<?php
declare(strict_types=1);
header('Content-Type: application/json');

require_once __DIR__ . '/../../lib/auth.php';
require_once __DIR__ . '/../../lib/chunked.php';

require_https();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['error' => 'method not allowed']);
    exit;
}

if (!rate_limit_check()) {
    http_response_code(429);
    echo json_encode(['error' => 'too many failed attempts, try again later']);
    exit;
}

$pw = password_from_request();
if ($pw === null || $pw === '' || !verify_password($pw)) {
    rate_limit_fail();
    http_response_code(401);
    echo json_encode(['error' => 'invalid password']);
    exit;
}
rate_limit_reset();

$id = (string)($_POST['upload_id'] ?? '');
if ($id === '' && str_starts_with($_SERVER['CONTENT_TYPE'] ?? '', 'application/json')) {
    $body = json_decode((string) file_get_contents('php://input'), true);
    if (is_array($body)) $id = (string)($body['upload_id'] ?? '');
}

if (!is_valid_upload_id($id)) {
    http_response_code(400);
    echo json_encode(['error' => 'invalid upload id']);
    exit;
}

delete_upload_dir($id);
echo json_encode(['aborted' => $id]);