From 1d7b4d7abdc8b73164a4c44ad4a7074f1734d4a4 Mon Sep 17 00:00:00 2001
From: Protocolbot <protocolbot@medlab.host>
Date: Mon, 6 Jul 2026 15:05:13 -0600
Subject: [PATCH] fix: strip base path in API router for subdirectory
 deployments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The API router's parse_path() only stripped /api from the URI, but
when deployed in a subdirectory (e.g. /protocol-droid/), the URI is
/protocol-droid/api/auth/register — the /api regex didn't match.
Now detects base path from SCRIPT_NAME and strips it before routing.
---
 api/index.php | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/api/index.php b/api/index.php
index 7920248..de49fec 100644
--- a/api/index.php
+++ b/api/index.php
@@ -57,6 +57,18 @@ function respond(int $code, array $data): void {
 function parse_path(): array {
     $uri = $_SERVER['REQUEST_URI'] ?? '/';
     $path = parse_url($uri, PHP_URL_PATH);
+
+    // Detect and strip the base path (for subdirectory deployments)
+    $scriptName = $_SERVER['SCRIPT_NAME'] ?? '/index.php';
+    // SCRIPT_NAME for /protocol-droid/api/index.php is /protocol-droid/api/index.php
+    // Go up two levels to get the base path: dirname(dirname(...)) = /protocol-droid
+    $basePath = rtrim(str_replace('\\', '/', dirname(dirname($scriptName))), '/');
+    if ($basePath === '/' || $basePath === '.') $basePath = '';
+    if ($basePath && strpos($path, $basePath) === 0) {
+        $path = substr($path, strlen($basePath));
+    }
+
+    // Strip /api prefix
     $path = preg_replace('#^/api#', '', $path);
     $path = trim($path, '/');
     return $path === '' ? [] : explode('/', $path);