<?php
require __DIR__ . '/_bootstrap.php';

/**
 * @OA\Post(
 *   path="/owner-document-upload.php",
 *   tags={"Documents"},
 *   summary="Upload a document file for an owner",
 *   security={{"bearerAuth":{}}},
 *   @OA\RequestBody(required=true, @OA\MediaType(mediaType="multipart/form-data",
 *     @OA\Schema(
 *       required={"owner_id","document_id","file"},
 *       @OA\Property(property="owner_id", type="integer"),
 *       @OA\Property(property="document_id", type="integer"),
 *       @OA\Property(property="file", type="string", format="binary", description="PDF or image"),
 *       @OA\Property(property="expiry_date", type="string", format="date"),
 *       @OA\Property(property="note", type="string"),
 *       @OA\Property(property="title", type="string", description="optional display name")
 *     )
 *   )),
 *   @OA\Response(response=201, description="File uploaded", @OA\JsonContent(
 *     @OA\Property(property="data", ref="#/components/schemas/UploadedFile"))),
 *   @OA\Response(response=403, ref="#/components/responses/Forbidden"),
 *   @OA\Response(response=422, ref="#/components/responses/ValidationError")
 * )
 */
require_method('POST');
$user   = require_auth($pdo);
$config = require __DIR__ . '/config.php';

$ownerId    = (int) ($_POST['owner_id'] ?? 0);
$documentId = (int) ($_POST['document_id'] ?? 0);
$expiry     = $_POST['expiry_date'] ?? null;
$note       = $_POST['note'] ?? null;
$title      = $_POST['title'] ?? null;

$fields = [];
if ($ownerId <= 0)    { $fields['owner_id']    = ['Required']; }
if ($documentId <= 0) { $fields['document_id'] = ['Required']; }
if (empty($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
    $fields['file'] = ['Valid file is required'];
} elseif (!is_allowed_upload($_FILES['file']['tmp_name'], $_FILES['file']['name'])) {
    $fields['file'] = ['Only PDF or image files are allowed'];
}
if ($fields) {
    json_error(422, 'Validation failed', $fields);
}
if (!user_owns_owner($pdo, $user, $ownerId)) {
    json_error(403, 'No access to this owner');
}

$dir = $config['persondocs_dir'];
if (!is_dir($dir) && !mkdir($dir, 0775, true) && !is_dir($dir)) {
    json_error(500, 'Storage directory unavailable');
}

$safe     = preg_replace('/[^A-Za-z0-9._-]/', '_', basename($_FILES['file']['name']));
$filename = $ownerId . '-' . time() . '-' . $safe;

if (!move_uploaded_file($_FILES['file']['tmp_name'], $dir . '/' . $filename)) {
    json_error(500, 'Failed to store file');
}

$expiryStatus = $expiry ? 1 : 0;

$stmt = $pdo->prepare(
    "INSERT INTO doc_storage (idhome, entity_type, owner_id, document_id, title, filename, expirystatus, expirydate, note, created_at, updated_at)
     VALUES (NULL, 'person', ?, ?, ?, ?, ?, ?, ?, NOW(), NOW())"
);
$stmt->execute([$ownerId, $documentId, $title ?: null, $filename, $expiryStatus, $expiry ?: null, $note ?: null]);
$id = (int) $pdo->lastInsertId();

$row = $pdo->prepare('SELECT * FROM doc_storage WHERE id = ?');
$row->execute([$id]);

json_data(present_file($row->fetch()), 201);