Files
xamxam/app/public/admin/toast-fragment.php
Pontoporeia d588ae004d Reintroduce TFE duration metadata: DB columns, form fields, controllers, views, and migration
Add 'unsafe-eval' to CSP script-src directives (htmx requires Function())
2026-06-15 15:56:52 +02:00

28 lines
841 B
PHP

<?php
/**
* Toast fragment endpoint — HTMX target.
*
* Reads flash messages from the session and returns the toast markup.
* Returns an empty 204 when there is nothing to show.
* Called via hx-get on the #toast-region aside in the admin footer.
*/
require_once __DIR__ . '/../../bootstrap.php';
require_once __DIR__ . '/../../src/AdminAuth.php';
// Don't redirect unauthenticated requests — just return empty (defense-in-depth).
// The toast-region poll fires on <hx-trigger="load">; if the user is on the
// login page they are not authenticated yet.
if (!AdminAuth::isAuthenticated()) {
http_response_code(204);
exit;
}
$flash = App::consumeFlash();
if (!$flash['error'] && !$flash['success'] && !$flash['warning']) {
http_response_code(204);
exit;
}
include APP_ROOT . '/templates/admin/partials/toast.php';