrl): void {
+    if (session_status() !== PHP_SESSION_ACTIVE) {
+        session_start();
+    }
+    if (!isset($_SESSION['uname'])) {
+        header('Location: ' . $loginUrl);
+        exit;
+    }
+}
+
+function hasPermission(string $permission): bool {
+    return !empty($_SESSION[$permission]);
+}
+
+function requirePermission(string $permission, string $message): void {
+    if (!hasPermission($permission)) {
+        http_response_code(403);
+        exit($message);
+    }
+}
+
+function isPasswordValid(string $password): bool {
+    return strlen($password) >= 8
+        && preg_match('/[0-9]/', $password) === 1
+        && preg_match('/[A-Z]/', $password) === 1;
+}