From 13856e35bcffba72492db499c0413450b11267f4 Mon Sep 17 00:00:00 2001
From: Harwinder Sekhon <hs.sekhon3@gmail.com>
Date: Sat, 11 Jul 2026 11:11:30 -0400
Subject: [PATCH] Fix HTTP 500 on PHP < 8.2: drop standalone true union type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

registerUser() declared `: string|true`; the bare `true` type requires
PHP 8.2, so including auth.php was a fatal error on PHP 8.0/8.1 — every
login/API call returned 500 while install.php (which doesn't include
auth.php) worked. Use string|bool instead. Also install a JSON exception
handler so future server errors surface a message to the SPA instead of
a blank 500.
---
 README.md         |  2 +-
 includes/auth.php |  3 ++-
 includes/db.php   | 13 +++++++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index f69c3af..645d647 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # CourseHub
 
-Self-hosted course video player: PHP 8 + MySQL/MariaDB + Bootstrap 5 + [Plyr](https://github.com/sampotts/plyr).
+Self-hosted course video player: PHP 8.0+ + MySQL/MariaDB + Bootstrap 5 + [Plyr](https://github.com/sampotts/plyr).
 
 Single-page app: `index.php` is a static shell; all navigation, login, browsing,
 playback, and scanning happen over AJAX against the JSON API in `api/`
diff --git a/includes/auth.php b/includes/auth.php
index 6c52e62..cef0c17 100644
--- a/includes/auth.php
+++ b/includes/auth.php
@@ -51,7 +51,8 @@ function attemptLogin(string $username, string $password): bool
     return false;
 }
 
-function registerUser(string $username, string $password): string|true
+/** Returns true on success, or an error-message string. */
+function registerUser(string $username, string $password): string|bool
 {
     if (!preg_match('/^[A-Za-z0-9_.-]{3,50}$/', $username)) {
         return 'Username must be 3-50 characters (letters, digits, _ . -).';
diff --git a/includes/db.php b/includes/db.php
index f72bfe1..e64c4a3 100644
--- a/includes/db.php
+++ b/includes/db.php
@@ -1,6 +1,19 @@
 <?php
 require_once __DIR__ . '/../config.php';
 
+// Uncaught exceptions in web requests become JSON errors (the SPA surfaces
+// them) instead of blank 500 pages; details still go to the PHP error log.
+if (PHP_SAPI !== 'cli') {
+    set_exception_handler(function (Throwable $e): void {
+        error_log($e);
+        http_response_code(500);
+        if (!headers_sent()) {
+            header('Content-Type: application/json');
+        }
+        echo json_encode(['error' => 'Server error: ' . $e->getMessage()]);
+    });
+}
+
 function db(): PDO
 {
     static $pdo = null;