Backoffice: PHP admin web UI for licenses, versions, audit

Self-contained admin under /PS_Launcher/admin/ on the same OVH host. No
JS framework, no Composer deps — just PHP 8.3 + sessions + a small CSS.

Auth & infrastructure
---------------------
- admin/lib/Auth.php: session + CSRF helper. Login via password_hash /
  password_verify. session_regenerate_id on successful login.
  config.example.php gains admin_password_hash, generated by:
  php -r "echo password_hash('PWD', PASSWORD_DEFAULT);"
- admin/lib/Layout.php: shared header/footer/nav, formatBytes,
  csrfField helpers.
- admin/.htaccess: noindex / X-Frame-Options DENY / X-Content-Type
  nosniff / blocks lib/*.php from web access.
- admin/assets/style.css: matches launcher's dark theme — same
  Brush.* palette mapped to CSS vars, vivid green/blue/amber status
  pills consistent with the WPF UI.

Pages
-----
- index.php (Dashboard): KPIs (active/expired/revoked licenses, machines
  seen 30d, validations 24h), manifest signature status, last 10
  audit_log entries.
- licenses.php: full CRUD.
  * Émettre: owner, expiration date, max machines, internal notes →
    generates a PRSRV-XXXX-XXXX-XXXX-XXXX key, displays it ONCE in a
    green callout (DB stores the key; the message stays only on this
    request, never shown again).
  * Prolonger (per-row, expandable form), Revoke / Unrevoke,
    Reset machines (frees all slots for that license).
  * Status badge: active / expired / revoked.
- versions.php: edit the manifest from the web.
  * Add a version: number + release date + minLicenseDate + release
    notes Markdown (creates releasenotes/{version}.md). Sets default
    download URL to {base_url}/builds/proserve-{version}.zip.
  * Per-row Méta (edit minLicenseDate / releasedAt), Notes (edit md
    inline), toggle availableForDownload, Delete entry.
  * 🔁 Sync (sign-manifest) button: shells out to
    `php tools/sign-manifest.php` and shows its stdout — recomputes
    sha256/sizeBytes for every uploaded ZIP, bumps `latest`, signs
    Ed25519. Visual indicators on each row: zip presence, hash
    computed yes/no, signature status.
  * Lists orphan ZIPs in builds/ that no manifest entry references.
- audit.php: paginated audit_log viewer (100/page) with event-type
  filter dropdown. JOINs licenses to show owner_name. Color-codes
  events (validate_ok green, expired amber, invalid/revoked red).

Server README rewritten to document the full setup flow:
1. Create MySQL DB, run migrations/001_init.sql
2. Copy config.example.php → config.php, fill db credentials
3. php tools/generate-keypair.php → paste into config.php and into the
   client's Resources/server-pubkey.txt
4. Set admin_password_hash in config.php
5. Login at /PS_Launcher/admin/

