fix upload path

.env.example

@@ -39,3 +39,5 @@ PUSHER_APP_CLUSTER=mt1
 MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
 MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
 
+# ASSETS_BASE_URL=https://casadoc.cesoft.io/public
+ASSETS_BASE_URL=

public/userportal/api/_bootstrap.php

@@ -194,13 +194,22 @@ function base_url(): string
     return $proto . '://' . $host;
 }
 
+// URL for a public/ asset. Uses the configured public base (ASSETS_BASE_URL) so links
+// point at the real https domain even behind a proxy; falls back to the request host.
+function asset_url(string $path): string
+{
+    global $config;
+    $base = $config['assets_base_url'] ?: base_url();
+    return $base . '/' . ltrim($path, '/');
+}
+
 function present_user(array $u): array
 {
     // Uploaded avatars are stored as a bare filename under public/upload/users;
     // social logins already hold an absolute URL.
     $avatar = $u['avatar'] ?? null;
     if ($avatar && !str_starts_with($avatar, 'http')) {
-        $avatar = base_url() . '/upload/users/' . $avatar;
+        $avatar = asset_url('/upload/users/' . $avatar);
     }
     return [
         'id'         => (int) $u['id'],
@@ -261,7 +270,7 @@ function present_home(array $h, bool $isOwner = true, ?array $counts = null): ar
         'latitude'               => $h['latitude'] ?? null,
         'longitude'              => $h['longitude'] ?? null,
         'mainphoto'              => $photo,
-        'photo_url'              => $photo ? (base_url() . '/userportal/homedocuments/' . $photo) : null,
+        'photo_url'              => $photo ? asset_url('/userportal/mainphoto/' . $photo) : null,
         'cadastral_municipality' => $h['cadastral_municipality'] ?? null,
         'cadastral_section'      => $h['cadastral_section'] ?? null,
         'cadastral_sheet'        => $h['cadastral_sheet'] ?? null,
@@ -292,7 +301,7 @@ function present_file(array $f): array
         'owner_id'      => isset($f['owner_id']) ? (int) $f['owner_id'] : null,
         'filename'      => $f['filename'],
         'size'          => is_file($path) ? filesize($path) : null,
-        'url'           => base_url() . '/userportal/api/document-file.php?id=' . (int) $f['id'],
+        'url'           => asset_url('/userportal/api/document-file.php?id=' . (int) $f['id']),
         'expiry_date'   => $f['expirydate'] ?? null,
         'expiry_status' => isset($f['expirystatus']) ? (int) $f['expirystatus'] : null,
         'note'          => $f['note'] ?? null,

public/userportal/api/config.php

@@ -38,7 +38,10 @@ return [
 
     'homedocs_dir'   => __DIR__ . '/../homedocuments',
     'persondocs_dir' => __DIR__ . '/../persondocuments',
+    'mainphoto_dir'  => __DIR__ . '/../mainphoto',
     'avatars_dir'    => __DIR__ . '/../../upload/users',
 
     'app_url'        => rtrim(getenv('APP_URL') ?: '', '/'),
+
+    'assets_base_url' => rtrim(getenv('ASSETS_BASE_URL') ?: '', '/'),
 ];

public/userportal/api/home-photo.php

@@ -41,7 +41,7 @@ if (!user_owns_home($pdo, $user, $idhome)) {
     json_error(403, 'No access to this home');
 }
 
-$dir = $config['homedocs_dir'];
+$dir = $config['mainphoto_dir'];
 if (!is_dir($dir) && !mkdir($dir, 0775, true) && !is_dir($dir)) {
     json_error(500, 'Storage directory unavailable');
 }