<?php
/**
 * Module F: Media Elimination Engine
 * Target Path: htdocs/api/v1/media/delete.php
 */

// Inherit global variables and database connection instance
require_once __DIR__ . '/../../../config.php';

// Instagram legacy clients send a POST payload request to execute deletions
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    die(json_encode(["status" => "fail", "message" => "Method not allowed. Use POST pipeline."]));
}

// 1. Session Identity Handshake Verification
$sessionCookie = $_COOKIE['sessionid'] ?? '';
if (empty($sessionCookie) || strpos($sessionCookie, 'nostolga_sess_') !== 0) {
    http_response_code(401);
    die(json_encode(["status" => "fail", "message" => "Unauthorized client session context."]));
}

// Decode active user primary key ID
$userId = (int)str_replace('nostolga_sess_', '', $sessionCookie);

// 2. Capture the Media ID Passed implicitly from our .htaccess Routing Engine
$mediaId = (int)($_GET['media_id'] ?? 0);

if ($mediaId <= 0) {
    http_response_code(400);
    die(json_encode(["status" => "fail", "message" => "Invalid target media identifier signature."]));
}

$db = getDB();

try {
    // 3. Ownership Verification Check
    // Locate the post to ensure it exists and belongs explicitly to the logged-in user
    $stmt = $db->prepare("SELECT user_id FROM posts WHERE id = ?");
    $stmt->execute([$mediaId]);
    $post = $stmt->fetch();

    if (!$post) {
        http_response_code(404);
        die(json_encode(["status" => "fail", "message" => "Target media asset registry record not found."]));
    }

    // Security Gate: Block malicious deletions from mismatched user accounts
    if ((int)$post['user_id'] !== $userId) {
        http_response_code(403);
        die(json_encode(["status" => "fail", "message" => "Access denied. Action signature authorization failure."]));
    }

    // 4. Execute the SQL Data Purge
    // InnoDB cascades or handles deletion cleanly across our constraints
    $deleteStmt = $db->prepare("DELETE FROM posts WHERE id = ?");
    $deleteStmt->execute([$mediaId]);

    // 5. Dispatch success payload confirmation back to the app UI matrix
    http_response_code(200);
    echo json_encode([
        "did_delete" => true,
        "status"     => "ok"
    ]);
    exit;

} catch (PDOException $e) {
    http_response_code(500);
    die(json_encode(["status" => "fail", "message" => "Database ledger serialization drop encountered during record purge."]));
}