<?php
include('include/headscript.php');
header('Content-Type: application/json; charset=utf-8');

$categorie = require __DIR__ . '/config/mescole_file_categories.php';

$idmescola = isset($_POST['idmescola']) ? (int)$_POST['idmescola'] : 0;
$categoria = $_POST['categoria'] ?? '';
$titolo    = trim($_POST['titolo'] ?? '');

if ($idmescola <= 0) {
    echo json_encode(['success' => false, 'message' => 'ID mescola non valido']);
    exit;
}
if (!array_key_exists($categoria, $categorie)) {
    echo json_encode(['success' => false, 'message' => 'Categoria non valida']);
    exit;
}
if ($titolo === '') {
    echo json_encode(['success' => false, 'message' => 'Il titolo del file è obbligatorio']);
    exit;
}
if (!isset($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
    echo json_encode(['success' => false, 'message' => 'File mancante o upload non riuscito']);
    exit;
}

// --- Validazioni di sicurezza sul file ---
$allowedExt = ['pdf', 'doc', 'docx', 'xls', 'xlsx', 'jpg', 'jpeg', 'png'];
$maxSize    = 15 * 1024 * 1024; // 15 MB

$originalName = $_FILES['file']['name'];
$tmpPath      = $_FILES['file']['tmp_name'];
$size         = (int)$_FILES['file']['size'];
$ext          = strtolower(pathinfo($originalName, PATHINFO_EXTENSION));

if (!in_array($ext, $allowedExt, true)) {
    echo json_encode(['success' => false, 'message' => 'Estensione file non consentita (' . $ext . ')']);
    exit;
}
if ($size <= 0 || $size > $maxSize) {
    echo json_encode(['success' => false, 'message' => 'Il file supera la dimensione massima di 15MB']);
    exit;
}

$finfo    = finfo_open(FILEINFO_MIME_TYPE);
$mimeType = finfo_file($finfo, $tmpPath);
finfo_close($finfo);

// Cartella dedicata per mescola: uploads/mescole/{idmescola}/
$destDir = __DIR__ . '/uploads/mescole/' . $idmescola . '/';
if (!is_dir($destDir)) {
    mkdir($destDir, 0775, true);
}

// Nome fisico casuale: evita collisioni e path traversal
$storedName = bin2hex(random_bytes(16)) . '.' . $ext;
$destPath   = $destDir . $storedName;

if (!move_uploaded_file($tmpPath, $destPath)) {
    echo json_encode(['success' => false, 'message' => 'Impossibile salvare il file sul server']);
    exit;
}

try {
    $db  = DBHandlerSelect::getInstance();
    $pdo = $db->getConnection();

    $stmt = $pdo->prepare("
        INSERT INTO mescole_files (idmescola, categoria, titolo, filename, original_filename, mime_type, filesize, uploaded_at)
        VALUES (?, ?, ?, ?, ?, ?, ?, NOW())
    ");
    $stmt->execute([$idmescola, $categoria, $titolo, $storedName, $originalName, $mimeType, $size]);

    echo json_encode(['success' => true, 'id' => $pdo->lastInsertId()]);
} catch (Throwable $e) {
    // rollback file se il DB fallisce
    @unlink($destPath);
    echo json_encode(['success' => false, 'message' => 'Errore database: ' . $e->getMessage()]);
}