<?php
/**
 * POST /api/journal/delete-screenshot — {screenshot_id}. Ownership
 * enforced by ScopedDb::select() itself (every query is scoped to
 * user_id = this session's user), so a foreign screenshot_id simply
 * matches zero rows rather than deleting someone else's file.
 */
require_once __DIR__ . '/../../src/ScreenshotStorage.php';

header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['error' => 'Method not allowed']);
    exit;
}

$userId = $auth->requireAuth();

$input = json_decode(file_get_contents('php://input'), true) ?: $_POST;
$screenshotId = trim((string)($input['screenshot_id'] ?? ''));
if ($screenshotId === '') {
    http_response_code(400);
    echo json_encode(['error' => 'screenshot_id is required']);
    exit;
}

$row = $db->selectById('trade_screenshots', $screenshotId);
if (!$row) {
    http_response_code(404);
    echo json_encode(['error' => 'Screenshot not found']);
    exit;
}

$db->raw('DELETE FROM trade_screenshots WHERE id = :id AND user_id = :uid', [':id' => $screenshotId, ':uid' => $userId]);
ScreenshotStorage::delete($row['storage_driver'], $row['storage_key']);

echo json_encode(['success' => true]);
