Skip to content
GitLab

Add admin panel and make API access host-agnostic

Merged Onne Ronda requested to merge features/admin-panel into master

Summary

Adds a config-gated admin panel and removes hardcoded API/self-call assumptions so the app can run cleanly across local dev, beta, and production hosts.

This branch introduces the admin tools requested for user/media maintenance, and refactors server-side API access away from hardcoded 127.0.0.1:81 / production API URLs.

Admin Panel

Routing and Access

  • Adds /?admin route.
  • Uses admin-main.php instead of admin.php.
  • Adds config-based admin access through admin.uids.
  • Adds admin helper functions in lib/auth.php.
  • Adds the admin panel menu link for configured admins:
    • menu.html
    • js/menu.js
    • EN/menu.php
    • HU/menu.php

Layout

  • Adds a full-width admin panel layout.
  • Adds WordPress-style left admin section navigation.
  • Removes the normal right-side stats/ad panel from the admin page.
  • Admin sections:
    • Overview
    • Users
    • Media Control

Overview

  • Adds summary stats for:
    • users
    • media
    • conversion backlog
    • visits
  • Converts Recent Media into a proper table.
  • Makes Recent Media IDs clickable into the admin media edit flow.
  • Converts Top Uploaders into a proper table.
  • Makes uploader UIDs clickable into the admin user edit flow.

User Control

  • Adds user lookup/edit screen.
  • Submitted user search now uses exact matching only:
    • users.uid = ?
    • users.uname = ?
    • users.email = ?
    • LIMIT 1
  • Keeps predictive username suggestions for the search input.
  • Supports editing:
    • username
    • email
    • public email
    • nickname
    • first name
    • last name
    • description
    • delete/ban reason
    • enabled/verified state
    • deleted/banned state
  • Adds avatar controls:
    • upload avatar file
    • set avatar from existing site image
    • remove avatar
  • Adds upload recount action.

Media Control

  • Adds media search/edit screen.
  • Supports filtering by media type.
  • Shows thumbnails/previews in media control.
  • Makes media title and thumbnail link to the public post.
  • Supports editing:
    • title
    • description
    • public flag
    • download flag
    • deleted flag
  • Integrates thumbnail regeneration into Media Control.
  • Removes the separate thumbnail tab as a primary admin section.
  • Keeps tab=thumbs mapped to Media Control for compatibility.
  • Adds encoded-file listing for video media.
  • Adds best-effort video re-encode action using existing upload/conversion logic.

API / Host-Agnostic Refactor

Internal API Layer

Adds lib/api_internal.php with direct internal functions for:

  • media list lookup
  • basic media lookup
  • user info lookup
  • user search
  • view increment
  • video processing/done state
  • resolution format marking

This allows PHP pages to call PHP directly instead of making HTTP calls back into the same site.

Comments Read Layer

Adds lib/comments_read.php for server-side comment payload reads.

Media pages can now load comments directly instead of server-side fetching api/comments.php.

Public API Compatibility

Keeps /api/ working for browser/UI calls.

api/index.php now delegates these endpoints to the internal functions:

  • get=users
  • get=userinfo
  • get=basic
  • get=list
  • set=views
  • set=done

The public API route remains available for browser-side calls and external consumers.

Removed Hardcoded API Origins

Removes app-code dependencies on:

  • 127.0.0.1:81
  • localhost:81
  • https://emalm.com/api
  • https://beta.emalm.com/api

Browser-side calls now use relative /api/... URLs.

Server-side PHP now calls internal functions directly.

Background Conversion Callback

Adds CLI helper:

  • tools/mark-video-done.php

Updates conversion paths:

  • upl/v/formats.php
  • upl/v/process.sh

These now call local PHP directly instead of curling the production API.

Upload / Legacy URL Cleanup

Converts several older browser/upload pages from hardcoded production API URLs to relative routes.

Also adjusts some upload response links to avoid hardcoding production hostnames where practical.

DB / Schema

No database schema changes.

No API schema changes intended.

Safety / Tests

Validated with:

php tests/run.php

Result:

All 91 tests passed.