xamxam/public/admin/parametres.php

<?php
require_once __DIR__ . "/../../config/bootstrap.php";
require_once __DIR__ . '/../../src/AdminAuth.php';
AdminAuth::requireLogin();

$pageTitle = "Paramètres";

$credentialsFile = APP_ROOT . '/config/admin_credentials.php';
$hasPassword     = defined('ADMIN_PASSWORD_HASH');
$maintenanceOn   = file_exists(APP_ROOT . '/storage/maintenance.flag');

if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
?>
<?php $isAdmin = true; $bodyClass = 'admin-body'; require_once APP_ROOT . '/templates/head.php'; ?>
    <?php include APP_ROOT . '/templates/header.php'; ?>

<main id="main-content">
    <h1>Paramètres</h1>

    <?php include APP_ROOT . '/templates/partials/flash-messages.php'; ?>

    <!-- ══════════════════════════════════════════════════════════════
         SECTION 1 — Maintenance
    ══════════════════════════════════════════════════════════════ -->
    <section class="admin-settings-section" aria-labelledby="settings-maintenance-title">
        <h2 class="admin-settings-section__title" id="settings-maintenance-title">Maintenance</h2>

        <div class="admin-maintenance-status <?= $maintenanceOn ? 'admin-maintenance-status--active' : '' ?>">
            <?php if ($maintenanceOn): ?>
                <p class="admin-maintenance-status__msg">
                    <strong>⚠ Mode maintenance activé</strong> — le site public est inaccessible.
                </p>
                <form method="post" action="actions/maintenance.php">
                    <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
                    <input type="hidden" name="action" value="disable_maintenance">
                    <input type="hidden" name="redirect" value="/admin/parametres.php">
                    <button type="submit" class="admin-btn admin-btn--sm">Désactiver la maintenance</button>
                </form>
            <?php else: ?>
                <p class="admin-maintenance-status__msg">
                    Site public : <strong>en ligne</strong>
                </p>
                <form method="post" action="actions/maintenance.php">
                    <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
                    <input type="hidden" name="action" value="enable_maintenance">
                    <input type="hidden" name="redirect" value="/admin/parametres.php">
                    <button type="submit" class="admin-btn admin-btn--sm admin-btn--warning"
                            onclick="return confirm('Mettre le site en maintenance ? Les visiteurs verront une page 503.')">
                        Activer la maintenance
                    </button>
                </form>
            <?php endif; ?>
        </div>
    </section>

    <!-- ══════════════════════════════════════════════════════════════
         SECTION 2 — Compte administrateur
    ══════════════════════════════════════════════════════════════ -->
    <section class="admin-settings-section" aria-labelledby="settings-account-title">
        <h2 class="admin-settings-section__title" id="settings-account-title">Compte administrateur</h2>

        <!-- Status info -->
        <dl class="admin-account-status">
            <div class="admin-account-status__row">
                <dt class="admin-account-status__label">Authentification PHP</dt>
                <dd><?php $badgeType = 'ok'; $badgeValue = $hasPassword; $badgeOkLabel = 'Active'; $badgeWarnLabel = 'Non configurée'; include APP_ROOT . '/templates/partials/status-badge.php'; ?></dd>
            </div>
            <div class="admin-account-status__row">
                <dt class="admin-account-status__label">Fichier de configuration</dt>
                <dd>
                    <code class="admin-account-status__code">config/admin_credentials.php</code>
                    <?php $badgeType = 'ok'; $badgeValue = file_exists($credentialsFile); $badgeOkLabel = 'Présent'; $badgeWarnLabel = 'Absent'; include APP_ROOT . '/templates/partials/status-badge.php'; ?>
                </dd>
            </div>
            <?php if (!$hasPassword): ?>
            <p class="admin-account-status__note">
                Aucun mot de passe PHP configuré. Le formulaire ci-dessous créera
                <code>config/admin_credentials.php</code> avec un hash bcrypt.
            </p>
            <?php endif; ?>
        </dl>

        <!-- Password change form -->
        <h3 class="admin-section-title"><?= $hasPassword ? 'Changer le mot de passe' : 'Définir le mot de passe' ?></h3>

        <form method="post" action="/admin/actions/account.php" class="admin-form" autocomplete="off">
            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
            <input type="hidden" name="redirect" value="/admin/parametres.php">

            <?php if ($hasPassword): ?>
            <div>
                <label for="current_password">Mot de passe actuel</label>
                <div>
                    <input type="password" id="current_password"
                           name="current_password" required autocomplete="current-password">
                </div>
            </div>
            <?php endif; ?>

            <div>
                <label for="new_password">Nouveau mot de passe</label>
                <div>
                    <input type="password" id="new_password"
                           name="new_password" required autocomplete="new-password"
                           minlength="12">
                    <small>Minimum 12 caractères.</small>
                </div>
            </div>

            <div>
                <label for="confirm_password">Confirmer le mot de passe</label>
                <div>
                    <input type="password" id="confirm_password"
                           name="confirm_password" required autocomplete="new-password">
                </div>
            </div>

            <div class="admin-form-footer">
                <button type="submit" class="admin-btn">
                    <?= $hasPassword ? 'Mettre à jour le mot de passe' : 'Définir le mot de passe' ?>
                </button>
            </div>
        </form>

        <?php if ($hasPassword): ?>
        <!-- Danger zone: remove password -->
        <h3 class="admin-section-title admin-section-title--danger">Zone de danger</h3>
        <div class="admin-danger-zone">
            <p class="admin-danger-zone__description">
                <strong>Supprimer la configuration du mot de passe PHP</strong><br>
                <small>
                    Supprime <code>config/admin_credentials.php</code>. L'accès admin
                    dépendra uniquement de l'authentification nginx Basic Auth si elle est configurée.
                </small>
            </p>
            <form method="post" action="/admin/actions/account.php"
                  onsubmit="return confirm('Supprimer le fichier de mot de passe PHP ? L\'accès admin ne sera protégé que par nginx Basic Auth.')">
                <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
                <input type="hidden" name="action" value="remove_credentials">
                <input type="hidden" name="redirect" value="/admin/parametres.php">
                <input type="hidden" name="current_password_remove" id="current_password_remove" value="">
                <button type="submit" class="admin-btn admin-btn--danger">Supprimer le fichier</button>
            </form>
        </div>
        <?php endif; ?>
    </section>
</main>

<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>