<?php

require_once __DIR__ . '/../includes/auth.php';

require_once __DIR__ . '/../includes/db.php';

require_once __DIR__ . '/../includes/helpers.php';

require_login();

$error   = '';

$notice  = '';

// Determine which repo we're uploading to (from POST on submit, else GET).

$repoSlug = $_POST['repo'] ?? $_GET['repo'] ?? '';

$repoSlug = strtolower(trim($repoSlug));

$repo     = $repoSlug !== '' ? get_repository_by_slug($repoSlug) : null;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    csrf_verify();

    $action = $_POST['action'] ?? 'upload';

    if (!$repo) {

        $error = 'Choose a repository first.';

    } elseif ($action === 'create_folder') {

        // Manually create a (possibly nested) folder, e.g. "folder1/folder2".

        $folder = safe_relpath($_POST['folder'] ?? '');

        if ($folder === '') {

            $error = 'Enter a valid folder name (e.g. src/utils).';

        } else {

            @mkdir(UPLOAD_DIR . '/' . $repo['slug'] . '/' . $folder, 0775, true);

            create_folder((int) $repo['id'], $folder);

            header('Location: ' . url('/admin/upload.php?repo=' . urlencode($repo['slug']) . '&foldercreated=1'));

            exit;

        }

    } elseif ($action === 'upload_zip') {

        // Upload a single .zip and unpack it, recreating its folder structure.

        if (!class_exists('ZipArchive')) {

            $error = 'Zip support is not available on this server (the PHP zip extension is disabled).';

        } elseif (empty($_FILES['zip']['name']) || ($_FILES['zip']['error'] ?? UPLOAD_ERR_NO_FILE) === UPLOAD_ERR_NO_FILE) {

            $error = 'Choose a .zip file to upload.';

        } elseif ($_FILES['zip']['error'] !== UPLOAD_ERR_OK || !is_uploaded_file($_FILES['zip']['tmp_name'])) {

            $error = 'The archive could not be uploaded (it may be too large; check upload_max_filesize).';

        } else {

            $tmp    = $_FILES['zip']['tmp_name'];

            $dir    = UPLOAD_DIR . '/' . $repo['slug'];

            $target = safe_relpath($_POST['target'] ?? ''); // optional destination folder

            $zip    = new ZipArchive();

            if ($zip->open($tmp) !== true) {

                $error = 'That file is not a valid zip archive.';

            } else {

                if (!is_dir($dir)) {

                    @mkdir($dir, 0775, true);

                }

                // Collect entries, dropping macOS/Windows junk.

                $entries = [];

                for ($i = 0; $i < $zip->numFiles; $i++) {

                    $stat = $zip->statIndex($i);

                    if ($stat === false) {

                        continue;

                    }

                    $name = $stat['name'];

                    $base = basename(rtrim($name, '/'));

                    if (strpos($name, '__MACOSX/') === 0 || $base === '.DS_Store' || $base === 'Thumbs.db') {

                        continue;

                    }

                    $entries[] = $stat;

                }

                // Detect a single wrapping top-level folder to strip (e.g. "myrepo-main/").

                $stripPrefix = null;

                foreach ($entries as $stat) {

                    $first = explode('/', $stat['name'], 2)[0];

                    if ($first === '') {

                        continue;

                    }

                    if ($stripPrefix === null) {

                        $stripPrefix = $first;

                    } elseif ($stripPrefix !== $first) {

                        $stripPrefix = null; // more than one root: keep structure as-is

                        break;

                    }

                }

                $saved    = 0;

                $skipped  = [];

                $totalOut = 0;

                $aborted  = false;

                foreach ($entries as $stat) {

                    $name  = $stat['name'];

                    $isDir = substr($name, -1) === '/';

                    // Strip the common wrapping folder if there is one.

