<?php
/**
 * FilePond revert endpoint — deletes a just-uploaded tmp file (admin).
 *
 * DELETE /admin/actions/filepond/revert.php
 * Body: plain text file_id
 *
 * Called when the user removes a file before form submit.
 */

require_once __DIR__ . '/../../../../bootstrap.php';
require_once __DIR__ . '/../../../../src/AdminAuth.php';
require_once __DIR__ . '/../../../../src/FilepondHandler.php';

// ── Auth (admin only) ────────────────────────────────────────────────────
AdminAuth::requireLogin();

// ── CSRF via header ──────────────────────────────────────────────────────
$csrfHeader = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
if (!isset($_SESSION['csrf_token'])
    || !hash_equals($_SESSION['csrf_token'], $csrfHeader)) {
    http_response_code(403);
    die('Token CSRF invalide.');
}

$handler = new FilepondHandler('[filepond:admin]');
$handler->handleRevert();