<?php

/**
 * Admin session keepalive — lightweight liveness ping.
 *
 * Called periodically by admin-session-keepalive.js while an admin page stays
 * open and the admin is genuinely interacting with it (typing/clicking/scrolling).
 *
 * Without this, `AdminAuth::enforceSessionTimeout()` only refreshed
 * `admin_last_activity` on navigations and HTMX requests. An admin spending
 * >IDLE_TIMEOUT_SECONDS entering data in an open form (a long encoding session)
 * issued no requests and was logged out mid-work.
 *
 * This endpoint calls `isAuthenticated()`, which runs the same timeout
 * enforcement and, on success, refreshes the activity timestamp. A truly idle
 * tab never pings (the client only pings after real interaction), so the idle
 * timeout still applies.
 *
 * Responses:
 *   204 — authenticated, activity refreshed (or no password configured: dev).
 *   401 — not authenticated: the client should redirect to the login page.
 */
require_once __DIR__ . '/../../bootstrap.php';
require_once __DIR__ . '/../../src/AdminAuth.php';

if (!AdminAuth::isAuthenticated()) {
    http_response_code(401);
    exit;
}

http_response_code(204);
exit;