                    $name = ($stripPrefix !== null)

                        ? (string) substr($name, strlen($stripPrefix) + 1)

                        : $name;

                    $rel = safe_relpath($name);

                    if ($rel === '') {

                        continue; // e.g. the stripped root folder itself, or junk

                    }

                    if ($target !== '') {

                        $rel = $target . '/' . $rel;

                    }

                    if ($isDir) {

                        @mkdir($dir . '/' . $rel, 0775, true);

                        create_folder((int) $repo['id'], $rel);

                        continue;

                    }

                    $size = (int) $stat['size'];

                    if ($size > MAX_FILE_SIZE) {

                        $skipped[] = $name . ' (too large)';

                        continue;

                    }

                    $totalOut += $size;

                    if ($totalOut > MAX_ZIP_TOTAL) {

                        $aborted = true;

                        break;

                    }

                    $dest    = $dir . '/' . $rel;

                    $destDir = dirname($dest);

                    if (!is_dir($destDir)) {

                        @mkdir($destDir, 0775, true);

                    }

                    // Copy via the zip stream wrapper (never extractTo(), which

                    // would honor the archive's raw, unsanitised path).

                    $stream = $zip->getStream($stat['name']);

                    if ($stream === false) {

                        $skipped[] = $name . ' (unreadable)';

                        continue;

                    }

                    $out = @fopen($dest, 'wb');

                    if ($out === false) {

                        fclose($stream);

                        $skipped[] = $name . ' (could not save)';

                        continue;

                    }

                    // Manual chunked copy — some shared hosts disable

                    // stream_copy_to_file() via disable_functions.

                    while (!feof($stream)) {

                        $chunk = fread($stream, 1 << 16);

                        if ($chunk === false) {

                            break;

                        }

                        fwrite($out, $chunk);

                    }

                    fclose($out);

                    fclose($stream);

                    create_file((int) $repo['id'], $rel, $repo['slug'] . '/' . $rel, (int) filesize($dest));

                    $dirRel = dirname($rel);

                    if ($dirRel !== '.' && $dirRel !== '') {

                        create_folder((int) $repo['id'], $dirRel);

                    }

                    $saved++;

                }

                $zip->close();

                if ($aborted) {

                    $error = 'Archive too large: extraction stopped after ' . human_size(MAX_ZIP_TOTAL) . '. ' . $saved . ' file(s) were imported.';

                } elseif ($saved > 0 && empty($skipped)) {

                    header('Location: ' . url('/admin/upload.php?repo=' . urlencode($repo['slug']) . '&uploaded=' . $saved));

                    exit;

                } else {

                    $notice = $saved . ' file(s) imported from archive.';

                    if ($skipped) {

                        $error = 'Skipped: ' . implode(', ', $skipped);

                    }

                }

            }

        }

    } elseif (empty($_FILES['files']) || !is_array($_FILES['files']['name'])) {

        $error = 'No files were selected.';

    } else {

        $dir    = UPLOAD_DIR . '/' . $repo['slug'];

        $target = safe_relpath($_POST['target'] ?? ''); // optional destination folder

        if (!is_dir($dir)) {

            @mkdir($dir, 0775, true);

        }

        $saved   = 0;

        $skipped = [];

        $count   = count($_FILES['files']['name']);

        for ($i = 0; $i < $count; $i++) {

            $err = $_FILES['files']['error'][$i];

            if ($err === UPLOAD_ERR_NO_FILE) {

                continue;

            }

            $origName = $_FILES['files']['name'][$i];

            $tmp      = $_FILES['files']['tmp_name'][$i];

            $size     = (int) $_FILES['files']['size'][$i];

            if ($err !== UPLOAD_ERR_OK) {

                $skipped[] = $origName . ' (upload error)';

                continue;

            }

            if ($size > MAX_FILE_SIZE) {

                $skipped[] = $origName . ' (too large)';

                continue;

            }

            if (!is_uploaded_file($tmp)) {

                $skipped[] = $origName . ' (invalid)';

                continue;

            }

            // Preserve folder structure: use the relative path the browser sent

            // (folder upload) when present, else fall back to the basename.

