<?php
// manage_documents.php - Dokumentenverwaltung für einen Gegenstand
require_once 'db.php';
require_once 'helpers.php';
requireLogin();

// Prüfen ob Dokumente-Feature aktiviert ist
$user = $db->selectOne("SELECT dokumente_aktiv FROM users WHERE username = ?", [$_SESSION['username']]);
if (!$user || !$user['dokumente_aktiv']) {
    redirectWithMessage('index.php', 'Dokumente-Feature ist nicht aktiviert', 'error');
}

$wertsache_id = filter_var($_GET['id'] ?? 0, FILTER_VALIDATE_INT);
if (!$wertsache_id) {
    redirectWithMessage('index.php', t('doc_invalid_id'), 'error');
}

// Wertsache laden
try {
    $wertsache = $db->selectOne("SELECT * FROM wertsachen WHERE id = ?", [$wertsache_id]);
    if (!$wertsache) {
        redirectWithMessage('index.php', 'Gegenstand nicht gefunden', 'error');
    }
} catch (PDOException $e) {
    die('Fehler beim Laden.');
}

define('PAGE_TITLE', 'Dokumente verwalten - ' . htmlspecialchars($wertsache['name']));
define('DOCUMENTS_DIR', __DIR__ . '/documents/');
define('MAX_DOCUMENT_SIZE', 5 * 1024 * 1024); // 5 MB
define('ALLOWED_DOCUMENT_TYPES', [
    'application/pdf',
    'application/msword',
    'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
    'application/vnd.ms-excel',
    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
    'image/jpeg',
    'image/png'
]);
define('ALLOWED_DOCUMENT_EXTENSIONS', ['pdf', 'doc', 'docx', 'xls', 'xlsx', 'jpg', 'jpeg', 'png']);

$message = '';
$error = '';

// Dokument hochladen
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['dokument'])) {
    validateRequest();
    
    $file = $_FILES['dokument'];
    
    if ($file['error'] === UPLOAD_ERR_OK) {
        $fileSize = $file['size'];
        $fileType = mime_content_type($file['tmp_name']);
        $originalName = basename($file['name']);
        $extension = strtolower(pathinfo($originalName, PATHINFO_EXTENSION));
        
        // Validierung
        if ($fileSize > MAX_DOCUMENT_SIZE) {
            $error = t('doc_too_large');
        } elseif (!in_array($fileType, ALLOWED_DOCUMENT_TYPES)) {
            $error = 'Dateityp nicht erlaubt';
        } elseif (!in_array($extension, ALLOWED_DOCUMENT_EXTENSIONS)) {
            $error = 'Dateiendung nicht erlaubt';
        } else {
            // Verzeichnis erstellen falls nicht vorhanden
            if (!is_dir(DOCUMENTS_DIR)) {
                mkdir(DOCUMENTS_DIR, 0755, true);
            }
            
            // Eindeutigen Dateinamen generieren
            $filename = uniqid('doc_', true) . '_' . time() . '.' . $extension;
            $filepath = DOCUMENTS_DIR . $filename;
            
            if (move_uploaded_file($file['tmp_name'], $filepath)) {
                try {
                    $db->execute(
                        "INSERT INTO dokumente (wertsache_id, dateiname, original_name, dateityp, dateigröße, hochgeladen_von) 
                         VALUES (?, ?, ?, ?, ?, ?)",
                        [$wertsache_id, $filename, $originalName, $fileType, $fileSize, $_SESSION['username']]
                    );
                    
                    $message = 'Dokument erfolgreich hochgeladen';
                    Security::logSecurityEvent('document_uploaded', [
                        'wertsache_id' => $wertsache_id,
                        'filename' => $originalName
                    ]);
                } catch (PDOException $e) {
                    unlink($filepath);
                    $error = 'Fehler beim Speichern in Datenbank';
                }
            } else {
                $error = 'Fehler beim Hochladen';
            }
        }
    } else {
        $error = 'Upload-Fehler';
    }
}

// Dokument löschen
if (isset($_GET['delete'])) {
    validateRequest();
    
    $doc_id = filter_var($_GET['delete'], FILTER_VALIDATE_INT);
    if ($doc_id) {
        try {
            $doc = $db->selectOne("SELECT * FROM dokumente WHERE id = ? AND wertsache_id = ?", [$doc_id, $wertsache_id]);
            
            if ($doc) {
                $filepath = DOCUMENTS_DIR . $doc['dateiname'];
                if (file_exists($filepath)) {
                    unlink($filepath);
                }
                
                $db->execute("DELETE FROM dokumente WHERE id = ?", [$doc_id]);
                $message = t('doc_deleted');
                
                Security::logSecurityEvent('document_deleted', [
                    'doc_id' => $doc_id,
                    'wertsache_id' => $wertsache_id
                ]);
            }
        } catch (PDOException $e) {
            $error = t('doc_error_delete');
        }
    }
}

// Dokumente laden
try {
    $dokumente = $db->select("SELECT * FROM dokumente WHERE wertsache_id = ? ORDER BY hochgeladen_am DESC", [$wertsache_id]);
} catch (PDOException $e) {
    $dokumente = [];
}

include 'header_next_page.php';
?>

<main class="backend-main">
<h2>📄 Dokumente: <?php echo htmlspecialchars($wertsache['name']); ?></h2>



