api certificate

public/api_medical_certificates_delete.php

@@ -0,0 +1,91 @@
+<?php
+
+/**
+ * api_medical_certificates_delete.php
+ * --------------------------------------------------------------------------
+ * Elimina un certificato medico dell'utente autenticato (con ownership check).
+ *
+ * Posizione: public/api/api_medical_certificates_delete.php
+ * Metodo:    POST
+ * Auth:      Bearer token (Sanctum) via _bootstrap.php
+ *
+ * Body:
+ *   - cert_id (int)  id del certificato (idcertificateuserprofile)
+ *     accettato sia via form-urlencoded sia via JSON.
+ *
+ * Tabella: certificateuserprofile
+ * --------------------------------------------------------------------------
+ */
+
+require_once __DIR__ . '/_bootstrap.php';
+$userId = (int) $user->id;
+
+$uploadDir = __DIR__ . '/../user/document/';
+
+// ==========================================================================
+// INPUT (JSON o form-urlencoded)
+// ==========================================================================
+$raw = file_get_contents('php://input');
+$json = json_decode($raw, true);
+if (is_array($json) && isset($json['cert_id'])) {
+    $certId = (int) $json['cert_id'];
+} else {
+    $certId = (int) ($_POST['cert_id'] ?? 0);
+}
+
+if ($certId <= 0) {
+    http_response_code(400);
+    echo json_encode(['success' => false, 'message' => 'Parametro cert_id mancante.']);
+    exit;
+}
+
+// ==========================================================================
+// 1) Recupera il certificato e verifica ownership
+// ==========================================================================
+$stmt = $db->prepare("
+    SELECT idcertificateuserprofile, filenamedocument
+    FROM certificateuserprofile
+    WHERE idcertificateuserprofile = :cid AND iduser = :uid
+    LIMIT 1
+");
+$stmt->execute([':cid' => $certId, ':uid' => $userId]);
+$cert = $stmt->fetch();
+
+if (!$cert) {
+    http_response_code(404);
+    echo json_encode(['success' => false, 'message' => 'Certificato non trovato.']);
+    exit;
+}
+
+// ==========================================================================
+// 2) Elimina record + file
+// ==========================================================================
+try {
+    $del = $db->prepare("
+        DELETE FROM certificateuserprofile
+        WHERE idcertificateuserprofile = :cid AND iduser = :uid
+        LIMIT 1
+    ");
+    $del->execute([':cid' => $certId, ':uid' => $userId]);
+} catch (Throwable $e) {
+    http_response_code(500);
+    echo json_encode(['success' => false, 'message' => 'Errore durante la cancellazione.']);
+    exit;
+}
+
+// Rimuovi il file fisico (best effort)
+$filename = (string) ($cert['filenamedocument'] ?? '');
+if ($filename !== '') {
+    $path = $uploadDir . $filename;
+    if (is_file($path)) {
+        @unlink($path);
+    }
+}
+
+// ==========================================================================
+// OUTPUT
+// ==========================================================================
+echo json_encode([
+    'success' => true,
+    'message' => 'Certificato eliminato.',
+], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);