<?php
require_once __DIR__ . '/../lib/auth.php';
require_login();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: ../pages/dokumentenarchiv.php');
    exit;
}

$id = (int) ($_POST['id'] ?? 0);
if ($id <= 0) {
    http_response_code(400);
    echo 'Ungültige Anfrage.';
    exit;
}

$stmt = db()->prepare('SELECT * FROM dokumente WHERE id = ?');
$stmt->execute([$id]);
$doc = $stmt->fetch();

if (!$doc) {
    http_response_code(404);
    echo 'Dokument nicht gefunden.';
    exit;
}

$user = current_user();
if ((int) $doc['user_id'] !== (int) $user['id'] && !is_admin()) {
    http_response_code(403);
    echo 'Keine Berechtigung.';
    exit;
}

$file_path = dirname(__DIR__) . '/uploads/' . $doc['filename'];
if (is_file($file_path)) {
    unlink($file_path);
}

db()->prepare('DELETE FROM dokumente WHERE id = ?')->execute([$id]);

header('Location: ../pages/dokumentenarchiv.php?deleted=1');
exit;