new api with url request

WEBROOT/api/get.php

@@ -1,40 +1,35 @@
 <?php
-include_once '../controller/DatabaseController.php';
-include_once '../controller/DataController.php';
-include_once __DIR__ . '/../modules/Mail.php';
+include_once(__DIR__ . '/../controller/DatabaseController.php');
+include_once(__DIR__ . '/../controller/DataController.php');
+include_once(__DIR__ . '/../modules/Mail.php');
 
 header("Content-Type: application/json");
 header("Access-Control-Allow-Origin: *");
-header("Access-Control-Allow-Headers: Authorization, Function, Content-Type");
-header("Access-Control-Allow-Methods: POST, GET, OPTIONS");
 
-if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-    http_response_code(200);
-    exit();
+// 1. Daten aus der URL (GET) statt aus dem Header holen
+$token    = $_GET['token'] ?? '';
+$function = $_GET['action'] ?? ''; // Ich habe es 'action' genannt, passend zur URL
+
+// Prüfen, ob überhaupt etwas übergeben wurde
+if (empty($token) || empty($function)) {
+    http_response_code(400);
+    echo json_encode(["error" => "Token oder Action fehlt in der URL"]);
+    exit;
 }
 
-// $validTokens = [
-//     "15a437d128c918633e57dc7d18118a073b807644f21731ed5a7ebcf3eca9e242",
-// ];
-$validTokens = DatabaseShow(
+// 2. Token-Validierung direkt in der Datenbank (Performanter!)
+// Annahme: Deine DatabaseShow kann Filter. Wenn nicht, hier das SQL anpassen.
+$checkToken = DatabaseShow(
     "API_Credentials",
-    "TOKEN"
+    "TOKEN",
+    "TOKEN = ?",
+    $token
 );
 
-$validTokens = array_column($validTokens, 'TOKEN');
-
-$headers = getallheaders();
-$token = $headers['Authorization'] ?? $headers['authorization'] ?? $_SERVER['HTTP_AUTHORIZATION'] ?? '';
-$function = $headers['Function'] ?? $headers['function'] ?? '';
-
-if (!in_array($token, $validTokens)) {
+if (empty($checkToken)) {
     http_response_code(401);
-    $error = json_encode([
-        "error" => "Unauthorized",
-        "debug_received_token" => $token,
-        "debug_all_headers" => $headers
-    ]);
     
+    // Loggen des Fehlversuchs
     DatabaseInsert(
         "API_LOGS",
         "CLIENT_IP, TOKEN, API, FUNKTION, JSON",
@@ -42,60 +37,48 @@ if (!in_array($token, $validTokens)) {
         $token,
         (new getSpecificData())->getRequestURL(),
         $function,
-        $error
+        json_encode(["error" => "Unauthorized"])
     );
 
-    errorMail(
-        "API Login failed",
-        $error,
-        true,
-    );
-
-    echo json_encode(
-        [
-            "error" => "Unauthorized",
-            "Contact" => "bruno.eckhardt07@gmail.com",
-        ]
-    );
+    echo json_encode(["error" => "Zugriff verweigert", "hint" => "Token ungültig"]);
     exit;
 }
 
-if (in_array($token, $validTokens)) {
-    DatabaseInsert(
-        "API_LOGS",
-        "CLIENT_IP, TOKEN, API, FUNKTION",
-        (new getSpecificData())->getClientIP(),
-        $token,
-        (new getSpecificData())->getRequestURL(),
-        $function
-    );
+// 3. Logik-Teil mit switch (sauberer als viele IFs)
+$data = null;
 
-    if ($function === "IPs") {
-        $data = DatabaseShow(
-            "logs",
-            "CLIENT_IP"
-        );
+switch ($function) {
+    case "UeberstundenAbbau":
+        $data = DatabaseShow("Ueberstunden", "DATUM, MINUTEN", "GRUND = ?", "Abbau");
+        break;
+
+    case "UeberstundenAktuell":
+        $conn = db_connect();
+        $sql = "SELECT 
+                    (SELECT COALESCE(SUM(OVERTIME), 0) FROM Firmenberichte) AS berichte,
+                    (SELECT COALESCE(SUM(MINUTEN), 0) FROM Ueberstunden WHERE GRUND = 'Abbau') AS abbau,
+                    (SELECT COALESCE(SUM(MINUTEN), 0) FROM Ueberstunden WHERE GRUND = 'Aufbau') AS aufbau";
+        $res = $conn->query($sql);
+        $row = $res->fetch_object();
+        $data = ($row->berichte - $row->abbau + $row->aufbau) / 60;
+        break;
+
+    case "Berichte":
+        $data = DatabaseShowWithFK("Berufsschulberichte", $Berufsschulberichte);
+        break;
+
+    case "Stundenplan":
+        $data = DatabaseShowWithFK("Stundenplan", $Stundenplan, "ZEITEN, MO, DI, MI, DO, FR");
+        break;
+
+    default:
+        http_response_code(404);
+        echo json_encode(["error" => "Funktion '$function' nicht gefunden"]);
+        exit;
 }
 
-    if ($function === "Ueberstunden") {
-        $data = DatabaseShow(
-            "Ueberstunden",
-            "MINUTEN"
-        );
-    }
-
-    if ($function === "Berichte") {
-        $data = DatabaseShowWithFK(
-            "Berufsschulberichte",
-            $Berufsschulberichte,
-        );
-    }
-    
-    echo json_encode(
-        [
+// 4. Erfolgreiche Antwort
+echo json_encode([
     "success" => true,
-            "data" => $data,
-        ]
-    );
-    exit;
-}
+    "data" => $data
+]);