<?php
session_start(); if(empty($_SESSION['admin'])){ http_response_code(401); exit('No auth'); }
$dir = __DIR__.'/../uploads/'; @mkdir($dir,0775,true);
function save_file($key,$allow){
  if(empty($_FILES[$key]['name'])) return null;
  $f=$_FILES[$key]; if($f['error']!==UPLOAD_ERR_OK) return null;
  $ext=strtolower(pathinfo($f['name'],PATHINFO_EXTENSION));
  if(!in_array($ext,$allow)) return null;
  $name=uniqid('',true).'.'.$ext;
  if(!move_uploaded_file($f['tmp_name'],$GLOBALS['dir'].$name)) return null;
  return 'uploads/'.$name;
}
