<?php
require_once 'includes/auth.php';
require_once 'config/database.php';

header('Content-Type: application/json');

if (!isset($_FILES['photo']) || $_FILES['photo']['error'] !== UPLOAD_ERR_OK) {
    echo json_encode(['success' => false, 'error' => 'Erreur upload']);
    exit;
}

$file = $_FILES['photo'];
$allowed = ['image/jpeg', 'image/png', 'image/jpg'];
if (!in_array($file['type'], $allowed)) {
    echo json_encode(['success' => false, 'error' => 'Format non autorisé']);
    exit;
}

$upload_dir = 'uploads/photos/';
if (!is_dir($upload_dir)) mkdir($upload_dir, 0755, true);
$filename = 'photo_' . uniqid() . '_' . time() . '.jpg';
$path = $upload_dir . $filename;
if (move_uploaded_file($file['tmp_name'], $path)) {
    echo json_encode(['success' => true, 'url' => $path]);
} else {
    echo json_encode(['success' => false, 'error' => 'Erreur sauvegarde']);
}