diff --git a/public/api_medical_certificates_delete.php b/public/api_medical_certificates_delete.php new file mode 100644 index 00000000..b3aa397e --- /dev/null +++ b/public/api_medical_certificates_delete.php @@ -0,0 +1,91 @@ +id; + +$uploadDir = __DIR__ . '/../user/document/'; + +// ========================================================================== +// INPUT (JSON o form-urlencoded) +// ========================================================================== +$raw = file_get_contents('php://input'); +$json = json_decode($raw, true); +if (is_array($json) && isset($json['cert_id'])) { + $certId = (int) $json['cert_id']; +} else { + $certId = (int) ($_POST['cert_id'] ?? 0); +} + +if ($certId <= 0) { + http_response_code(400); + echo json_encode(['success' => false, 'message' => 'Parametro cert_id mancante.']); + exit; +} + +// ========================================================================== +// 1) Recupera il certificato e verifica ownership +// ========================================================================== +$stmt = $db->prepare(" + SELECT idcertificateuserprofile, filenamedocument + FROM certificateuserprofile + WHERE idcertificateuserprofile = :cid AND iduser = :uid + LIMIT 1 +"); +$stmt->execute([':cid' => $certId, ':uid' => $userId]); +$cert = $stmt->fetch(); + +if (!$cert) { + http_response_code(404); + echo json_encode(['success' => false, 'message' => 'Certificato non trovato.']); + exit; +} + +// ========================================================================== +// 2) Elimina record + file +// ========================================================================== +try { + $del = $db->prepare(" + DELETE FROM certificateuserprofile + WHERE idcertificateuserprofile = :cid AND iduser = :uid + LIMIT 1 + "); + $del->execute([':cid' => $certId, ':uid' => $userId]); +} catch (Throwable $e) { + http_response_code(500); + echo json_encode(['success' => false, 'message' => 'Errore durante la cancellazione.']); + exit; +} + +// Rimuovi il file fisico (best effort) +$filename = (string) ($cert['filenamedocument'] ?? ''); +if ($filename !== '') { + $path = $uploadDir . $filename; + if (is_file($path)) { + @unlink($path); + } +} + +// ========================================================================== +// OUTPUT +// ========================================================================== +echo json_encode([ + 'success' => true, + 'message' => 'Certificato eliminato.', +], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES); diff --git a/public/api_medical_certificates_list.php b/public/api_medical_certificates_list.php new file mode 100644 index 00000000..8746401a --- /dev/null +++ b/public/api_medical_certificates_list.php @@ -0,0 +1,54 @@ +id; + +$today = date('Y-m-d'); + +$stmt = $db->prepare(" + SELECT idcertificateuserprofile, documentdescription, filenamedocument, + expirydatedocument, uploaded_at + FROM certificateuserprofile + WHERE iduser = :uid + ORDER BY uploaded_at DESC, idcertificateuserprofile DESC +"); +$stmt->execute([':uid' => $userId]); +$rows = $stmt->fetchAll(); + +$certificates = []; +foreach ($rows as $r) { + $filename = (string) ($r['filenamedocument'] ?? ''); + $expiry = $r['expirydatedocument'] ?? null; + $isExpired = ($expiry !== null && $expiry !== '' && $expiry < $today); + + $certificates[] = [ + 'id' => (int) $r['idcertificateuserprofile'], + 'document_name' => (string) ($r['documentdescription'] ?? ''), + 'filename' => $filename, + 'uploaded_at' => $r['uploaded_at'] ?? null, + 'expiry_date' => $expiry, + 'is_expired' => $isExpired, + // percorso file relativo (la webapp li serve da public/user/document/) + 'file_url' => $filename !