<?php
declare(strict_types=1);
header('Content-Type: application/json');

require_once __DIR__ . '/../lib/auth.php';
require_once __DIR__ . '/../lib/hash.php';

require_https();

if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
    http_response_code(405);
    echo json_encode(['error' => 'method not allowed']);
    exit;
}

if (!rate_limit_check()) {
    http_response_code(429);
    echo json_encode(['error' => 'too many failed attempts, try again later']);
    exit;
}

$pw = password_from_request();
if ($pw === null || $pw === '' || !verify_password($pw)) {
    rate_limit_fail();
    http_response_code(401);
    echo json_encode(['error' => 'invalid password']);
    exit;
}
rate_limit_reset();

$offset = max(0, (int)($_GET['offset'] ?? 0));
$count  = (int)($_GET['count'] ?? 0);   // omit / 0 → all (back-compat)
if ($count > 0) $count = min($count, 100); // cap page size

echo json_encode(paginate_videos(true, $offset, $count), JSON_PRETTY_PRINT);