- Public display

public/api.php

@@ -8,6 +8,10 @@ try {
     $method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
 
     if ($method === 'GET' && $action === 'state') {
+        if (!app_private_tools_enabled()) {
+            json_response(['error' => 'Private tracker/admin tools are disabled for this public site.'], 403);
+            exit;
+        }
         json_response(state_payload($_GET));
         exit;
     }
@@ -23,6 +27,31 @@ try {
     }
 
     $data = json_input();
+    $adminActions = [
+        'create_user' => true,
+        'update_user' => true,
+        'delete_user' => true,
+        'refresh_medication_sources' => true,
+    ];
+    $trackerActions = [
+        'update_theme' => true,
+        'create_exercise' => true,
+        'create_supplement' => true,
+        'create_nutrition_goal' => true,
+        'create_routine' => true,
+        'create_workout' => true,
+        'update_workout' => true,
+        'create_nutrition_log' => true,
+        'create_supplement_log' => true,
+        'create_body_metric' => true,
+        'create_medication_log' => true,
+        'create_vital_log' => true,
+        'create_lab_result' => true,
+        'create_symptom_log' => true,
+        'create_allergy_record' => true,
+        'create_appointment' => true,
+        'create_immunization_record' => true,
+    ];
     $routes = [
         'create_user' => 'create_user',
         'update_user' => 'update_user',
@@ -52,6 +81,16 @@ try {
         exit;
     }
 
+    if (isset($adminActions[$action]) && !app_admin_area_enabled()) {
+        json_response(['error' => 'Admin tools are disabled for this public site.'], 403);
+        exit;
+    }
+
+    if (isset($trackerActions[$action]) && !app_tracker_area_enabled()) {
+        json_response(['error' => 'Tracker tools are disabled for this public site.'], 403);
+        exit;
+    }
+
     json_response($routes[$action]($data));
 } catch (InvalidArgumentException $exception) {
     json_response(['error' => $exception->getMessage()], 400);