<?php
// Backwards-compatible: vega-data only checks the HTTP status code,
// so adding fields to the payload is safe. The fapi PHPSessionMiddleware
// reads the user fields below to bridge PHP sessions into Python without
// requiring a re-login during the PHP→Python migration.
require_once('../utils.php');

configure_session_lifetime(12);

if (session_status() == PHP_SESSION_NONE) {
    session_start();
}

header('Content-Type: application/json; charset=utf-8');

if (isset($_SESSION['email']) && trim((string)$_SESSION['email']) !== '') {
    http_response_code(200);
    // Identification fields PHP actually stores in $_SESSION on login
    // (set by index.php). The fapi PHPSessionMiddleware uses `usid` to do
    // its own DB lookup for role/avatar/etc — fields PHP doesn't track.
    echo json_encode([
        'ok'        => true,
        'usid'      => isset($_SESSION['usid']) ? (int)$_SESSION['usid'] : 0,
        'email'     => (string)$_SESSION['email'],
        'firstname' => (string)($_SESSION['firstname'] ?? ''),
        'lastname'  => (string)($_SESSION['lastname'] ?? ''),
    ]);
    exit;
}

http_response_code(403);
echo json_encode(['ok' => false, 'error' => 'connect']);