moved api certificate

2026-08-22 08:19:22 +02:00
parent e7d321c048
commit 7124b08c9b
3 changed files with 0 additions and 0 deletions
@@ -0,0 +1,137 @@
+<?php
+
+/**
+ * api_medical_certificates_upload.php
+ * --------------------------------------------------------------------------
+ * Carica un certificato medico per l'utente autenticato.
+ *
+ * Posizione: public/api/api_medical_certificates_upload.php
+ * Metodo:    POST (multipart/form-data)
+ * Auth:      Bearer token (Sanctum) via _bootstrap.php
+ *
+ * Campi attesi (form-data):
+ *   - certificate    (file)  campo file (PDF/JPG/PNG, max 16MB)
+ *   - document_name  (text)  descrizione documento
+ *   - expiry_date    (text)  YYYY-MM-DD
+ *
+ * Logica ricalcata da certificate.php (webapp).
+ * Tabella: certificateuserprofile
+ * --------------------------------------------------------------------------
+ */
+
+require_once __DIR__ . '/_bootstrap.php';
+$userId = (int) $user->id;
+
+// La cartella upload è public/user/document/. Questo file sta in public/api/,
+// quindi saliamo di un livello.
+$uploadDir = __DIR__ . '/../user/document/';
+
+$allowedExt  = ['pdf', 'jpg', 'jpeg', 'png'];
+$allowedMime = ['application/pdf', 'image/jpeg', 'image/png'];
+$maxBytes    = 16 * 1024 * 1024; // 16 MB
+
+// ==========================================================================
+// INPUT
+// ==========================================================================
+$documentName = trim($_POST['document_name'] ?? '');
+$expiryDate   = trim($_POST['expiry_date'] ?? '');
+
+if ($documentName === '') {
+    $documentName = 'Certificato Medico';
+}
+
+if ($expiryDate === '') {
+    http_response_code(400);
+    echo json_encode(['success' => false, 'message' => 'Data di scadenza obbligatoria.']);
+    exit;
+}
+
+// Validazione formato data YYYY-MM-DD
+$d = DateTime::createFromFormat('Y-m-d', $expiryDate);
+if ($d === false || $d->format('Y-m-d') !== $expiryDate) {
+    http_response_code(400);
+    echo json_encode(['success' => false, 'message' => 'Formato data non valido (YYYY-MM-DD).']);
+    exit;
+}
+
+// File
+if (!isset($_FILES['certificate']) || $_FILES['certificate']['error'] !== UPLOAD_ERR_OK) {
+    http_response_code(400);
+    echo json_encode(['success' => false, 'message' => 'Nessun file ricevuto o errore upload.']);
+    exit;
+}
+
+$file = $_FILES['certificate'];
+
+if ($file['size'] > $maxBytes) {
+    http_response_code(400);
+    echo json_encode(['success' => false, 'message' => 'Il file supera i 16 MB.']);
+    exit;
+}
+
+$ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
+$finfo = new finfo(FILEINFO_MIME_TYPE);
+$realMime = $finfo->file($file['tmp_name']);
+
+if (!in_array($ext, $allowedExt, true) || !in_array($realMime, $allowedMime, true)) {
+    http_response_code(400);
+    echo json_encode(['success' => false, 'message' => 'Formato non consentito. Usa PDF, JPG o PNG.']);
+    exit;
+}
+
+// ==========================================================================
+// SALVATAGGIO FILE
+// ==========================================================================
+if (!is_dir($uploadDir)) {
+    @mkdir($uploadDir, 0755, true);
+}
+
+$safeName = bin2hex(random_bytes(16)) . '.' . $ext;
+$destination = $uploadDir . $safeName;
+
+if (!move_uploaded_file($file['tmp_name'], $destination)) {
+    http_response_code(500);
+    echo json_encode(['success' => false, 'message' => 'Salvataggio del file non riuscito.']);
+    exit;
+}
+
+// ==========================================================================
+// INSERT DB
+// ==========================================================================
+try {
+    $sql = "INSERT INTO certificateuserprofile
+                (iduser, documentdescription, filenamedocument, expirydatedocument, uploaded_at)
+            VALUES (:iduser, :descr, :fname, :expiry, :uploaded)";
+    $stmt = $db->prepare($sql);
+    $stmt->execute([
+        ':iduser'   => $userId,
+        ':descr'    => $documentName,
+        ':fname'    => $safeName,
+        ':expiry'   => $expiryDate,
+        ':uploaded' => date('Y-m-d'),
+    ]);
+    $newId = (int) $db->lastInsertId();
+} catch (Throwable $e) {
+    // rollback file se l'insert fallisce
+    @unlink($destination);
+    http_response_code(500);
+    echo json_encode(['success' => false, 'message' => 'Errore nel salvataggio del documento.']);
+    exit;
+}
+
+// ==========================================================================
+// OUTPUT
+// ==========================================================================
+echo json_encode([
+    'success'     => true,
+    'message'     => 'Documento caricato correttamente.',
+    'certificate' => [
+        'id'            => $newId,
+        'document_name' => $documentName,
+        'filename'      => $safeName,
+        'uploaded_at'   => date('Y-m-d'),
+        'expiry_date'   => $expiryDate,
+        'is_expired'    => false,
+        'file_url'      => '/user/document/' . $safeName,
+    ],
+], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);