api/register.php

<?php
header('Content-Type: application/json');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(204);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['error' => 'Method not allowed']);
    exit;
}

$input = json_decode(file_get_contents('php://input'), true);
$username = trim($input['username'] ?? '');

// Validate username
if (!preg_match('/^[a-z0-9]{3,32}$/', $username)) {
    http_response_code(400);
    echo json_encode(['error' => 'Username must be 3-32 lowercase letters and numbers only']);
    exit;
}

// Reserved words blacklist
$reserved = ['api','www','mail','admin','root','static','assets','blog','app'];
if (in_array($username, $reserved)) {
    http_response_code(400);
    echo json_encode(['error' => 'That username is reserved']);
    exit;
}

// Connect to SQLite
$db = new PDO('sqlite:/data/db/platform.sqlite');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

// Check if username already exists
$stmt = $db->prepare('SELECT id FROM users WHERE username = ?');
$stmt->execute([$username]);
if ($stmt->fetch()) {
    http_response_code(409);
    echo json_encode(['error' => 'Username already taken']);
    exit;
}

// Create the user's site directory
$htdocs = "/data/sites/{$username}/htdocs";
if (!mkdir($htdocs, 0755, true)) {
    http_response_code(500);
    echo json_encode(['error' => 'Failed to create site directory']);
    exit;
}
chown($htdocs, 'www-data');

// Create a default index.php for the user
file_put_contents("{$htdocs}/index.php", "<?php\necho '<h1>Welcome, {$username}!</h1>';\necho '<p>Edit this file to build your site.</p>';\n");

// Save user to database
$stmt = $db->prepare('INSERT INTO users (username) VALUES (?)');
$stmt->execute([$username]);

echo json_encode([
    'success' => true,
    'username' => $username,
    'message' => 'Site created successfully'
]);