?php
// index.php — place at index.php on your server

define('UPLOAD_USERNAME', 'IAmAdmin');  // change this
define('UPLOAD_PASSWORD', 'IAmStFrancisClinic2026***');  // change this
define('UPLOAD_DIR', __DIR__ . '/');
define('BASE_URL', 'https://stfrancisclinic.online');

// Basic Auth check
$headers = getallheaders();
$auth = $headers['Authorization'] ?? '';
if (strpos($auth, 'Basic ') === 0) {
    $decoded = base64_decode(substr($auth, 6));
    [$user, $pass] = explode(':', $decoded, 2);
    if ($user !== UPLOAD_USERNAME || $pass !== UPLOAD_PASSWORD) {
        http_response_code(401);
        echo json_encode(['error' => 'Unauthorized']);
        exit;
    }
} else {
    http_response_code(401);
    echo json_encode(['error' => 'Unauthorized']);
    exit;
}

// Handle file upload
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['file'])) {
    $file = $_FILES['file'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    $newName = uniqid('', true) . '_' . time() . '.' . $ext;
    $dest = UPLOAD_DIR . $newName;

    if (move_uploaded_file($file['tmp_name'], $dest)) {
        header('Content-Type: application/json');
        echo json_encode(['url' => BASE_URL . '/' . $newName]);
    } else {
        http_response_code(500);
        echo json_encode(['error' => 'Failed to save file']);
    }
} else {
    http_response_code(400);
    echo json_encode(['error' => 'No file provided']);
}