<?php
/**
 * FilePond remove endpoint — soft-deletes an already-saved thesis_files row.
 *
 * DELETE /admin/actions/filepond/remove.php
 * Body: JSON { "db_id": 123 }
 *
 * Called when a user removes an existing file in edit mode via FilePond UI.
 */

require_once __DIR__ . '/../../../../bootstrap.php';
require_once __DIR__ . '/../../../../src/AdminAuth.php';
require_once __DIR__ . '/../../../../src/ErrorHandler.php';

AdminAuth::requireLogin();

// ── CSRF via header ──────────────────────────────────────────────────────
$csrfHeader = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
if (!isset($_SESSION['csrf_token'])
    || !hash_equals($_SESSION['csrf_token'], $csrfHeader)) {
    http_response_code(403);
    die('Token CSRF invalide.');
}

// ── Only accept DELETE ───────────────────────────────────────────────────
if ($_SERVER['REQUEST_METHOD'] !== 'DELETE') {
    http_response_code(405);
    die('Méthode non autorisée.');
}

// ── Parse JSON body ──────────────────────────────────────────────────────
$body = json_decode(file_get_contents('php://input'), true);
$dbId = filter_var($body['db_id'] ?? '', FILTER_VALIDATE_INT);

if ($dbId === false || $dbId <= 0) {
    http_response_code(400);
    die('ID de fichier invalide.');
}

// ── Look up and soft-delete ──────────────────────────────────────────────
require_once APP_ROOT . '/src/Database.php';
$db = new Database();

$pdo  = $db->getConnection();
$stmt = $pdo->prepare('SELECT * FROM thesis_files WHERE id = ?');
$stmt->execute([$dbId]);
$fileRow = $stmt->fetch();

if (!$fileRow) {
    http_response_code(404);
    die('Fichier introuvable.');
}

// ── Move physical file to _trash/ for recovery ───────────────────────────
$filePath = $fileRow['file_path'] ?? '';
if ($filePath !== ''
    && !str_starts_with($filePath, 'peertube_ids:')
    && !str_starts_with($filePath, 'http://')
    && !str_starts_with($filePath, 'https://')) {

    $absPath = STORAGE_ROOT . '/' . $filePath;
    if (file_exists($absPath)) {
        $trashDir = STORAGE_ROOT . '/tmp/_trash';
        if (!is_dir($trashDir)) {
            mkdir($trashDir, 0755, true);
        }
        $trashPath = $trashDir . '/' . basename($filePath);
        // Append db_id to avoid name collisions
        $trashPath = $trashDir . '/' . $dbId . '_' . basename($filePath);
        rename($absPath, $trashPath);
    }
}

// ── Soft-delete the row (set deleted_at timestamp) ───────────────────────
// thesis_files may not have a deleted_at column; delete outright for now.
$delStmt = $pdo->prepare('DELETE FROM thesis_files WHERE id = ?');
$delStmt->execute([$dbId]);

http_response_code(200);
exit;