xamxam/app/public/admin/fragments/file-browser.php

<?php
/**
 * File browser fragment — returns a clickable directory tree of documents/ + theses/.
 *
 * GET /admin/fragments/file-browser.php?dir=documents/2025
 *
 * Used by the relink modal to let admins pick an orphaned file and reattach
 * it to a thesis entry.
 */
require_once __DIR__ . '/../../../bootstrap.php';
require_once __DIR__ . '/../../../src/AdminAuth.php';
AdminAuth::requireLogin();

$storageRoot = STORAGE_ROOT;

// Determine which directory to browse
$relDir = trim($_GET['dir'] ?? '', '/');
if ($relDir !== '' && !preg_match('#^(documents|theses)/#', $relDir)) {
    $relDir = '';
}

$currentAbs = $storageRoot . '/' . ($relDir !== '' ? $relDir . '/' : '');
// Security: prevent escaping STORAGE_ROOT
$realCurrent = realpath($currentAbs);
$realStorage = realpath($storageRoot);
if ($realCurrent === false || !str_starts_with($realCurrent, $realStorage)) {
    http_response_code(403);
    die('Chemin interdit.');
}

// Build breadcrumb
$breadcrumb = [];
if ($relDir !== '') {
    $parts = explode('/', $relDir);
    $accum = '';
    foreach ($parts as $p) {
        $accum = ltrim($accum . '/' . $p, '/');
        $breadcrumb[] = ['label' => $p, 'dir' => $accum];
    }
}

// Gather entries
$entries = [];
if (is_dir($realCurrent)) {
    $dh = opendir($realCurrent);
    if ($dh) {
        while (($name = readdir($dh)) !== false) {
            if ($name === '.' || $name === '..') continue;
            $full = $realCurrent . '/' . $name;
            $isDir = is_dir($full);
            $entries[] = [
                'name'   => $name,
                'is_dir' => $isDir,
                'size'   => $isDir ? null : filesize($full),
                'ext'    => $isDir ? null : strtolower(pathinfo($name, PATHINFO_EXTENSION)),
            ];
        }
        closedir($dh);
    }
}

// Sort: dirs first, then files, alphabetical
usort($entries, function ($a, $b) {
    if ($a['is_dir'] !== $b['is_dir']) return $a['is_dir'] ? -1 : 1;
    return strnatcasecmp($a['name'], $b['name']);
});

// Human-readable filesize
function fmtSize(?int $bytes): string {
    if ($bytes === null) return '';
    if ($bytes >= 1_000_000_000) return round($bytes / 1_000_000_000, 1) . ' GB';
    if ($bytes >= 1_000_000) return round($bytes / 1_000_000, 1) . ' MB';
    if ($bytes >= 1_000) return round($bytes / 1_000, 1) . ' KB';
    return $bytes . ' B';
}

// Determine parent dir
$parentDir = '';
if ($relDir !== '') {
    $parentParts = explode('/', $relDir);
    array_pop($parentParts);
    $parentDir = implode('/', $parentParts);
}

$rootDirs = ['documents', 'theses'];
?>
<div id="file-browser-container" class="file-browser">
    <?php if ($relDir === ''): ?>
        <!-- Root: show top-level directories -->
        <p class="file-browser-hint">Sélectionnez un dossier pour parcourir les fichiers orphelins.</p>
        <ul class="file-browser-list">
            <?php foreach ($rootDirs as $rd): ?>
                <?php $rdAbs = $storageRoot . '/' . $rd; ?>
                <li class="file-browser-entry file-browser-dir">
                    <a href="#" hx-get="/admin/fragments/file-browser.php?dir=<?= urlencode($rd) ?>"
                       hx-target="#file-browser-container" hx-swap="outerHTML">
                        <span class="file-browser-icon">📁</span>
                        <span class="file-browser-name"><?= htmlspecialchars($rd) ?>/</span>
                    </a>
                </li>
            <?php endforeach; ?>
        </ul>
    <?php else: ?>
        <!-- Subdirectory: breadcrumb + entries -->
        <nav class="file-browser-breadcrumb">
            <a href="#" hx-get="/admin/fragments/file-browser.php"
               hx-target="#file-browser-container" hx-swap="outerHTML">📂 racine</a>
            <?php foreach ($breadcrumb as $i => $bc): ?>
                <span class="file-browser-sep">/</span>
                <a href="#" hx-get="/admin/fragments/file-browser.php?dir=<?= urlencode($bc['dir']) ?>"
                   hx-target="#file-browser-container" hx-swap="outerHTML"><?= htmlspecialchars($bc['label']) ?></a>
            <?php endforeach; ?>
        </nav>

        <?php if (empty($entries)): ?>
            <p class="file-browser-empty">Ce dossier est vide.</p>
        <?php else: ?>
            <ul class="file-browser-list">
                <?php foreach ($entries as $e): ?>
                    <?php if ($e['is_dir']): ?>
                        <li class="file-browser-entry file-browser-dir">
                            <a href="#" hx-get="/admin/fragments/file-browser.php?dir=<?= urlencode($relDir . '/' . $e['name']) ?>"
                               hx-target="#file-browser-container" hx-swap="outerHTML">
                                <span class="file-browser-icon">📁</span>
                                <span class="file-browser-name"><?= htmlspecialchars($e['name']) ?>/</span>
                            </a>
                        </li>
                    <?php else: ?>
                        <li class="file-browser-entry file-browser-file"
                            data-file-path="<?= htmlspecialchars($relDir . '/' . $e['name']) ?>"
                            data-file-name="<?= htmlspecialchars($e['name']) ?>"
                            data-file-ext="<?= htmlspecialchars($e['ext'] ?? '') ?>"
                            data-file-size="<?= (int)($e['size'] ?? 0) ?>">
                            <button type="button" class="file-browser-select-btn"
                                    onclick="XamxamRelinkFile(this)">
                                <span class="file-browser-icon">📄</span>
                                <span class="file-browser-name"><?= htmlspecialchars($e['name']) ?></span>
                                <span class="file-browser-size"><?= htmlspecialchars(fmtSize($e['size'])) ?></span>
                            </button>
                        </li>
                    <?php endif; ?>
                <?php endforeach; ?>
            </ul>
        <?php endif; ?>
    <?php endif; ?>
</div>