CourseHub: AJAX video course player (PHP + MySQL + Bootstrap + Plyr)

Scans nested course folders for mp4s, tracks per-user resume position
and per-folder progress. SPA frontend with hash routing over a JSON API;
range-request streaming via stream.php.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

includes/auth.php

@@ -0,0 +1,70 @@
+<?php
+require_once __DIR__ . '/db.php';
+
+if (session_status() === PHP_SESSION_NONE) {
+    session_start();
+}
+
+function currentUserId(): ?int
+{
+    return isset($_SESSION['user_id']) ? (int)$_SESSION['user_id'] : null;
+}
+
+function currentUsername(): ?string
+{
+    return $_SESSION['username'] ?? null;
+}
+
+function requireLogin(): int
+{
+    $uid = currentUserId();
+    if ($uid === null) {
+        header('Location: login.php');
+        exit;
+    }
+    return $uid;
+}
+
+function requireLoginApi(): int
+{
+    $uid = currentUserId();
+    if ($uid === null) {
+        http_response_code(401);
+        header('Content-Type: application/json');
+        echo json_encode(['error' => 'Not logged in']);
+        exit;
+    }
+    return $uid;
+}
+
+function attemptLogin(string $username, string $password): bool
+{
+    $stmt = db()->prepare('SELECT id, username, password_hash FROM users WHERE username = ?');
+    $stmt->execute([$username]);
+    $user = $stmt->fetch();
+    if ($user && password_verify($password, $user['password_hash'])) {
+        session_regenerate_id(true);
+        $_SESSION['user_id']  = (int)$user['id'];
+        $_SESSION['username'] = $user['username'];
+        return true;
+    }
+    return false;
+}
+
+function registerUser(string $username, string $password): string|true
+{
+    if (!preg_match('/^[A-Za-z0-9_.-]{3,50}$/', $username)) {
+        return 'Username must be 3-50 characters (letters, digits, _ . -).';
+    }
+    if (strlen($password) < 6) {
+        return 'Password must be at least 6 characters.';
+    }
+    $stmt = db()->prepare('SELECT id FROM users WHERE username = ?');
+    $stmt->execute([$username]);
+    if ($stmt->fetch()) {
+        return 'That username is already taken.';
+    }
+    $stmt = db()->prepare('INSERT INTO users (username, password_hash) VALUES (?, ?)');
+    $stmt->execute([$username, password_hash($password, PASSWORD_DEFAULT)]);
+    return true;
+}