REST API — File-Based

<?php
// File: api/device/list.php
// Endpoint: /api/device/list — Mode 1: EVERY HTTP method hits this ONE handler.
// The variable name MUST match basename($file, '.php') → 'list'

use ZealPHP\G;

$list = function() {
    // $this is the ZealAPI instance. Because Mode 1 doesn't split GET/POST
    // into separate closures, use the helper to tell which verb came in:
    $method = $this->get_request_method();   // 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH'

    if ($method === 'POST') {
        $g = G::instance();
        return ['created' => true, 'method' => $method, 'body' => $g->post];
    }

    // default (GET, HEAD, …)
    return [
        'devices' => [['id' => 1, 'name' => 'Sensor A'], ['id' => 2, 'name' => 'Sensor B']],
        'method'  => $method,
    ];
};

<?php
$get = function() {
    return ['users' => [['id' => 1, 'name' => 'Alice']]];
};

$post = function() {
    return ['created' => true, 'id' => 3];
};

// PUT, DELETE, PATCH → automatic 405 Method Not Allowed
// HEAD → auto-derived from $get (body stripped by framework)
// OPTIONS → auto-generated Allow header

<?php
$list = function() {
    return [
        'products' => [
            ['id' => 1, 'name' => 'Widget', 'price' => 9.99],
            ['id' => 2, 'name' => 'Gadget', 'price' => 24.99],
        ],
        'total' => 2,
    ];
};
// → {"products": [...], "total": 2}

<?php
// File: api/user/show.php  →  /api/user/show
// Canonical convention: the closure variable name matches the filename
// (basename without .php). One handler serves EVERY HTTP method — branch
// on the verb with $this->get_request_method() if you need to.
use ZealPHP\RequestContext;

${basename(__FILE__, '.php')} = function($request, $response) {
    // ZealAPI's dispatcher injects these by parameter name (reflection-cached):
    //   $request  → ZealPHP\HTTP\Request  (wrapped OpenSwoole request; alias: $req)
    //   $response → ZealPHP\HTTP\Response (wrapped OpenSwoole response; alias: $res)
    //   $app      → ZealPHP\App instance  (the main application instance)
    //   $server   → \OpenSwoole\Http\Server (raw OpenSwoole server handle)
    //   $this     → ZealAPI instance      (handler runs inside Closure::bind)
    // Any other named parameter receives its default value (or null if none).

    // Pull a query param via the injected request — the cleanest form:
    $id = $request->get['id'] ?? null;
    //                  ^ ZealPHP\HTTP\Request->get is the OpenSwoole-parsed
    //                    query array (per-request, NOT the $_GET superglobal).

    if (!$id) return 400;                      // int return = HTTP status (universal contract)

    // Need $g (session, cookies, server vars)? Grab it explicitly:
    $g = RequestContext::instance();
    if (empty($g->session['user'])) return 401;

    return ['user' => User::find($id)];        // array return = JSON body (universal contract)
};

<?php
$stream = function() {
    return (function() {
        yield '{"events":[';
        $first = true;
        foreach (Event::cursor() as $event) {
            if (!$first) yield ',';
            yield json_encode($event->toArray());
            $first = false;
        }
        yield ']}';
    })();
};

App::middlewareAlias('auth', fn() => new BasicAuthMiddleware($verifier));

App::when('/api/admin', ['auth', 'admin-only']);  // every api/admin/*.php endpoint
App::when('/api',       ['request-id']);          // the whole /api/* surface

$middleware = ['confirm-token'];   // runs after App::when('/api/admin')['auth']

$delete = function () {
    return ['deleted' => true];
};

<?php
use ZealPHP\App;

require __DIR__ . '/vendor/autoload.php';

// Register the three hooks ONCE during boot. ZealPHP doesn't care what
// auth system you use — it just asks you. Callbacks run on each
// requirePostAuth() / isAuthenticated() / isAdmin() / getUsername() call,
// so you can read $_SESSION / $g->session / a JWT header / a global —
// whatever lives at the moment the API handler dispatches.
// Canonical: read via $g — works in BOTH App::superglobals modes.
App::authChecker(fn(): bool       => !empty(\ZealPHP\G::instance()->session['user_id']));
App::adminChecker(fn(): bool      => (\ZealPHP\G::instance()->session['role'] ?? '') === 'admin');
App::usernameProvider(fn(): ?string => \ZealPHP\G::instance()->session['username'] ?? null);

$app = App::init('0.0.0.0', 8080);
$app->run();

<?php
// File: api/device/delete.php — handler filters by method internally
$delete = function() {
    // POST + authenticated guard. Sends 403 JSON and returns false if
    // either check fails — short-circuits the handler.
    if (!$this->requirePostAuth()) return;

    // Admin-only operation? Compose checks naturally:
    if (!$this->isAdmin()) {
        return $this->response($this->json(['error' => 'admin_only']), 403);
    }

    $username = $this->getUsername();   // for audit log
    $g = \ZealPHP\G::instance();        // per-coroutine; safe in both modes
    User::delete($g->post['id'], $username);
    return ['ok' => true];
};

<?php
// File: task/backup.php
// The variable name must match basename → 'backup'

use function ZealPHP\elog;

$backup = function($db_name, $output_dir) {
    elog("Starting backup of $db_name to $output_dir");

    // Heavy work here — runs in task worker, not HTTP worker
    $file = "$output_dir/$db_name-" . date('Ymd-His') . ".sql";
    exec("mysqldump $db_name > $file");

    return ['status' => 'done', 'file' => $file];
};

use ZealPHP\App;

$app->route('/admin/backup', ['methods' => ['POST']], function() {
    // Dispatch to task worker (non-blocking)
    App::getServer()->task([
        'handler' => '/task/backup',
        'args'    => ['my_database', '/backups'],
    ]);

    return ['queued' => true, 'message' => 'Backup started in background'];
});

$app->run([
    'task_worker_num' => 4,            // 4 dedicated task workers
    'task_enable_coroutine' => true,   // Coroutines in task workers (default)
]);