<?php if ($message): ?>
    <div class="alert alert-success"><i class="ti ti-circle-check"></i> <?php echo htmlspecialchars($message); ?></div>
<?php endif; ?>

<?php if ($error): ?>
    <div class="alert alert-danger"><i class="ti ti-circle-x"></i> <?php echo htmlspecialchars($error); ?></div>
<?php endif; ?>

<div class="activity-timeline" style="margin-bottom:24px;">
    <h3>Neues Dokument hochladen</h3>
    <form method="POST" action="" enctype="multipart/form-data">
        <?php echo Security::getCSRFInput(); ?>
        
        <div class="form-group">
            <label for="dokument">Dokument auswählen:</label>
            <input type="file" id="dokument" name="dokument" required 
                   accept=".pdf,.doc,.docx,.xls,.xlsx,.jpg,.jpeg,.png">
            <small>
                Erlaubte Formate: PDF, Word (DOC/DOCX), Excel (XLS/XLSX), Bilder (JPG/PNG)<br>
                Maximale Größe: 5 MB
            </small>
        </div>
        
        <button type="submit" class="vs-btn vs-btn-primary">📤 Hochladen</button>
    </form>
</div>

<div class="activity-timeline" style="margin-bottom:24px;">
    <h3>Vorhandene Dokumente (<?php echo count($dokumente); ?>)</h3>
    
    <?php if (empty($dokumente)): ?>
        <p style="color: #999; padding: 20px; text-align: center;">Keine Dokumente vorhanden</p>
    <?php else: ?>
        <table class="backend-table">
            <thead>
                <tr>
                    <th>Typ</th>
                    <th>Dateiname</th>
                    <th>Größe</th>
                    <th>Hochgeladen</th>
                    <th>Von</th>
                    <th>Aktionen</th>
                </tr>
            </thead>
            <tbody>
                <?php foreach ($dokumente as $doc): ?>
                    <tr>
                        <td>
                            <?php
                            $ext = strtolower(pathinfo($doc['original_name'], PATHINFO_EXTENSION));
                            $icon = '📄';
                            if ($ext === 'pdf') $icon = '📕';
                            elseif (in_array($ext, ['doc', 'docx'])) $icon = '📘';
                            elseif (in_array($ext, ['xls', 'xlsx'])) $icon = '📗';
                            elseif (in_array($ext, ['jpg', 'jpeg', 'png'])) $icon = '🖼️';
                            echo $icon;
                            ?>
                        </td>
                        <td><?php echo htmlspecialchars($doc['original_name']); ?></td>
                        <td><?php echo number_format($doc['dateigröße'] / 1024, 0); ?> KB</td>
                        <td><?php echo date('d.m.Y H:i', strtotime($doc['hochgeladen_am'])); ?></td>
                        <td><?php echo htmlspecialchars($doc['hochgeladen_von']); ?></td>
                        <td>
                            <?php
                            // Ansicht-Button nur für PDFs und Bilder
                            $canView = in_array($ext, ['pdf', 'jpg', 'jpeg', 'png']);
                            if ($canView):
                            ?>
                                <a href="download_document.php?id=<?php echo $doc['id']; ?>&view=1" 
                                   class="vs-btn vs-btn-sm" target="_blank" 
                                   title="Im Browser öffnen">👁️ Ansicht</a>
                            <?php endif; ?>
                            <a href="download_document.php?id=<?php echo $doc['id']; ?>" 
                               class="vs-btn vs-btn-sm vs-btn-secondary" target="_blank" 
                               title="Herunterladen">⬇️ Download</a>
                            <a href="?id=<?php echo $wertsache_id; ?>&delete=<?php echo $doc['id']; ?>&<?php echo http_build_query(['csrf_token' => $_SESSION['csrf_token']]); ?>" 
                               class="vs-btn vs-btn-sm vs-btn-danger"
                               onclick="return confirm('<?php echo t('doc_confirm_delete'); ?>')">🗑️ Löschen</a>
                        </td>
                    </tr>
                <?php endforeach; ?>
            </tbody>
        </table>
    <?php endif; ?>
</div>

<div style="display:flex; gap:12px; margin-top:20px;">
    <a href="edit.php?id=<?php echo $wertsache_id; ?>" class="vs-btn vs-btn-secondary">← Zurück zum Gegenstand</a>
    <a href="index.php" class="vs-btn vs-btn-secondary">🏠 Zur Übersicht</a>
</div>

</main>

<style>
.alert { padding:15px 20px; border-radius:8px; margin-bottom:20px; border-left:4px solid; }
.alert-success { background:var(--vs-success-light,#f0fdf4); border-color:var(--vs-success,#22c55e); color:#166534; }
.alert-danger  { background:var(--vs-danger-light,#fef2f2);  border-color:var(--vs-danger,#ef4444);  color:#991b1b; }
.backend-table { width:100%; border-collapse:collapse; margin-top:15px; }
.backend-table thead tr { background:var(--bg-color,#f8fafc); border-bottom:2px solid var(--border-color,#e2e8f0); }
.backend-table th, .backend-table td { padding:12px; text-align:left; font-size:14px; }
.backend-table tbody tr { border-bottom:1px solid var(--border-color,#e2e8f0); }
.backend-table tbody tr:hover { background:var(--bg-color,#f8fafc); }
</style>

<?php include 'footer_next.php'; ?>
