<?php

/**
 * api_medical_certificates_delete.php
 * --------------------------------------------------------------------------
 * Elimina un certificato medico dell'utente autenticato (con ownership check).
 *
 * Posizione: public/api/api_medical_certificates_delete.php
 * Metodo:    POST
 * Auth:      Bearer token (Sanctum) via _bootstrap.php
 *
 * Body:
 *   - cert_id (int)  id del certificato (idcertificateuserprofile)
 *     accettato sia via form-urlencoded sia via JSON.
 *
 * Tabella: certificateuserprofile
 * --------------------------------------------------------------------------
 */

require_once __DIR__ . '/_bootstrap.php';
$userId = (int) $user->id;

$uploadDir = __DIR__ . '/../user/document/';

// ==========================================================================
// INPUT (JSON o form-urlencoded)
// ==========================================================================
$raw = file_get_contents('php://input');
$json = json_decode($raw, true);
if (is_array($json) && isset($json['cert_id'])) {
    $certId = (int) $json['cert_id'];
} else {
    $certId = (int) ($_POST['cert_id'] ?? 0);
}

if ($certId <= 0) {
    http_response_code(400);
    echo json_encode(['success' => false, 'message' => 'Parametro cert_id mancante.']);
    exit;
}

// ==========================================================================
// 1) Recupera il certificato e verifica ownership
// ==========================================================================
$stmt = $db->prepare("
    SELECT idcertificateuserprofile, filenamedocument
    FROM certificateuserprofile
    WHERE idcertificateuserprofile = :cid AND iduser = :uid
    LIMIT 1
");
$stmt->execute([':cid' => $certId, ':uid' => $userId]);
$cert = $stmt->fetch();

if (!$cert) {
    http_response_code(404);
    echo json_encode(['success' => false, 'message' => 'Certificato non trovato.']);
    exit;
}

// ==========================================================================
// 2) Elimina record + file
// ==========================================================================
try {
    $del = $db->prepare("
        DELETE FROM certificateuserprofile
        WHERE idcertificateuserprofile = :cid AND iduser = :uid
        LIMIT 1
    ");
    $del->execute([':cid' => $certId, ':uid' => $userId]);
} catch (Throwable $e) {
    http_response_code(500);
    echo json_encode(['success' => false, 'message' => 'Errore durante la cancellazione.']);
    exit;
}

// Rimuovi il file fisico (best effort)
$filename = (string) ($cert['filenamedocument'] ?? '');
if ($filename !== '') {
    $path = $uploadDir . $filename;
    if (is_file($path)) {
        @unlink($path);
    }
}

// ==========================================================================
// OUTPUT
// ==========================================================================
echo json_encode([
    'success' => true,
    'message' => 'Certificato eliminato.',
], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);