138 lines
4.7 KiB
PHP
138 lines
4.7 KiB
PHP
<?php
|
|
|
|
/**
|
|
* api_medical_certificates_upload.php
|
|
* --------------------------------------------------------------------------
|
|
* Carica un certificato medico per l'utente autenticato.
|
|
*
|
|
* Posizione: public/api/api_medical_certificates_upload.php
|
|
* Metodo: POST (multipart/form-data)
|
|
* Auth: Bearer token (Sanctum) via _bootstrap.php
|
|
*
|
|
* Campi attesi (form-data):
|
|
* - certificate (file) campo file (PDF/JPG/PNG, max 16MB)
|
|
* - document_name (text) descrizione documento
|
|
* - expiry_date (text) YYYY-MM-DD
|
|
*
|
|
* Logica ricalcata da certificate.php (webapp).
|
|
* Tabella: certificateuserprofile
|
|
* --------------------------------------------------------------------------
|
|
*/
|
|
|
|
require_once __DIR__ . '/_bootstrap.php';
|
|
$userId = (int) $user->id;
|
|
|
|
// La cartella upload è public/user/document/. Questo file sta in public/api/,
|
|
// quindi saliamo di un livello.
|
|
$uploadDir = __DIR__ . '/../user/document/';
|
|
|
|
$allowedExt = ['pdf', 'jpg', 'jpeg', 'png'];
|
|
$allowedMime = ['application/pdf', 'image/jpeg', 'image/png'];
|
|
$maxBytes = 16 * 1024 * 1024; // 16 MB
|
|
|
|
// ==========================================================================
|
|
// INPUT
|
|
// ==========================================================================
|
|
$documentName = trim($_POST['document_name'] ?? '');
|
|
$expiryDate = trim($_POST['expiry_date'] ?? '');
|
|
|
|
if ($documentName === '') {
|
|
$documentName = 'Certificato Medico';
|
|
}
|
|
|
|
if ($expiryDate === '') {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'message' => 'Data di scadenza obbligatoria.']);
|
|
exit;
|
|
}
|
|
|
|
// Validazione formato data YYYY-MM-DD
|
|
$d = DateTime::createFromFormat('Y-m-d', $expiryDate);
|
|
if ($d === false || $d->format('Y-m-d') !== $expiryDate) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'message' => 'Formato data non valido (YYYY-MM-DD).']);
|
|
exit;
|
|
}
|
|
|
|
// File
|
|
if (!isset($_FILES['certificate']) || $_FILES['certificate']['error'] !== UPLOAD_ERR_OK) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'message' => 'Nessun file ricevuto o errore upload.']);
|
|
exit;
|
|
}
|
|
|
|
$file = $_FILES['certificate'];
|
|
|
|
if ($file['size'] > $maxBytes) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'message' => 'Il file supera i 16 MB.']);
|
|
exit;
|
|
}
|
|
|
|
$ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
|
|
$finfo = new finfo(FILEINFO_MIME_TYPE);
|
|
$realMime = $finfo->file($file['tmp_name']);
|
|
|
|
if (!in_array($ext, $allowedExt, true) || !in_array($realMime, $allowedMime, true)) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'message' => 'Formato non consentito. Usa PDF, JPG o PNG.']);
|
|
exit;
|
|
}
|
|
|
|
// ==========================================================================
|
|
// SALVATAGGIO FILE
|
|
// ==========================================================================
|
|
if (!is_dir($uploadDir)) {
|
|
@mkdir($uploadDir, 0755, true);
|
|
}
|
|
|
|
$safeName = bin2hex(random_bytes(16)) . '.' . $ext;
|
|
$destination = $uploadDir . $safeName;
|
|
|
|
if (!move_uploaded_file($file['tmp_name'], $destination)) {
|
|
http_response_code(500);
|
|
echo json_encode(['success' => false, 'message' => 'Salvataggio del file non riuscito.']);
|
|
exit;
|
|
}
|
|
|
|
// ==========================================================================
|
|
// INSERT DB
|
|
// ==========================================================================
|
|
try {
|
|
$sql = "INSERT INTO certificateuserprofile
|
|
(iduser, documentdescription, filenamedocument, expirydatedocument, uploaded_at)
|
|
VALUES (:iduser, :descr, :fname, :expiry, :uploaded)";
|
|
$stmt = $db->prepare($sql);
|
|
$stmt->execute([
|
|
':iduser' => $userId,
|
|
':descr' => $documentName,
|
|
':fname' => $safeName,
|
|
':expiry' => $expiryDate,
|
|
':uploaded' => date('Y-m-d'),
|
|
]);
|
|
$newId = (int) $db->lastInsertId();
|
|
} catch (Throwable $e) {
|
|
// rollback file se l'insert fallisce
|
|
@unlink($destination);
|
|
http_response_code(500);
|
|
echo json_encode(['success' => false, 'message' => 'Errore nel salvataggio del documento.']);
|
|
exit;
|
|
}
|
|
|
|
// ==========================================================================
|
|
// OUTPUT
|
|
// ==========================================================================
|
|
echo json_encode([
|
|
'success' => true,
|
|
'message' => 'Documento caricato correttamente.',
|
|
'certificate' => [
|
|
'id' => $newId,
|
|
'document_name' => $documentName,
|
|
'filename' => $safeName,
|
|
'uploaded_at' => date('Y-m-d'),
|
|
'expiry_date' => $expiryDate,
|
|
'is_expired' => false,
|
|
'file_url' => '/user/document/' . $safeName,
|
|
],
|
|
], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
|