79 lines
3.0 KiB
PHP
79 lines
3.0 KiB
PHP
<?php
|
|
require __DIR__ . '/_bootstrap.php';
|
|
|
|
/**
|
|
* @OA\Post(
|
|
* path="/document-upload.php",
|
|
* tags={"Documents"},
|
|
* summary="Upload a document file for a home",
|
|
* security={{"bearerAuth":{}}},
|
|
* @OA\RequestBody(required=true, @OA\MediaType(mediaType="multipart/form-data",
|
|
* @OA\Schema(
|
|
* required={"idhome","document_id","file"},
|
|
* @OA\Property(property="idhome", type="integer"),
|
|
* @OA\Property(property="document_id", type="integer"),
|
|
* @OA\Property(property="file", type="string", format="binary", description="PDF or image"),
|
|
* @OA\Property(property="expiry_date", type="string", format="date"),
|
|
* @OA\Property(property="note", type="string"),
|
|
* @OA\Property(property="title", type="string", description="optional display name")
|
|
* )
|
|
* )),
|
|
* @OA\Response(response=201, description="File uploaded", @OA\JsonContent(
|
|
* @OA\Property(property="data", ref="#/components/schemas/UploadedFile"))),
|
|
* @OA\Response(response=403, ref="#/components/responses/Forbidden"),
|
|
* @OA\Response(response=422, ref="#/components/responses/ValidationError")
|
|
* )
|
|
*/
|
|
require_method('POST');
|
|
$user = require_auth($pdo);
|
|
$config = require __DIR__ . '/config.php';
|
|
|
|
$idhome = (int) ($_POST['idhome'] ?? 0);
|
|
$documentId = (int) ($_POST['document_id'] ?? 0);
|
|
$expiry = $_POST['expiry_date'] ?? null;
|
|
$note = $_POST['note'] ?? null;
|
|
$title = $_POST['title'] ?? null;
|
|
|
|
$fields = [];
|
|
if ($idhome <= 0) { $fields['idhome'] = ['Required']; }
|
|
if ($documentId <= 0) { $fields['document_id'] = ['Required']; }
|
|
if (empty($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
|
|
$fields['file'] = ['Valid file is required'];
|
|
} elseif (!is_allowed_upload($_FILES['file']['tmp_name'], $_FILES['file']['name'])) {
|
|
$fields['file'] = ['Only PDF or image files are allowed'];
|
|
}
|
|
if ($fields) {
|
|
json_error(422, 'Validation failed', $fields);
|
|
}
|
|
|
|
// Owner only (not shared access) may upload.
|
|
if (!user_owns_home($pdo, $user, $idhome)) {
|
|
json_error(403, 'No access to this home');
|
|
}
|
|
|
|
$dir = $config['homedocs_dir'];
|
|
if (!is_dir($dir) && !mkdir($dir, 0775, true) && !is_dir($dir)) {
|
|
json_error(500, 'Storage directory unavailable');
|
|
}
|
|
|
|
$safe = preg_replace('/[^A-Za-z0-9._-]/', '_', basename($_FILES['file']['name']));
|
|
$filename = $idhome . '-' . time() . '-' . $safe;
|
|
|
|
if (!move_uploaded_file($_FILES['file']['tmp_name'], $dir . '/' . $filename)) {
|
|
json_error(500, 'Failed to store file');
|
|
}
|
|
|
|
$expiryStatus = $expiry ? 1 : 0;
|
|
|
|
$stmt = $pdo->prepare(
|
|
"INSERT INTO doc_storage (idhome, entity_type, document_id, title, filename, expirystatus, expirydate, note, created_at, updated_at)
|
|
VALUES (?, 'home', ?, ?, ?, ?, ?, ?, NOW(), NOW())"
|
|
);
|
|
$stmt->execute([$idhome, $documentId, $title ?: null, $filename, $expiryStatus, $expiry ?: null, $note ?: null]);
|
|
$id = (int) $pdo->lastInsertId();
|
|
|
|
$row = $pdo->prepare('SELECT * FROM doc_storage WHERE id = ?');
|
|
$row->execute([$id]);
|
|
|
|
json_data(present_file($row->fetch()), 201);
|