initial prototype based on nat-as-server

handlers/session.php

@@ -0,0 +1,44 @@
+<?php
+
+/**
+ * GET /api/session — verify Bearer token is still active and return role metadata.
+ */
+
+if ($method !== 'GET') {
+    json_error('METHOD_NOT_ALLOWED', 'Method not allowed', 405);
+}
+
+$token = get_bearer_token();
+if (!$token) {
+    json_error('UNAUTHORIZED', 'Missing Bearer token', 401);
+}
+
+$rec = token_get_record($token);
+if (!$rec) {
+    json_error('UNAUTHORIZED', 'Invalid or expired token', 401);
+}
+
+$role = (string)($rec['role'] ?? '');
+
+$username = '';
+if (($rec['userID'] ?? '') !== '') {
+    try {
+        $opened = qdb_open_read_or_fail();
+        [$pdo, $tmpDb, $lockFp] = $opened;
+        $stmt = $pdo->prepare('SELECT username FROM users WHERE userID = :uid');
+        $stmt->execute([':uid' => $rec['userID']]);
+        $row = $stmt->fetchColumn();
+        $username = $row !== false ? (string)$row : '';
+        qdb_discard($tmpDb, $lockFp);
+    } catch (Throwable $e) {
+        qdb_handler_fail($e, 'Session check', null, $tmpDb ?? null, $lockFp ?? null);
+    }
+}
+
+json_success([
+    'valid'              => true,
+    'user'               => $username,
+    'role'               => $role,
+    'userID'             => $rec['userID'] ?? '',
+    'mustChangePassword' => !empty($rec['temp']),
+]);