feat: require an api key to schedule

web/send-now.html

@@ -103,6 +103,11 @@
         <i class="fa-solid fa-flask me-1"></i> Sandbox mode is active — texts are tagged as a test and excluded from
         cost calculations.
       </div>
+      <div id="noApiKeyBanner" class="alert alert-danger"
+        style="display:none;font-size:0.85rem;font-weight:600;text-align:center;">
+        <i class="fa-solid fa-circle-exclamation me-1"></i> No Clickatell API key configured —
+        <a href="index.html" class="alert-link">set one in Admin settings</a> before sending.
+      </div>
 
       <div class="page-header d-flex align-items-center gap-3">
         <a href="index.html" class="btn btn-sm btn-secondary">
@@ -196,6 +201,7 @@
     const countSpan = document.getElementById('recipientCount');
     const recipientsSel = document.getElementById('recipients');
     const resultEl = document.getElementById('sendResult');
+    let noApiKey = false;
 
     // ── Populate recipients from API ───────────────────────────
     async function loadRecipients() {
@@ -276,7 +282,7 @@
       sectionEl.style.visibility = empty ? 'hidden' : 'visible';
       placeholderEl.style.display = empty ? '' : 'none';
       previewEl.textContent = empty ? '' : previewText(val);
-      sendBtn.disabled = empty;
+      sendBtn.disabled = empty || noApiKey;
       resultEl.style.display = 'none';
     });
 
@@ -333,7 +339,7 @@
         <i class="fa-solid fa-circle-xmark me-2"></i>${esc(err.message)}
       </div>`;
       } finally {
-        sendBtn.disabled = msgEl.value.trim() === '';
+        sendBtn.disabled = msgEl.value.trim() === '' || noApiKey;
         sendBtn.innerHTML = '<i class="fa-solid fa-paper-plane me-2"></i>Send to <span id="recipientCount">' + countSpan.textContent + '</span> attendees';
       }
     });
@@ -384,6 +390,16 @@
     }
     checkAuth();
     document.addEventListener('visibilitychange', () => { if (document.visibilityState === 'visible') checkAuth(); });
+
+    async function checkApiKey() {
+      try {
+        const r = await fetch('/api/settings.php?key=clickatell_api_key').then(res => res.json());
+        noApiKey = !r.set;
+        document.getElementById('noApiKeyBanner').style.display = noApiKey ? '' : 'none';
+        if (noApiKey) document.getElementById('sendBtn').disabled = true;
+      } catch { }
+    }
+    checkApiKey();
   </script>
 </body>