<?php
declare(strict_types=1);

/* =========================================================
   Pengelola Berkas PHP — Premium (Cyan Glow) — FINAL FIX
   ---------------------------------------------------------
   Perbaikan utama vs versi lama:
   1. Flash message dibaca dari $message/$error DAN $_GET
      -> error tidak lagi hilang senyap (bug utama).
   2. Setiap aksi melaporkan PENYEBAB kegagalan yang sebenarnya
      (permission, open_basedir, disable_functions, dll).
   3. Cek is_writable() sebelum eksekusi -> pesan jelas.
   4. Delete yang gagal karena path/exists tidak lagi diam.
   5. Bug logika rename ("terlindungi" padahal input kosong) diperbaiki.
   6. Halaman diagnosa: ?diag=1
   7. Login wajib (bcrypt + CSRF + throttle). Setup: ?setup=1
   ========================================================= */

/* =========================================================
   KONFIGURASI — WAJIB DIUBAH
   ========================================================= */
$AUTH = [
    'enabled' => true,      // JANGAN dimatikan di server publik
    'user'    => 'admin',
    // Kosongkan dulu, lalu buka ?setup=1 untuk membuat hash-nya.
    'hash'    => '',
];

$MAX_EDIT_BYTES = 2 * 1024 * 1024; // batas ukuran file yang boleh dibuka editor

/* =========================================================
   SESSION
   ========================================================= */
session_set_cookie_params([
    'httponly' => true,
    'samesite' => 'Lax',
    'secure'   => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
]);
session_start();

$baseDir  = __DIR__;
$selfFile = basename(__FILE__);

/* ---------- CSRF ---------- */
if (empty($_SESSION['csrf'])) {
    $_SESSION['csrf'] = bin2hex(random_bytes(32));
}
$csrf = $_SESSION['csrf'];

function checkCsrf(): bool {
    return isset($_POST['csrf'], $_SESSION['csrf'])
        && hash_equals($_SESSION['csrf'], (string)$_POST['csrf']);
}

/* =========================================================
   HELPER DASAR
   ========================================================= */
function cleanRelativePath(string $path): string {
    $path  = str_replace('\\', '/', $path);
    $parts = array_filter(explode('/', $path), fn($p) => $p !== '' && $p !== '.' && $p !== '..');
    return implode('/', $parts);
}

function fullPath(string $base, string $rel): string {
    $rel = cleanRelativePath($rel);
    return rtrim($base, DIRECTORY_SEPARATOR) . ($rel ? DIRECTORY_SEPARATOR . $rel : '');
}

function isInsideBase(string $base, string $path): bool {
    $realBase = realpath($base);
    if ($realBase === false) return false;
    $check = file_exists($path) ? realpath($path) : realpath(dirname($path));
    if ($check === false) return false;
    $realBase = rtrim($realBase, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
    $check    = rtrim($check, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
    return str_starts_with($check, $realBase);
}

function isProtected(string $name, string $self): bool {
    return $name === $self || $name === '.htaccess' || $name === '.htpasswd';
}

function formatBytes(int $bytes): string {
    $units = ['B','KB','MB','GB','TB']; $i = 0; $b = (float)$bytes;
    while ($b >= 1024 && $i < 4) { $b /= 1024; $i++; }
    return round($b, 2) . ' ' . $units[$i];
}

function permString(string $path): string {
    if (!file_exists($path)) return '---';
    $p = fileperms($path);
    $s  = (($p & 0x4000) === 0x4000) ? 'd' : '-';
    $s .= ($p & 0x0100) ? 'r' : '-'; $s .= ($p & 0x0080) ? 'w' : '-'; $s .= ($p & 0x0040) ? 'x' : '-';
    $s .= ($p & 0x0020) ? 'r' : '-'; $s .= ($p & 0x0010) ? 'w' : '-'; $s .= ($p & 0x0008) ? 'x' : '-';
    $s .= ($p & 0x0004) ? 'r' : '-'; $s .= ($p & 0x0002) ? 'w' : '-'; $s .= ($p & 0x0001) ? 'x' : '-';
    return $s;
}

