<?php
// Allow large uploads (adjust as needed)
ini_set('upload_max_filesize', '100M');
ini_set('post_max_size', '100M');
ini_set('max_execution_time', '300');

// Allow only POST
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(["error" => "Only POST allowed"]);
    exit;
}

// Check file
if (!isset($_FILES['file'])) {
    http_response_code(400);
    echo json_encode(["error" => "No file uploaded"]);
    exit;
}

$uploadDir = __DIR__ . "/uploads/";
$file = $_FILES['file'];

// Basic validation
if ($file['error'] !== UPLOAD_ERR_OK) {
    http_response_code(400);
    echo json_encode(["error" => "Upload failed"]);
    exit;
}

// Optional: restrict file types
$allowedTypes = ['image/jpeg', 'image/png', 'application/pdf', 'video/mp4'];
if (!in_array($file['type'], $allowedTypes)) {
    http_response_code(400);
    echo json_encode(["error" => "File type not allowed"]);
    exit;
}

// Prevent overwrite
$filename = time() . "_" . basename($file['name']);
$targetPath = $uploadDir . $filename;

// Move file
if (move_uploaded_file($file['tmp_name'], $targetPath)) {
    echo json_encode([
        "status" => "success",
        "filename" => $filename,
        "path" => "uploads/" . $filename
    ]);
} else {
    http_response_code(500);
    echo json_encode(["error" => "Failed to save file"]);
}