<?php
require_once __DIR__ . '/db.php';

function require_api_key(): void {
    $hdr = $_SERVER['HTTP_AUTHORIZATION'] ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ?? '';
    if (!$hdr && function_exists('apache_request_headers')) {
        $req = apache_request_headers();
        $hdr = $req['Authorization'] ?? $req['authorization'] ?? '';
    }
    if (!preg_match('/Bearer\s+(.+)/', $hdr, $m)) {
        http_response_code(401); exit;
    }

    $hash = hash('sha256', $m[1]);
    global $pdo;

    $q = $pdo->prepare("SELECT 1 FROM api_keys WHERE key_hash=? AND revoked=0");
    $q->execute([$hash]);
    if (!$q->fetch()) {
        http_response_code(403); exit;
    }
}