feat: require an api key to schedule

web/api/db.php

@@ -61,3 +61,16 @@ function error_out(string $message, int $status = 400): never
 {
     json_out(['error' => $message], $status);
 }
+
+/**
+ * Aborts with 400 if no Clickatell API key has been configured.
+ */
+function require_api_key(): void
+{
+    $stmt = db()->prepare("SELECT setting_value FROM `system` WHERE setting_name = 'clickatell_api_key'");
+    $stmt->execute();
+    $key = $stmt->fetchColumn();
+    if ($key === false || trim((string) $key) === '') {
+        error_out('No Clickatell API key is configured. Set one in Admin → Clickatell Settings before sending or scheduling messages.', 400);
+    }
+}

web/api/schedule.php

@@ -42,6 +42,8 @@ function handle_get(): never
 
 function handle_post(): never
 {
+    require_api_key();
+
     $body       = json_body();
     $templateId = (int) ($body['template_id'] ?? 0);
     $mode       = (string) ($body['mode'] ?? '');
@@ -104,6 +106,8 @@ function handle_post(): never
 
 function handle_put(): never
 {
+    require_api_key();
+
     $id = (int) ($_GET['id'] ?? 0);
     if ($id <= 0) {
         error_out('Missing or invalid id');

web/api/send-now.php

@@ -16,6 +16,8 @@ if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
 // }
 
 try {
+    require_api_key();
+
     $body       = json_body();
     $customBody = trim((string) ($body['message'] ?? ''));
     $templateId = isset($body['template_id']) ? (int) $body['template_id'] : null;