MovieLog_Server/lib/auth.php

<?php
// ============================================
// 文件: lib/auth.php
// 说明: 登录校验与管理员账号管理
// ============================================

// 登录检查
function checkLogin() {
    if (!isset($_SESSION['admin_id'])) {
        header('Location: login.php');
        exit;
    }
}

// 获取当前管理员（含关联观影人信息）
function getCurrentAdmin() {
    if (isset($_SESSION['admin_id'])) {
        $db = getDB();
        $stmt = $db->prepare("
            SELECT a.*, p.id as person_id, p.name as person_name, p.color as person_color, p.avatar as person_avatar
            FROM admins a
            LEFT JOIN persons p ON a.person_id = p.id
            WHERE a.id = ?
        ");
        $stmt->execute([$_SESSION['admin_id']]);
        return $stmt->fetch();
    }
    return null;
}

// 获取所有管理员（含关联观影人）
function getAllAdmins() {
    $db = getDB();
    $stmt = $db->query("
        SELECT a.id, a.username, a.avatar, a.person_id, p.name as person_name
        FROM admins a
        LEFT JOIN persons p ON a.person_id = p.id
        ORDER BY a.id
    ");
    return $stmt->fetchAll();
}

// 添加管理员（支持关联观影人）
function addAdmin($username, $password, $avatar = null, $person_id = null) {
    $db = getDB();
    $stmt = $db->prepare("SELECT COUNT(*) FROM admins WHERE username = ?");
    $stmt->execute([$username]);
    if ($stmt->fetchColumn() > 0) return false;
    $hashed = password_hash($password, PASSWORD_DEFAULT);
    $stmt = $db->prepare("INSERT INTO admins (username, password, avatar, person_id) VALUES (?, ?, ?, ?)");
    return $stmt->execute([$username, $hashed, $avatar, $person_id]);
}

// 删除管理员
function deleteAdmin($id) {
    $db = getDB();
    $stmt = $db->query("SELECT COUNT(*) FROM admins");
    if ($stmt->fetchColumn() <= 1) return false;
    if ($id == $_SESSION['admin_id']) return false;
    $stmt = $db->prepare("DELETE FROM admins WHERE id = ?");
    return $stmt->execute([$id]);
}

// 更新管理员的观影人关联
function updateAdminPersonId($admin_id, $person_id) {
    $db = getDB();
    $stmt = $db->prepare("UPDATE admins SET person_id = ? WHERE id = ?");
    return $stmt->execute([$person_id, $admin_id]);
}

// 保存某个账号的界面主题（key 必须是 lib/theme.php 注册表里的）。
// 同时更新 session，这样同一个请求后面渲染页面时就已经是新主题了。
// 失败返回 false（非法 key、账号不存在、库报错都算失败）。
function setAdminTheme($admin_id, $theme_key) {
    $admin_id = (int)$admin_id;
    if ($admin_id <= 0 || !isValidTheme($theme_key)) {
        return false;
    }
    $db = getDB();
    $stmt = $db->prepare("UPDATE admins SET theme = ? WHERE id = ?");
    if (!$stmt->execute([$theme_key, $admin_id]) || $stmt->rowCount() <= 0) {
        // rowCount 为 0 时可能是「账号不存在」，也可能是「主题没变」——后者不算失败
        $chk = $db->prepare("SELECT theme FROM admins WHERE id = ?");
        $chk->execute([$admin_id]);
        $rows = $chk->fetchAll();     // fetchAll：避免留下未读完的游标（会挂共享读锁）
        if (!$rows || (string)($rows[0]['theme'] ?? '') !== $theme_key) {
            return false;
        }
    }
    if ((int)($_SESSION['admin_id'] ?? 0) === $admin_id) {
        $_SESSION['admin_theme'] = $theme_key;
    }
    return true;
}