            $rel = isset($_POST['relpaths'][$i]) ? safe_relpath((string) $_POST['relpaths'][$i]) : '';

            if ($rel === '') {

                $rel = safe_filename($origName);

            }

            // Nest under the chosen target folder, if any.

            if ($target !== '') {

                $rel = $target . '/' . $rel;

            }

            $dest    = $dir . '/' . $rel;

            $destDir = dirname($dest);

            if (!is_dir($destDir)) {

                @mkdir($destDir, 0775, true);

            }

            if (move_uploaded_file($tmp, $dest)) {

                create_file((int) $repo['id'], $rel, $repo['slug'] . '/' . $rel, $size);

                // Register the file's folder (and ancestors) so the tree stays complete.

                $dirRel = dirname($rel);

                if ($dirRel !== '.' && $dirRel !== '') {

                    create_folder((int) $repo['id'], $dirRel);

                }

                $saved++;

            } else {

                $skipped[] = $origName . ' (could not save)';

            }

        }

        if ($saved > 0 && empty($skipped)) {

            header('Location: ' . url('/admin/upload.php?repo=' . urlencode($repo['slug']) . '&uploaded=' . $saved));

            exit;

        }

        $notice = $saved . ' file(s) uploaded.';

        if ($skipped) {

            $error = 'Skipped: ' . implode(', ', $skipped);

        }

    }

}

if (isset($_GET['uploaded']))      { $notice = ((int) $_GET['uploaded']) . ' file(s) uploaded.'; }

if (isset($_GET['foldercreated'])) { $notice = 'Folder created.'; }

if (isset($_GET['deleted']))       { $notice = 'Deleted.'; }

$allRepos = get_repositories();

$files    = $repo ? get_files_by_repo((int) $repo['id']) : [];

$folders  = $repo ? get_folders_by_repo((int) $repo['id']) : [];

$page_title = $repo ? ('Upload files to ' . $repo['name']) : 'Upload files';

require __DIR__ . '/../includes/header.php';

?>

<nav class="crumbs"><a href="<?= e(url('/admin/dashboard.php')) ?>">dashboard</a> / upload</nav>

<h1><?= $repo ? 'Upload files to ' . e($repo['name']) : 'Upload files' ?></h1>

<?php if ($notice): ?><p class="notice"><?= e($notice) ?></p><?php endif; ?>

<?php if ($error): ?><p class="error"><?= e($error) ?></p><?php endif; ?>

<form method="post" enctype="multipart/form-data" class="card form" id="upload-form">

    <?= csrf_field() ?>

    <input type="hidden" name="action" value="upload">

    <label>Repository

        <select name="repo" required onchange="if(this.value){window.location='<?= e(url('/admin/upload.php?repo=')) ?>'+encodeURIComponent(this.value);}">

            <option value="">— choose —</option>

            <?php foreach ($allRepos as $r): ?>

                <option value="<?= e($r['slug']) ?>" <?= ($repo && $repo['slug'] === $r['slug']) ? 'selected' : '' ?>>

                    <?= e($r['name']) ?> (/<?= e($r['slug']) ?>)

                </option>

            <?php endforeach; ?>

        </select>

    </label>

    <?php if ($repo): ?>

    <label>Destination folder (optional)

        <select name="target">

            <option value="">(repository root)</option>

            <?php foreach ($folders as $fo): ?>

                <option value="<?= e($fo['path']) ?>"><?= e($fo['path']) ?>/</option>

            <?php endforeach; ?>

        </select>

    </label>

    <?php endif; ?>

    <div id="dropzone" class="dropzone">

        <p>Drag &amp; drop files or a folder here</p>

        <div class="row dropzone-buttons">

            <label class="btn-secondary file-pick">Choose files

                <input type="file" name="files[]" id="file-input" multiple hidden>

            </label>

            <label class="btn-secondary file-pick">Choose folder

                <input type="file" id="folder-input" webkitdirectory multiple hidden>

            </label>

        </div>

        <ul id="file-list" class="file-names"></ul>

    </div>

    <button type="submit">Upload</button>

    <p class="muted">Max <?= e(human_size(MAX_FILE_SIZE)) ?> per file. Folder structure is preserved.</p>

