<?php
/**
 * Forward /citpl_website/uploads/* → Node static uploads (no mod_proxy required).
 */
declare(strict_types=1);

$apiOrigin = getenv('CITPL_API_ORIGIN') ?: 'http://127.0.0.1:3001';
$file = $_GET['file'] ?? '';
$file = str_replace(['..', '\\'], '', $file);
$file = ltrim($file, '/');

if ($file === '') {
  http_response_code(400);
  header('Content-Type: application/json');
  echo json_encode(['error' => 'Missing file', 'code' => 'VALIDATION']);
  exit;
}

$url = rtrim($apiOrigin, '/') . '/uploads/' . str_replace(' ', '%20', $file);

if (!function_exists('curl_init')) {
  http_response_code(500);
  exit('curl required');
}

$ch = curl_init($url);
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HEADER => true,
  CURLOPT_FOLLOWLOCATION => false,
  CURLOPT_CONNECTTIMEOUT => 5,
  CURLOPT_TIMEOUT => 60,
]);

$response = curl_exec($ch);
if ($response === false) {
  curl_close($ch);
  http_response_code(502);
  exit('Upload server unreachable');
}

$status = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
$headerSize = (int) curl_getinfo($ch, CURLINFO_HEADER_SIZE);
curl_close($ch);

http_response_code($status > 0 ? $status : 502);
$rawHeaders = substr($response, 0, $headerSize);
$body = substr($response, $headerSize);

$skip = ['transfer-encoding', 'connection', 'keep-alive'];
foreach (explode("\r\n", $rawHeaders) as $line) {
  if ($line === '' || stripos($line, 'HTTP/') === 0) {
    continue;
  }
  $parts = explode(':', $line, 2);
  if (count($parts) < 2) {
    continue;
  }
  $name = trim($parts[0]);
  if (in_array(strtolower($name), $skip, true)) {
    continue;
  }
  header($name . ':' . $parts[1], false);
}

echo $body;