function permOctal(string $path): string {
    if (!file_exists($path)) return '000';
    return substr(sprintf('%o', fileperms($path)), -3);
}

function rrmdir(string $dir): bool {
    if (!is_dir($dir)) return false;
    foreach (array_diff(scandir($dir) ?: [], ['.','..']) as $item) {
        $p = $dir . DIRECTORY_SEPARATOR . $item;
        is_dir($p) && !is_link($p) ? rrmdir($p) : @unlink($p);
    }
    return @rmdir($dir);
}

/* Jalankan operasi & tangkap penyebab error aslinya */
function tryOp(callable $fn): array {
    error_clear_last();
    $ok  = (bool)$fn();
    $err = $ok ? '' : (error_get_last()['message'] ?? 'penyebab tidak diketahui');
    // rapikan pesan bawaan PHP
    $err = preg_replace('/^[a-z_]+\(\)?:?\s*/i', '', $err);
    return [$ok, $err];
}

function fnDisabled(string $fn): bool {
    $list = array_map('trim', explode(',', (string)ini_get('disable_functions')));
    return in_array($fn, $list, true) || !function_exists($fn);
}

/* Alasan kenapa sebuah direktori tidak bisa ditulis */
function whyNotWritable(string $dir): string {
    if (!is_dir($dir))      return 'Direktori tidak ada.';
    if (is_writable($dir))  return '';
    $owner = function_exists('posix_getpwuid') ? (posix_getpwuid(fileowner($dir))['name'] ?? fileowner($dir)) : fileowner($dir);
    $me    = function_exists('posix_geteuid')  ? (posix_getpwuid(posix_geteuid())['name'] ?? '?') : get_current_user();
    return sprintf(
        'Direktori tidak writable (perm %s, owner "%s", PHP jalan sebagai "%s"). Jalankan: chown -R %s:%s "%s" && chmod -R 755 "%s"',
        permOctal($dir), (string)$owner, (string)$me, (string)$me, (string)$me, $dir, $dir
    );
}

/* =========================================================
   SETUP: generator hash password  (?setup=1)
   ========================================================= */
if (isset($_GET['setup'])) {
    header('Content-Type: text/html; charset=utf-8');
    $out = '';
    if (!empty($_POST['pw'])) {
        $out = password_hash((string)$_POST['pw'], PASSWORD_DEFAULT);
    }
    echo '<meta name="viewport" content="width=device-width,initial-scale=1">';
    echo '<body style="font-family:system-ui;background:#050914;color:#e2f4f8;padding:28px;line-height:1.6">';
    echo '<h2 style="color:#22d3ee">Setup Password</h2>';
    echo '<p>Ketik password, salin hash yang muncul ke <code>$AUTH[\'hash\']</code> di baris atas file ini, lalu <b>hapus blok setup ini</b>.</p>';
    echo '<form method="post"><input name="pw" type="text" autofocus style="padding:10px;width:320px;max-width:100%;border-radius:8px;border:1px solid #22d3ee;background:#00121a;color:#e2f4f8">'
       . ' <button style="padding:10px 16px;border-radius:8px;border:0;background:#22d3ee;color:#04121a;font-weight:700;cursor:pointer">Buat Hash</button></form>';
    if ($out) {
        echo '<p style="margin-top:20px">Salin baris ini:</p>';
        echo '<textarea readonly style="width:100%;height:80px;padding:12px;background:#00121a;color:#34d399;border:1px solid #22d3ee;border-radius:10px;font-family:monospace">'
           . "'hash' => '" . htmlspecialchars($out) . "'," . '</textarea>';
    }
    echo '</body>';
    exit;
}

