<?php
// Minimal stand-in for Supabase GoTrue /auth/v1/user so the REAL includes/auth.php
// runs unmodified: it verifies the token over HTTP exactly as it does in production.
$h = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
if (!preg_match('/Bearer\s+(.+)/i', $h, $m)) { http_response_code(401); echo '{"msg":"no token"}'; exit; }
$parts = explode('.', $m[1]);
$payload = json_decode(base64_decode(strtr($parts[1] ?? '', '-_', '+/')), true);
if (empty($payload['sub'])) { http_response_code(401); echo '{"msg":"bad token"}'; exit; }
header('Content-Type: application/json');
echo json_encode(['id' => $payload['sub'], 'role' => 'authenticated']);
