First cut of log on page (#9)

- Add session support
- Refactor security handling to use db connection
- Fix db path issue

src/start.php

@@ -14,6 +14,12 @@ require 'user-config.php';
 
 Data::ensureDb();
 
+session_start([
+    'name'            => 'FRCSESSION',
+    'use_strict_mode' => true,
+    'cookie_httponly' => true,
+    'cookie_samesite' => 'Strict']);
+
 /**
  * Add a message to be displayed at the top of the page
  *
@@ -59,20 +65,20 @@ function page_head(string $title): void {
 <header>
     <a class=title href="/">Feed Reader Central</a>
     <div><?php
-        if (array_key_exists(Key::USER_ID, $_REQUEST)) {
-            echo '<a href=/feed?id=new>Add Feed</a>';
-            if ($_REQUEST[Key::USER_EMAIL] != 'solouser@example.com') echo " | {$_REQUEST[Key::USER_EMAIL]}";
+        if (array_key_exists(Key::USER_ID, $_SESSION)) {
+            echo '<a href=/feed?id=new>Add Feed</a> | <a href=/user/log-off>Log Off</a>';
+            if ($_SESSION[Key::USER_EMAIL] != Security::SINGLE_USER_EMAIL) echo " | {$_SESSION[Key::USER_EMAIL]}";
+        } else {
+            echo '<a href=/user/log-on>Log On</a>';
         } ?>
     </div>
 </header>
 <main hx-target=this><?php
-    if (array_key_exists(Key::USER_MSG, $_REQUEST)) {
-        foreach ($_REQUEST[Key::USER_MSG] as $msg) { ?>
-            <div>
-                <?=$msg['level'] == 'INFO' ? '' : "<strong>{$msg['level']}</strong><br>"?>
-                <?=$msg['message']?>
-            </div><?php
-        }
+    foreach ($_REQUEST[Key::USER_MSG] ?? [] as $msg) { ?>
+        <div>
+            <?=$msg['level'] == 'INFO' ? '' : "<strong>{$msg['level']}</strong><br>"?>
+            <?=$msg['message']?>
+        </div><?php
     }
 }
 
@@ -81,6 +87,7 @@ function page_head(string $title): void {
  */
 function page_foot(): void {
     ?></main></body></html><?php
+    session_commit();
 }
 
 /**
@@ -94,8 +101,8 @@ function frc_redirect(string $value): void {
         http_response_code(400);
         die();
     }
-    header("Location: $value");
-    http_response_code(303);
+    session_commit();
+    header("Location: $value", true, 303);
     die();
 }