</form>

<?php if ($repo): ?>

<section class="card">

    <h2>Upload a zip</h2>

    <form method="post" enctype="multipart/form-data" class="form">

        <?= csrf_field() ?>

        <input type="hidden" name="action" value="upload_zip">

        <input type="hidden" name="repo" value="<?= e($repo['slug']) ?>">

        <label>Destination folder (optional)

            <select name="target">

                <option value="">(repository root)</option>

                <?php foreach ($folders as $fo): ?>

                    <option value="<?= e($fo['path']) ?>"><?= e($fo['path']) ?>/</option>

                <?php endforeach; ?>

            </select>

        </label>

        <label>Zip archive

            <input type="file" name="zip" accept=".zip,application/zip" required>

        </label>

        <button type="submit">Upload &amp; unpack</button>

        <p class="muted">The archive is unpacked into the repository, preserving its folders. A single wrapping top-level folder is stripped automatically.</p>

    </form>

</section>

<section class="card">

    <h2>Create folder</h2>

    <form method="post" class="form">

        <?= csrf_field() ?>

        <input type="hidden" name="action" value="create_folder">

        <input type="hidden" name="repo" value="<?= e($repo['slug']) ?>">

        <label>Folder path

            <input type="text" name="folder" placeholder="folder1/folder2/folder3" required>

        </label>

        <p class="muted">Use “/” to nest. Each level is created automatically.</p>

        <button type="submit">Create folder</button>

    </form>

</section>

<section>

    <h2>Contents of /<?= e($repo['slug']) ?></h2>

    <?php if (empty($files) && empty($folders)): ?>

        <p class="empty">Empty. Upload files or create a folder above.</p>

    <?php else: ?>

        <table class="file-table">

            <thead><tr><th>Name</th><th>Size</th><th></th></tr></thead>

            <tbody>

            <?php foreach ($folders as $fo): ?>

                <tr>

                    <td><span class="dir">&#128193;</span> <?= e($fo['path']) ?>/</td>

                    <td class="muted">folder</td>

                    <td>

                        <form method="post" action="<?= e(url('/admin/delete.php')) ?>" class="inline"

                              onsubmit="return confirm('Delete folder &quot;<?= e($fo['path']) ?>&quot; and everything inside it?');">

                            <?= csrf_field() ?>

                            <input type="hidden" name="type" value="folder">

                            <input type="hidden" name="id" value="<?= (int) $fo['id'] ?>">

                            <input type="hidden" name="repo" value="<?= e($repo['slug']) ?>">

                            <button type="submit" class="link-btn danger">Delete</button>

                        </form>

                    </td>

                </tr>

            <?php endforeach; ?>

            <?php foreach ($files as $f): ?>

                <tr>

                    <td><a href="<?= e(blob_url($repo['slug'], $f['filename'])) ?>"><?= e($f['filename']) ?></a></td>

                    <td class="muted"><?= e(human_size((int) $f['filesize'])) ?></td>

                    <td>

                        <form method="post" action="<?= e(url('/admin/delete.php')) ?>" class="inline"

                              onsubmit="return confirm('Delete <?= e($f['filename']) ?>?');">

                            <?= csrf_field() ?>

                            <input type="hidden" name="type" value="file">

                            <input type="hidden" name="id" value="<?= (int) $f['id'] ?>">

                            <input type="hidden" name="repo" value="<?= e($repo['slug']) ?>">

                            <button type="submit" class="link-btn danger">Delete</button>

                        </form>

                    </td>

                </tr>

            <?php endforeach; ?>

            </tbody>

        </table>

    <?php endif; ?>

</section>

<?php endif; ?>

<script>

// Vanilla JS enhancement. Supports picking/dropping individual files OR whole

// folders. For folders we read each file's relative path and send it in a

// parallel relpaths[] field so the server can recreate the directory tree.

