<?php
// Delete handler: removes an image file from /img and returns JSON.
require_once __DIR__ . '/../auth/auth.php';
dreamgirl_require_login_json();
header('Content-Type: application/json; charset=utf-8');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
  http_response_code(405);
  echo json_encode(['ok' => false, 'error' => 'Method not allowed']);
  exit;
}

$filename = isset($_POST['filename']) ? (string)$_POST['filename'] : '';
$filename = basename($filename);

if ($filename === '' || $filename === '.' || $filename === '..') {
  http_response_code(400);
  echo json_encode(['ok' => false, 'error' => 'Invalid filename']);
  exit;
}

$allowedExt = ['jpg', 'jpeg', 'png', 'gif', 'webp'];
$ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
if (!in_array($ext, $allowedExt, true)) {
  http_response_code(400);
  echo json_encode(['ok' => false, 'error' => 'Unsupported file type']);
  exit;
}

$imgDir = realpath(__DIR__ . '/../img');
if ($imgDir === false || !is_dir($imgDir)) {
  http_response_code(500);
  echo json_encode(['ok' => false, 'error' => 'img directory not found']);
  exit;
}

$path = $imgDir . DIRECTORY_SEPARATOR . $filename;
$realPath = realpath($path);

if ($realPath === false || !is_file($realPath) || dirname($realPath) !== $imgDir) {
  http_response_code(404);
  echo json_encode(['ok' => false, 'error' => 'File not found']);
  exit;
}

if (!@unlink($realPath)) {
  http_response_code(500);
  echo json_encode(['ok' => false, 'error' => 'Failed to delete file (check permissions)']);
  exit;
}

echo json_encode(['ok' => true, 'filename' => $filename], JSON_UNESCAPED_UNICODE);