accounting_dev_v2/application/controllers/Accountingattachments.php

<?php
defined('BASEPATH') OR exit('No direct script access allowed');
class Accountingattachments extends MY_Controller
{
 private $imageTypes='jpg|jpeg|jpe|jfif|png|webp|gif|bmp|tif|tiff|heic|heif|avif|jp2|j2k|jpf|jpg2|jpx|ico';
 public function upload(){
  $type=$this->input->post('entity_type');$id=(int)$this->input->post('entity_id');$purchaseTypes=array('purchase_order','goods_receipt','supplier_invoice','supplier_payment','purchase_return','purchase_return_shipment','purchase_replacement','supplier_debit_note','purchase_refund','supplier_refund','supplier_refund_receipt');
  if(!in_array($type,array_merge(array('asset','asset_maintenance','asset_opname','cash_transaction','cash_transfer','bank_reconciliation','stock_document','technician_equipment_document','customer_equipment_registry'),$purchaseTypes),true)||$id<1)return json_response(false,'Target lampiran tidak valid.',array(),422);
  $this->assertEntityAccess((object)array('entity_type'=>$type,'entity_id'=>$id));
  if($type==='asset')$this->requirePermission('asset','can_create');
  if($type==='asset_maintenance')$this->requirePermission('asset','can_update');
  if($type==='asset_opname')$this->requirePermission('asset','can_create');
  if($type==='asset'&&!$this->db->get_where('assets',array('id'=>$id,'company_id'=>(int)$this->session->userdata('company_id'),'workflow_status'=>'draft'))->row())return json_response(false,'Lampiran perolehan hanya dapat ditambah saat draft.',array(),422);
  if($type==='asset_opname'&&!$this->db->get_where('asset_opnames',array('id'=>$id,'company_id'=>(int)$this->session->userdata('company_id'),'status'=>'draft'))->row())return json_response(false,'Bukti opname hanya dapat ditambah saat draft.',array(),422);
  if($type==='stock_document'){$this->assertEntityAccess((object)array('entity_type'=>$type,'entity_id'=>$id));$this->requirePermission('items','can_create');}
  if(empty($_FILES['attachment']['tmp_name'])||!is_uploaded_file($_FILES['attachment']['tmp_name']))return json_response(false,'Pilih file gambar atau PDF.',array(),422);
  $tmp=$_FILES['attachment']['tmp_name'];$mime=function_exists('finfo_open')?(new finfo(FILEINFO_MIME_TYPE))->file($tmp):($_FILES['attachment']['type']??'');
  if($mime!=='application/pdf'&&strpos((string)$mime,'image/')!==0)return json_response(false,'Isi file bukan gambar atau PDF yang valid.',array(),422);
  $dir=FCPATH.'uploads/accounting/';if(!is_dir($dir)&&!mkdir($dir,0750,true))return json_response(false,'Folder lampiran tidak tersedia.',array(),500);
  $this->load->library('upload',array('upload_path'=>$dir,'allowed_types'=>'pdf|'.$this->imageTypes,'max_size'=>5120,'encrypt_name'=>true));
  if(!$this->upload->do_upload('attachment'))return json_response(false,'File '.$_FILES['attachment']['name'].' ditolak: '.strip_tags($this->upload->display_errors()),array(),422);
  $f=$this->upload->data();$module=in_array($type,$purchaseTypes,true)?'purchase':($type==='stock_document'?'inventory':(strpos($type,'asset')===0?'fixed_asset':'cash_bank'));$row=array('module'=>$module,'entity_type'=>$type,'entity_id'=>$id,'original_name'=>$f['orig_name'],'stored_name'=>$f['file_name'],'mime_type'=>$f['file_type'],'file_size'=>$f['file_size']*1024,'sha256'=>hash_file('sha256',$f['full_path']),'uploaded_by'=>$this->session->userdata('user_id'),'created_at'=>date('Y-m-d H:i:s'));if($this->db->field_exists('company_id','transaction_attachments'))$row['company_id']=(int)$this->session->userdata('company_id');$this->db->insert('transaction_attachments',$row);return json_response(true,'Lampiran berhasil disimpan.',array('id'=>$this->db->insert_id()));
 }
 public function download($id){$f=$this->db->get_where('transaction_attachments',array('id'=>(int)$id))->row();if(!$f)show_404();$this->assertEntityAccess($f);$path=FCPATH.'uploads/accounting/'.$f->stored_name;if(!$this->safePath($path))show_404();$this->load->helper('download');force_download($f->original_name,file_get_contents($path));}
 public function preview($id){$f=$this->db->get_where('transaction_attachments',array('id'=>(int)$id))->row();if(!$f)show_404();$this->assertEntityAccess($f);$path=FCPATH.'uploads/accounting/'.$f->stored_name;if(!$this->safePath($path))show_404();$mime=function_exists('finfo_open')?(new finfo(FILEINFO_MIME_TYPE))->file($path):$f->mime_type;if($mime!=='application/pdf'&&strpos((string)$mime,'image/')!==0)show_404();$name=str_replace(array('"',"\r","\n"),'',basename($f->original_name));$this->output->set_header('Content-Type: '.$mime)->set_header('Content-Disposition: inline; filename="'.$name.'"')->set_header('Content-Length: '.filesize($path))->set_header('X-Content-Type-Options: nosniff')->set_output(file_get_contents($path));}
 private function assertEntityAccess($file){$company=(int)$this->session->userdata('company_id');if(in_array($file->entity_type,array('technician_equipment_document','customer_equipment_registry'),true)){$table=$file->entity_type==='technician_equipment_document'?'technician_equipment_documents':'customer_equipment_registry';$owned=$this->db->get_where($table,array('id'=>(int)$file->entity_id,'company_id'=>$company))->row();if(!$owned)show_error('Akses lampiran ditolak.',403,'Akses ditolak');$permissions=$this->session->userdata('permissions');$known=is_array($permissions)&&array_key_exists('technician_attachment',$permissions);$fallback=!$known&&(check_permission('technician_equipment','can_view')||check_permission('items','can_view'));if(!is_master_admin_user()&&!check_permission('technician_attachment','can_view')&&!$fallback)show_error('Akses lampiran ditolak.',403,'Akses ditolak');return;}if($file->entity_type==='technician_installation'){$owned=$this->db->select('b.id')->from('item_barcodes b')->join('items i','i.id=b.item_id')->where(array('b.id'=>(int)$file->entity_id,'i.company_id'=>$company))->get()->row();if(!$owned)show_error('Akses lampiran ditolak.',403,'Akses ditolak');$this->requirePermission('items','can_view');return;}if($file->entity_type==='technician_status_change'){$owned=$this->db->get_where('technician_item_status_logs',array('id'=>(int)$file->entity_id,'company_id'=>$company))->row();if(!$owned)show_error('Akses lampiran ditolak.',403,'Akses ditolak');$this->requirePermission('items','can_view');return;}$map=array('stock_document'=>array('stock_documents','items'),'asset'=>array('assets','asset'),'asset_maintenance'=>array('asset_maintenance','asset'),'asset_opname'=>array('asset_opnames','asset'));if(!isset($map[$file->entity_type]))return;list($table,$feature)=$map[$file->entity_type];if(!$this->db->get_where($table,array('id'=>(int)$file->entity_id,'company_id'=>$company))->row())show_error('Akses lampiran ditolak.',403,'Akses ditolak');$this->requirePermission($feature,'can_view');}
 private function safePath($path){$root=realpath(FCPATH.'uploads/accounting');$real=realpath($path);return$root&&$real&&strpos($real,$root.DIRECTORY_SEPARATOR)===0&&is_file($real);}
}