(function () {

    var dz = document.getElementById('dropzone');

    var fileInput = document.getElementById('file-input');

    var folderInput = document.getElementById('folder-input');

    var list = document.getElementById('file-list');

    var form = document.getElementById('upload-form');

    if (!dz || !form || !fileInput) return;

    var selected = []; // array of { file: File, path: string }

    function render() {

        list.innerHTML = '';

        selected.forEach(function (item) {

            var li = document.createElement('li');

            li.textContent = item.path;

            list.appendChild(li);

        });

        if (selected.length) {

            var summary = document.createElement('li');

            summary.className = 'muted';

            summary.textContent = selected.length + ' file(s) ready to upload';

            list.appendChild(summary);

        }

    }

    function addFileList(files, useRelative) {

        for (var i = 0; i < files.length; i++) {

            var f = files[i];

            var p = (useRelative && f.webkitRelativePath) ? f.webkitRelativePath : f.name;

            selected.push({ file: f, path: p });

        }

        render();

    }

    fileInput.addEventListener('change', function () {

        addFileList(fileInput.files, false);

        fileInput.value = '';

    });

    folderInput.addEventListener('change', function () {

        addFileList(folderInput.files, true);

        folderInput.value = '';

    });

    ['dragenter', 'dragover'].forEach(function (ev) {

        dz.addEventListener(ev, function (e) { e.preventDefault(); dz.classList.add('over'); });

    });

    ['dragleave', 'drop'].forEach(function (ev) {

        dz.addEventListener(ev, function (e) { e.preventDefault(); dz.classList.remove('over'); });

    });

    dz.addEventListener('drop', function (e) {

        var items = e.dataTransfer && e.dataTransfer.items;

        if (items && items.length && items[0].webkitGetAsEntry) {

            var pending = 0, queued = false;

            function done() { if (queued && pending === 0) render(); }

            for (var i = 0; i < items.length; i++) {

                var entry = items[i].webkitGetAsEntry();

                if (entry) { pending++; traverse(entry, '', function () { pending--; done(); }); }

            }

            queued = true; done();

        } else if (e.dataTransfer && e.dataTransfer.files) {

            addFileList(e.dataTransfer.files, false);

        }

    });

    // Recursively walk a dropped directory entry, collecting files + paths.

    function traverse(entry, prefix, cb) {

        if (entry.isFile) {

            entry.file(function (file) {

                selected.push({ file: file, path: prefix + entry.name });

                cb();

            }, cb);

        } else if (entry.isDirectory) {

            var reader = entry.createReader();

            var all = [];

            (function readBatch() {

                reader.readEntries(function (batch) {

                    if (batch.length) {

                        all = all.concat(batch);

                        readBatch(); // readEntries returns files in chunks

                    } else if (!all.length) {

                        cb();

                    } else {

                        var remaining = all.length;

                        all.forEach(function (child) {

                            traverse(child, prefix + entry.name + '/', function () {

                                if (--remaining === 0) cb();

                            });

                        });

                    }

                }, cb);

            })();

        } else { cb(); }

    }

    form.addEventListener('submit', function (e) {

        if (!selected.length) return; // nothing staged: let server-side validation handle it

        if (typeof DataTransfer === 'undefined') return; // very old browser: submit as-is

        e.preventDefault();

        // Rebuild the file input and parallel relpaths[] hidden fields, in order.

        form.querySelectorAll('input[name="relpaths[]"]').forEach(function (n) { n.remove(); });

        var dt = new DataTransfer();

        selected.forEach(function (item) {

            dt.items.add(item.file);

            var h = document.createElement('input');

            h.type = 'hidden';

            h.name = 'relpaths[]';

            h.value = item.path;

            form.appendChild(h);

        });

        fileInput.files = dt.files;

        form.submit();

    });

})();

</script>

<?php

require __DIR__ . '/../includes/footer.php';