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/admin/lib/Auth.php

@@ -0,0 +1,74 @@
+<?php
+declare(strict_types=1);
+
+namespace PSLauncher\Admin;
+
+final class Auth
+{
+    public static function start(): void
+    {
+        if (session_status() === PHP_SESSION_NONE) {
+            session_set_cookie_params([
+                'lifetime' => 0,
+                'path'     => '/',
+                'secure'   => !empty($_SERVER['HTTPS']),
+                'httponly' => true,
+                'samesite' => 'Lax',
+            ]);
+            session_name('PSLAUNCHER_ADMIN');
+            session_start();
+        }
+        if (!isset($_SESSION['csrf'])) $_SESSION['csrf'] = bin2hex(random_bytes(32));
+    }
+
+    public static function isLoggedIn(): bool
+    {
+        return !empty($_SESSION['admin']);
+    }
+
+    public static function login(string $username, string $password, array $config): bool
+    {
+        $hash = $config['admin_password_hash'] ?? '';
+        if ($hash === '') return false;
+        if (!password_verify($password, $hash)) return false;
+
+        $_SESSION['admin'] = ['user' => $username, 'at' => time()];
+        // régénère l'ID après login pour éviter session fixation
+        session_regenerate_id(true);
+        $_SESSION['csrf'] = bin2hex(random_bytes(32));
+        return true;
+    }
+
+    public static function logout(): void
+    {
+        $_SESSION = [];
+        if (ini_get('session.use_cookies')) {
+            $p = session_get_cookie_params();
+            setcookie(session_name(), '', time() - 3600, $p['path'], $p['domain'] ?? '', $p['secure'], $p['httponly']);
+        }
+        session_destroy();
+    }
+
+    public static function requireLogin(): void
+    {
+        self::start();
+        if (!self::isLoggedIn()) {
+            header('Location: login.php');
+            exit;
+        }
+    }
+
+    public static function csrfToken(): string
+    {
+        return $_SESSION['csrf'] ?? '';
+    }
+
+    public static function checkCsrf(): void
+    {
+        $token = $_POST['csrf'] ?? '';
+        if (!hash_equals($_SESSION['csrf'] ?? '', $token)) {
+            http_response_code(403);
+            die('CSRF token invalid');
+        }
+    }
+}

server/admin/lib/Layout.php

@@ -0,0 +1,84 @@
+<?php
+declare(strict_types=1);
+
+namespace PSLauncher\Admin;
+
+final class Layout
+{
+    public static function header(string $title, string $active = ''): void
+    {
+        Auth::start();
+        $isLoggedIn = Auth::isLoggedIn();
+        $titleEsc = htmlspecialchars($title);
+        $nav = $isLoggedIn ? self::navHtml($active) : '';
+        echo <<<HTML
+<!DOCTYPE html>
+<html lang="fr">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex,nofollow">
+<title>{$titleEsc} — PS_Launcher Admin</title>
+<link rel="stylesheet" href="assets/style.css">
+</head>
+<body>
+{$nav}
+<main>
+HTML;
+    }
+
+    public static function footer(): void
+    {
+        echo "</main></body></html>";
+    }
+
+    private static function navHtml(string $active): string
+    {
+        $items = [
+            'dashboard' => ['index.php',    'Dashboard'],
+            'licenses'  => ['licenses.php', 'Licenses'],
+            'versions'  => ['versions.php', 'Versions'],
+            'audit'     => ['audit.php',    'Audit'],
+        ];
+        $links = '';
+        foreach ($items as $k => [$href, $label]) {
+            $cls  = ($k === $active) ? 'active' : '';
+            $links .= sprintf(
+                '<a href="%s" class="%s">%s</a>',
+                htmlspecialchars($href),
+                $cls,
+                htmlspecialchars($label)
+            );
+        }
+        return <<<HTML
+<nav>
+  <strong class="brand">PS_Launcher Admin</strong>
+  {$links}
+  <span class="spacer"></span>
+  <a href="logout.php" class="logout">Déconnexion</a>
+</nav>
+HTML;
+    }
+
+    public static function flash(?string $msg, string $type = 'success'): void
+    {
+        if ($msg === null || $msg === '') return;
+        $cls = $type === 'error' ? 'error' : 'success';
+        echo "<div class='flash {$cls}'>" . nl2br(htmlspecialchars($msg)) . "</div>";
+    }
+
+    public static function csrfField(): string
+    {
+        return '<input type="hidden" name="csrf" value="' . htmlspecialchars(Auth::csrfToken()) . '">';
+    }
+
+    public static function formatBytes(int $bytes): string
+    {
+        if ($bytes <= 0) return '—';
+        $units = ['o', 'Ko', 'Mo', 'Go', 'To'];
+        $u = 0;
+        $v = (float)$bytes;
+        while ($v >= 1024 && $u < count($units) - 1) { $v /= 1024; $u++; }
+        return number_format($v, 1) . ' ' . $units[$u];
+    }
+}