<?php

require_once __DIR__ . '/../includes/auth.php';

require_once __DIR__ . '/../includes/db.php';

require_once __DIR__ . '/../includes/helpers.php';

require_login();

// POST-only.

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {

    http_response_code(405);

    exit('Method not allowed.');

}

csrf_verify();

/** Recursively remove a directory identified by a path relative to UPLOAD_DIR. */

function remove_upload_dir(string $relPath): void

{

    $base = realpath(UPLOAD_DIR);

    $dir  = realpath(UPLOAD_DIR . '/' . $relPath);

    if ($base === false || $dir === false) {

        return;

    }

    // Safety: never touch anything at or above the uploads root.

    if ($dir === $base || strpos($dir, $base . DIRECTORY_SEPARATOR) !== 0) {

        return;

    }

    $items = new RecursiveIteratorIterator(

        new RecursiveDirectoryIterator($dir, FilesystemIterator::SKIP_DOTS),

        RecursiveIteratorIterator::CHILD_FIRST

    );

    foreach ($items as $item) {

        $item->isDir() ? @rmdir($item->getPathname()) : @unlink($item->getPathname());

    }

    @rmdir($dir);

}

$type = $_POST['type'] ?? '';

if ($type === 'repo') {

    $id   = (int) ($_POST['id'] ?? 0);

    $repo = get_repository($id);

    if ($repo) {

        remove_upload_dir($repo['slug']);

        delete_repository($id); // cascades file + folder rows

    }

    header('Location: ' . url('/admin/dashboard.php?deleted=1'));

    exit;

}

if ($type === 'folder') {

    $id     = (int) ($_POST['id'] ?? 0);

    $folder = get_folder($id);

    if ($folder) {

        $repo = get_repository((int) $folder['repo_id']);

        $path = delete_folder($id); // removes descendant file + folder rows

        if ($repo && $path !== null) {

            remove_upload_dir($repo['slug'] . '/' . $path);

        }

        if ($repo) {

            header('Location: ' . url('/admin/upload.php?repo=' . urlencode($repo['slug']) . '&deleted=1'));

            exit;

        }

    }

    header('Location: ' . url('/admin/dashboard.php?deleted=1'));

    exit;

}

if ($type === 'file') {

    $id   = (int) ($_POST['id'] ?? 0);

    $file = get_file($id);

    if ($file) {

        $repo = get_repository((int) $file['repo_id']);

        // Delete the file on disk, guarding against traversal.

        $base = realpath(UPLOAD_DIR);

        $full = realpath(UPLOAD_DIR . '/' . $file['filepath']);

        if ($base !== false && $full !== false && strpos($full, $base . DIRECTORY_SEPARATOR) === 0) {

            @unlink($full);

        }

        delete_file($id);

        if ($repo) {

            header('Location: ' . url('/admin/upload.php?repo=' . urlencode($repo['slug']) . '&deleted=1'));

            exit;

        }

    }

    header('Location: ' . url('/admin/dashboard.php?deleted=1'));

    exit;

}

http_response_code(400);

exit('Unknown delete type.');