<?php
require __DIR__ . '/_bootstrap.php';

/**
 * @OA\Post(
 *   path="/me-avatar.php",
 *   tags={"Auth"},
 *   summary="Upload the current user's avatar",
 *   description="Stored under public/upload/users; the User.avatar field is returned as an absolute URL.",
 *   security={{"bearerAuth":{}}},
 *   @OA\RequestBody(required=true, @OA\MediaType(mediaType="multipart/form-data",
 *     @OA\Schema(
 *       required={"avatar"},
 *       @OA\Property(property="avatar", type="string", format="binary", description="image")
 *     )
 *   )),
 *   @OA\Response(response=200, description="OK", @OA\JsonContent(
 *     @OA\Property(property="data", ref="#/components/schemas/User"))),
 *   @OA\Response(response=401, ref="#/components/responses/Unauthorized"),
 *   @OA\Response(response=422, ref="#/components/responses/ValidationError")
 * )
 */
require_method('POST');
$user   = require_auth($pdo);
$config = require __DIR__ . '/config.php';

if (empty($_FILES['avatar']) || $_FILES['avatar']['error'] !== UPLOAD_ERR_OK) {
    json_error(422, 'Validation failed', ['avatar' => ['Valid image is required']]);
}
if (!is_allowed_upload($_FILES['avatar']['tmp_name'], $_FILES['avatar']['name'], true)) {
    json_error(422, 'Validation failed', ['avatar' => ['Only image files are allowed']]);
}

$dir = $config['avatars_dir'];
if (!is_dir($dir) && !mkdir($dir, 0775, true) && !is_dir($dir)) {
    json_error(500, 'Storage directory unavailable');
}

$safe     = preg_replace('/[^A-Za-z0-9._-]/', '_', basename($_FILES['avatar']['name']));
$filename = $user['id'] . '-' . time() . '-' . $safe;

if (!move_uploaded_file($_FILES['avatar']['tmp_name'], $dir . '/' . $filename)) {
    json_error(500, 'Failed to store avatar');
}

// Drop the previous upload; an external (social) avatar is just a URL, nothing to delete.
$old = (string) ($user['avatar'] ?? '');
if ($old !== '' && !str_starts_with($old, 'http') && is_file($dir . '/' . basename($old))) {
    @unlink($dir . '/' . basename($old));
}

$pdo->prepare('UPDATE auth_users SET avatar = ? WHERE id = ?')->execute([$filename, $user['id']]);

$stmt = $pdo->prepare('SELECT * FROM auth_users WHERE id = ? LIMIT 1');
$stmt->execute([$user['id']]);

json_data(present_user($stmt->fetch()));