Initial commit

admin/api/customer-orders.php

@@ -0,0 +1,15 @@
+<?php
+require_once __DIR__ . '/../../includes/auth.php';
+header('Content-Type: application/json');
+if (!AdminAuth::isLoggedIn()) { echo json_encode(['error'=>'Unauthorized']); exit; }
+$cid = trim($_GET['customer_id'] ?? '');
+if (!$cid) { echo json_encode(['error'=>'No customer ID','orders'=>[]]); exit; }
+try {
+    $orders = db()->fetchAll(
+        "SELECT order_id, order_number, total, order_status, payment_status, items, shipping_address, tracking_number, created_at FROM orders WHERE customer_id = :id ORDER BY created_at DESC",
+        ['id' => $cid]
+    );
+    echo json_encode(['success'=>true,'orders'=>$orders]);
+} catch (Exception $e) {
+    echo json_encode(['error'=>$e->getMessage(),'orders'=>[]]);
+}

admin/api/upload-splash.php

@@ -0,0 +1,29 @@
+<?php
+require_once __DIR__ . '/../includes/header.php';
+header('Content-Type: application/json');
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST' || empty($_FILES['image'])) {
+    echo json_encode(['error' => 'No file received']); exit;
+}
+
+$file = $_FILES['image'];
+$allowed = ['image/jpeg','image/png','image/gif','image/webp'];
+if (!in_array($file['type'], $allowed)) {
+    echo json_encode(['error' => 'Invalid type. Use JPG, PNG, WebP or GIF.']); exit;
+}
+if ($file['size'] > 5 * 1024 * 1024) {
+    echo json_encode(['error' => 'File too large (max 5 MB).']); exit;
+}
+
+$dir = __DIR__ . '/../../uploads/splashes/';
+if (!is_dir($dir)) mkdir($dir, 0755, true);
+
+$ext  = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
+$name = 'splash_' . time() . '_' . bin2hex(random_bytes(4)) . '.' . $ext;
+$path = $dir . $name;
+
+if (move_uploaded_file($file['tmp_name'], $path)) {
+    echo json_encode(['success' => true, 'url' => '/uploads/splashes/' . $name]);
+} else {
+    echo json_encode(['error' => 'Could not save file.']);
+}