<?php
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/db.php';
require_once __DIR__ . '/../includes/helpers.php';

require_login();

// POST-only.
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    exit('Method not allowed.');
}
csrf_verify();

/** Recursively remove a directory identified by a path relative to UPLOAD_DIR. */
function remove_upload_dir(string $relPath): void
{
    $base = realpath(UPLOAD_DIR);
    $dir  = realpath(UPLOAD_DIR . '/' . $relPath);
    if ($base === false || $dir === false) {
        return;
    }
    // Safety: never touch anything at or above the uploads root.
    if ($dir === $base || strpos($dir, $base . DIRECTORY_SEPARATOR) !== 0) {
        return;
    }
    $items = new RecursiveIteratorIterator(
        new RecursiveDirectoryIterator($dir, FilesystemIterator::SKIP_DOTS),
        RecursiveIteratorIterator::CHILD_FIRST
    );
    foreach ($items as $item) {
        $item->isDir() ? @rmdir($item->getPathname()) : @unlink($item->getPathname());
    }
    @rmdir($dir);
}

$type = $_POST['type'] ?? '';

if ($type === 'repo') {
    $id   = (int) ($_POST['id'] ?? 0);
    $repo = get_repository($id);
    if ($repo) {
        remove_upload_dir($repo['slug']);
        delete_repository($id); // cascades file + folder rows
    }
    header('Location: ' . url('/admin/dashboard.php?deleted=1'));
    exit;
}

if ($type === 'folder') {
    $id     = (int) ($_POST['id'] ?? 0);
    $folder = get_folder($id);
    if ($folder) {
        $repo = get_repository((int) $folder['repo_id']);
        $path = delete_folder($id); // removes descendant file + folder rows
        if ($repo && $path !== null) {
            remove_upload_dir($repo['slug'] . '/' . $path);
        }
        if ($repo) {
            header('Location: ' . url('/admin/upload.php?repo=' . urlencode($repo['slug']) . '&deleted=1'));
            exit;
        }
    }
    header('Location: ' . url('/admin/dashboard.php?deleted=1'));
    exit;
}

if ($type === 'file') {
    $id   = (int) ($_POST['id'] ?? 0);
    $file = get_file($id);
    if ($file) {
        $repo = get_repository((int) $file['repo_id']);
        // Delete the file on disk, guarding against traversal.
        $base = realpath(UPLOAD_DIR);
        $full = realpath(UPLOAD_DIR . '/' . $file['filepath']);
        if ($base !== false && $full !== false && strpos($full, $base . DIRECTORY_SEPARATOR) === 0) {
            @unlink($full);
        }
        delete_file($id);
        if ($repo) {
            header('Location: ' . url('/admin/upload.php?repo=' . urlencode($repo['slug']) . '&deleted=1'));
            exit;
        }
    }
    header('Location: ' . url('/admin/dashboard.php?deleted=1'));
    exit;
}

http_response_code(400);
exit('Unknown delete type.');