Create api/serve.php

api/serve.php

@@ -0,0 +1,95 @@
+<?php
+// ── Parse the username from the URL ──────────────────────────────────────────
+// Expected URL format: https://emalawi19-php-hosting.hf.space/site/username/
+// e.g. /site/alice/index.php → serves /data/sites/alice/htdocs/index.php
+
+$requestUri = $_SERVER['REQUEST_URI'];
+
+// Strip query string
+$path = parse_url($requestUri, PHP_URL_PATH);
+
+// Match /site/{username}/{filepath}
+if (!preg_match('#^/site/([a-z0-9]{3,32})(/.*)?$#', $path, $matches)) {
+    http_response_code(400);
+    echo '<h1>400 Bad Request</h1><p>Invalid site URL format.</p>';
+    echo '<p>Use: /site/username/filename.php</p>';
+    exit;
+}
+
+$username = $matches[1];
+$filePath = $matches[2] ?? '/index.php';
+
+// Default to index.php if only directory requested
+if (substr($filePath, -1) === '/') {
+    $filePath .= 'index.php';
+}
+
+// Sanitise — prevent directory traversal
+$filePath = '/' . implode('/', array_filter(array_map(function($part) {
+    return ($part === '..' || $part === '.') ? '' : $part;
+}, explode('/', $filePath))));
+
+// Check user exists
+$db = new PDO('sqlite:/data/db/platform.sqlite');
+$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+$stmt = $db->prepare('SELECT id FROM users WHERE username = ?');
+$stmt->execute([$username]);
+if (!$stmt->fetch()) {
+    http_response_code(404);
+    echo '<h1>404 Not Found</h1><p>No site found for user: ' . htmlspecialchars($username) . '</p>';
+    exit;
+}
+
+$htdocs   = "/data/sites/{$username}/htdocs";
+$fullPath = $htdocs . $filePath;
+
+if (!file_exists($fullPath)) {
+    http_response_code(404);
+    echo '<h1>404 Not Found</h1><p>File not found: ' . htmlspecialchars($filePath) . '</p>';
+    exit;
+}
+
+// ── Serve static files directly ───────────────────────────────────────────────
+$ext      = strtolower(pathinfo($fullPath, PATHINFO_EXTENSION));
+$mimeTypes = [
+    'html' => 'text/html',
+    'htm'  => 'text/html',
+    'css'  => 'text/css',
+    'js'   => 'application/javascript',
+    'json' => 'application/json',
+    'png'  => 'image/png',
+    'jpg'  => 'image/jpeg',
+    'jpeg' => 'image/jpeg',
+    'gif'  => 'image/gif',
+    'webp' => 'image/webp',
+    'svg'  => 'image/svg+xml',
+    'ico'  => 'image/x-icon',
+    'txt'  => 'text/plain',
+    'pdf'  => 'application/pdf',
+    'woff' => 'font/woff',
+    'woff2'=> 'font/woff2',
+];
+
+if ($ext !== 'php') {
+    $mime = $mimeTypes[$ext] ?? 'application/octet-stream';
+    header("Content-Type: {$mime}");
+    readfile($fullPath);
+    exit;
+}
+
+// ── Execute PHP files ─────────────────────────────────────────────────────────
+// Set environment so the included PHP file feels like it was requested directly
+$_SERVER['DOCUMENT_ROOT']   = $htdocs;
+$_SERVER['SCRIPT_FILENAME'] = $fullPath;
+$_SERVER['SCRIPT_NAME']     = $filePath;
+$_SERVER['PHP_SELF']        = $filePath;
+
+// Change working directory so relative includes work
+chdir($htdocs);
+
+// Buffer and include the PHP file
+ob_start();
+include $fullPath;
+$output = ob_get_clean();
+
+echo $output;