== '' ? '/user/document/' . $filename : null, + ]; +} + +echo json_encode([ + 'success' => true, + 'certificates' => $certificates, +], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES); diff --git a/public/api_medical_certificates_upload.php b/public/api_medical_certificates_upload.php new file mode 100644 index 00000000..eaad8905 --- /dev/null +++ b/public/api_medical_certificates_upload.php @@ -0,0 +1,137 @@ +id; + +// La cartella upload รจ public/user/document/. Questo file sta in public/api/, +// quindi saliamo di un livello. +$uploadDir = __DIR__ . '/../user/document/'; + +$allowedExt = ['pdf', 'jpg', 'jpeg', 'png']; +$allowedMime = ['application/pdf', 'image/jpeg', 'image/png']; +$maxBytes = 16 * 1024 * 1024; // 16 MB + +// ========================================================================== +// INPUT +// ========================================================================== +$documentName = trim($_POST['document_name'] ?? ''); +$expiryDate = trim($_POST['expiry_date'] ?? ''); + +if ($documentName === '') { + $documentName = 'Certificato Medico'; +} + +if ($expiryDate === '') { + http_response_code(400); + echo json_encode(['success' => false, 'message' => 'Data di scadenza obbligatoria.']); + exit; +} + +// Validazione formato data YYYY-MM-DD +$d = DateTime::createFromFormat('Y-m-d', $expiryDate); +if ($d === false || $d->format('Y-m-d') !== $expiryDate) { + http_response_code(400); + echo json_encode(['success' => false, 'message' => 'Formato data non valido (YYYY-MM-DD).']); + exit; +} + +// File +if (!isset($_FILES['certificate']) || $_FILES['certificate']['error'] !== UPLOAD_ERR_OK) { + http_response_code(400); + echo json_encode(['success' => false, 'message' => 'Nessun file ricevuto o errore upload.']); + exit; +} + +$file = $_FILES['certificate']; + +if ($file['size'] > $maxBytes) { + http_response_code(400); + echo json_encode(['success' => false, 'message' => 'Il file supera i 16 MB.']); + exit; +} + +$ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION)); +$finfo = new finfo(FILEINFO_MIME_TYPE); +$realMime = $finfo->file($file['tmp_name']); + +if (!in_array($ext, $allowedExt, true) || !in_array($realMime, $allowedMime, true)) { + http_response_code(400); + echo json_encode(['success' => false, 'message' => 'Formato non consentito. Usa PDF, JPG o PNG.']); + exit; +} + +// ========================================================================== +// SALVATAGGIO FILE +// ========================================================================== +if (!is_dir($uploadDir)) { + @mkdir($uploadDir, 0755, true); +} + +$safeName = bin2hex(random_bytes(16)) . '.' . $ext; +$destination = $uploadDir . $safeName; + +if (!move_uploaded_file($file['tmp_name'], $destination)) { + http_response_code(500); + echo json_encode(['success' => false, 'message' => 'Salvataggio del file non riuscito.']); + exit; +} + +// ========================================================================== +// INSERT DB +// ========================================================================== +try { + $sql = "INSERT INTO certificateuserprofile + (iduser, documentdescription, filenamedocument, expirydatedocument, uploaded_at) + VALUES (:iduser, :descr, :fname, :expiry, :uploaded)"; + $stmt = $db->prepare($sql); + $stmt->execute([ + ':iduser' => $userId, + ':descr' => $documentName, + ':fname' => $safeName, + ':expiry' => $expiryDate, + ':uploaded' => date('Y-m-d'), + ]); + $newId = (int) $db->lastInsertId(); +} catch (Throwable $e) { + // rollback file se l'insert fallisce + @unlink($destination); + http_response_code(500); + echo json_encode(['success' => false, 'message' => 'Errore nel salvataggio del documento.']); + exit; +} + +// ========================================================================== +// OUTPUT +// ========================================================================== +echo json_encode([ + 'success' => true, + 'message' => 'Documento caricato correttamente.', + 'certificate' => [ + 'id' => $newId, + 'document_name' => $documentName, + 'filename' => $safeName, + 'uploaded_at' => date('Y-m-d'), + 'expiry_date' => $expiryDate, + 'is_expired' => false, + 'file_url' => '/user/document/' . $safeName, + ], +], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);