<?php
require __DIR__ . '/_bootstrap.php';

/**
 * @OA\Post(
 *   path="/document-file-delete.php",
 *   tags={"Documents"},
 *   summary="Delete an uploaded file",
 *   security={{"bearerAuth":{}}},
 *   @OA\RequestBody(required=true, @OA\JsonContent(
 *     required={"id"},
 *     @OA\Property(property="id", type="integer", description="doc_storage.id")
 *   )),
 *   @OA\Response(response=200, ref="#/components/responses/Success"),
 *   @OA\Response(response=403, ref="#/components/responses/Forbidden"),
 *   @OA\Response(response=404, ref="#/components/responses/NotFound")
 * )
 */
require_method('POST');
$user   = require_auth($pdo);
$config = require __DIR__ . '/config.php';
$id     = (int) (body()['id'] ?? 0);

if ($id <= 0) {
    json_error(422, 'id is required');
}

$stmt = $pdo->prepare('SELECT * FROM doc_storage WHERE id = ? LIMIT 1');
$stmt->execute([$id]);
$file = $stmt->fetch();
if (!$file) {
    json_error(404, 'File not found');
}

$allowed = false;
$baseDir = null;
if (!empty($file['idhome'])) {
    $allowed = user_owns_home($pdo, $user, (int) $file['idhome']);
    $baseDir = $config['homedocs_dir'];
} elseif (!empty($file['owner_id'])) {
    $allowed = user_owns_owner($pdo, $user, (int) $file['owner_id']);
    $baseDir = $config['persondocs_dir'];
}
if (!$allowed) {
    json_error(403, 'No access to this file');
}

$path = $baseDir . '/' . basename((string) $file['filename']);
if (is_file($path)) {
    @unlink($path);
}
$pdo->prepare('DELETE FROM doc_storage WHERE id = ?')->execute([$id]);

json_ok();