<?php
/**
 * API Upload & Download untuk Media Storage
 * Engine berada di: /var/www/html/api.php
 * Storage tujuan: /repository/media/
 */

// ==========================================
// 1. KONFIGURASI (WAJIB DIUBAH)
// ==========================================
define('API_KEY', 'GANTI_DENGAN_KUNCI_RAHASIA_ANDA_12345'); 
define('DOWNLOAD_USERNAME', 'admin_media'); 
// Paste hasil hash dari: php -r "echo password_hash('PasswordAnda', PASSWORD_BCRYPT);"
define('DOWNLOAD_PASSWORD_HASH', '$2y$10$...PASTE_HASH_ANDA_DISINI...'); 

define('MAX_FILE_SIZE_MB', 10); 
define('BASE_URL', 'https://media.jgec.jp');

// INI KUNCINYA: Arahkan ke folder storage Anda
define('BASE_PATH', '/repository/media/'); 

define('ALLOWED_FOLDERS', ['KK', 'KTP', 'IJAZAH', 'AKTA']);
define('ALLOWED_EXTENSIONS', [
    'pdf', 'jpg', 'jpeg', 'png',
    'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx',
    'rtf', 'odt', 'ods', 'odp'
]);

// ==========================================
// 2. HEADER & RESPONSE HANDLER
// ==========================================
header('Content-Type: application/json; charset=utf-8');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Username, X-Password');

// Handle preflight OPTIONS request
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}

function sendResponse($status, $message, $data = null, $httpCode = 200) {
    http_response_code($httpCode);
    $response = ['status' => $status, 'message' => $message];
    if ($data !== null) $response['data'] = $data;
    echo json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
    exit;
}

// ==========================================
// 3. FUNGSI VALIDASI & AUTENTIKASI
// ==========================================
function checkApiKey() {
    $headers = getallheaders();
    $key = isset($headers['Authorization']) ? trim(str_replace('Bearer ', '', $headers['Authorization'])) : (isset($_GET['api_key']) ? trim($_GET['api_key']) : null);
    if (empty($key) || $key !== API_KEY) sendResponse('error', 'Unauthorized: API Key tidak valid', null, 401);
}

function checkDownloadAuth() {
    checkApiKey();
    $headers = getallheaders();
    $user = isset($headers['X-Username']) ? trim($headers['X-Username']) : (isset($_GET['username']) ? trim($_GET['username']) : null);
    $pass = isset($headers['X-Password']) ? trim($headers['X-Password']) : (isset($_GET['password']) ? trim($_GET['password']) : null);
    
    if (empty($user) || empty($pass)) sendResponse('error', 'Username dan password wajib diisi', null, 401);
    if ($user !== DOWNLOAD_USERNAME) sendResponse('error', 'Unauthorized: Username tidak valid', null, 401);
    if (!password_verify($pass, DOWNLOAD_PASSWORD_HASH)) sendResponse('error', 'Unauthorized: Password salah', null, 401);
}

function validateFolder($folder) {
    $folder = strtoupper(trim($folder));
    if (!in_array($folder, ALLOWED_FOLDERS)) sendResponse('error', 'Folder tidak valid. Gunakan: ' . implode(', ', ALLOWED_FOLDERS), null, 400);
    return $folder;
}

function validateFile($filename, $size) {
    $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
    if (!in_array($ext, ALLOWED_EXTENSIONS)) sendResponse('error', 'Tipe file tidak diizinkan. Hanya: ' . implode(', ', ALLOWED_EXTENSIONS), null, 400);
    if ($size > MAX_FILE_SIZE_MB * 1024 * 1024) sendResponse('error', 'Ukuran file melebihi ' . MAX_FILE_SIZE_MB . ' MB', null, 400);
}

// ==========================================
// 4. ROUTING
// ==========================================
$method = $_SERVER['REQUEST_METHOD'];
$action = $_GET['action'] ?? '';

if ($method === 'POST' && $action === 'upload') {
    checkApiKey();
    $folder = validateFolder($_POST['folder'] ?? '');
    $targetDir = BASE_PATH . $folder . '/';
    
    if (!is_dir($targetDir)) sendResponse('error', 'Folder tujuan tidak ditemukan di server', null, 500);
    if (!isset($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
        sendResponse('error', 'File tidak ditemukan atau error saat upload', null, 400);
    }
    
    $file = $_FILES['file'];
    validateFile($file['name'], $file['size']);
    
    $uniqueName = date('Ymd_His') . '_' . substr(md5(uniqid()), 0, 8) . '.' . pathinfo($file['name'], PATHINFO_EXTENSION);
    $targetFile = $targetDir . $uniqueName;
    
    if (move_uploaded_file($file['tmp_name'], $targetFile)) {
        sendResponse('success', 'File berhasil diupload', [
            'folder' => $folder,
            'original_filename' => $file['name'],
            'saved_filename' => $uniqueName,
            'file_size_mb' => round($file['size'] / 1024 / 1024, 2),
            'download_link' => BASE_URL . '/api.php?action=download&folder=' . $folder . '&file=' . $uniqueName,
            'uploaded_at' => date('Y-m-d H:i:s')
        ], 201);
    } else {
        sendResponse('error', 'Gagal menyimpan file. Cek permission folder /repository/media/', null, 500);
    }

} elseif ($method === 'GET' && $action === 'download') {
    checkDownloadAuth();
    $folder = validateFolder($_GET['folder'] ?? '');
    $filename = basename($_GET['file'] ?? '');
    
    if (empty($filename)) sendResponse('error', 'Nama file kosong', null, 400);
    
    $filePath = BASE_PATH . $folder . '/' . $filename;
    if (!file_exists($filePath)) sendResponse('error', 'File tidak ditemukan', null, 404);
    
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="' . $filename . '"');
    header('Content-Length: ' . filesize($filePath));
    readfile($filePath);
    exit;

} else {
    sendResponse('error', 'Endpoint tidak valid', [
        'usage' => [
            'upload' => 'POST https://media.jgec.jp/api.php?action=upload (Header: Authorization: Bearer API_KEY)',
            'download' => 'GET https://media.jgec.jp/api.php?action=download&folder=X&file=Y (Header: Authorization + X-Username + X-Password)'
        ]
    ], 404);
}
?>