/* =========================================================
   AUTENTIKASI
   ========================================================= */
$loginError = '';
if ($AUTH['enabled']) {

    if (isset($_GET['logout'])) {
        $_SESSION = [];
        session_destroy();
        header('Location: ?');
        exit;
    }

    if ($AUTH['hash'] === '') {
        http_response_code(503);
        exit('<body style="font-family:system-ui;background:#050914;color:#fda4af;padding:28px">'
           . 'Password belum diatur. Buka <a style="color:#22d3ee" href="?setup=1">?setup=1</a> untuk membuat hash-nya.</body>');
    }

    if (($_POST['action'] ?? '') === 'login') {
        $tries = (int)($_SESSION['login_fail'] ?? 0);
        if ($tries >= 5 && (time() - (int)($_SESSION['login_last'] ?? 0)) < 60) {
            $loginError = 'Terlalu banyak percobaan. Tunggu 60 detik.';
        } elseif (!checkCsrf()) {
            $loginError = 'Token kedaluwarsa, coba lagi.';
        } else {
            $u = (string)($_POST['user'] ?? '');
            $p = (string)($_POST['pass'] ?? '');
            if (hash_equals($AUTH['user'], $u) && password_verify($p, $AUTH['hash'])) {
                session_regenerate_id(true);
                $_SESSION['auth']       = true;
                $_SESSION['csrf']       = bin2hex(random_bytes(32));
                $_SESSION['login_fail'] = 0;
                header('Location: ?');
                exit;
            }
            $_SESSION['login_fail'] = $tries + 1;
            $_SESSION['login_last'] = time();
            usleep(400000);
            $loginError = 'Username atau password salah.';
        }
    }

    if (empty($_SESSION['auth'])) {
        $csrf = $_SESSION['csrf'];
        ?>
        <!DOCTYPE html><html lang="id"><head><meta charset="UTF-8">
        <meta name="viewport" content="width=device-width,initial-scale=1">
        <title>Login — Pengelola Berkas</title>
        <style>
        *{box-sizing:border-box;margin:0;padding:0}
        body{font-family:system-ui,-apple-system,'Segoe UI',sans-serif;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:20px;
             background:radial-gradient(circle at 20% 0%,rgba(34,211,238,.16),transparent 40%),#050914;color:#e2f4f8}
        .box{width:100%;max-width:380px;background:rgba(9,15,30,.9);border:1px solid rgba(34,211,238,.3);border-radius:18px;padding:28px;
             box-shadow:0 0 0 1px rgba(34,211,238,.28),0 0 26px rgba(34,211,238,.18)}
        h1{font-size:20px;margin-bottom:6px;color:#22d3ee}
        p.sub{color:#7d97a8;font-size:12px;margin-bottom:20px}
        input{width:100%;margin-bottom:12px;padding:12px;border-radius:12px;border:1px solid rgba(34,211,238,.3);background:rgba(0,0,0,.3);color:#e2f4f8;outline:none}
        input:focus{border-color:#22d3ee;box-shadow:0 0 0 1px rgba(34,211,238,.6)}
        button{width:100%;padding:12px;border:0;border-radius:12px;background:linear-gradient(135deg,#22d3ee,#06b6d4);color:#04121a;font-weight:700;cursor:pointer}
        .err{background:rgba(244,63,94,.12);border:1px solid rgba(244,63,94,.35);color:#fda4af;padding:10px 12px;border-radius:10px;font-size:13px;margin-bottom:14px}
        </style></head><body>
        <form class="box" method="post">
            <h1>Pengelola Berkas</h1>
            <p class="sub">Masuk untuk melanjutkan</p>
            <?php if ($loginError): ?><div class="err"><?= htmlspecialchars($loginError) ?></div><?php endif; ?>
            <input type="hidden" name="csrf" value="<?= $csrf ?>">
            <input type="hidden" name="action" value="login">
            <input type="text" name="user" placeholder="Username" autocomplete="username" required autofocus>
            <input type="password" name="pass" placeholder="Password" autocomplete="current-password" required>
            <button type="submit">Masuk</button>
        </form></body></html>
        <?php
        exit;
    }
}

/* =========================================================
   DIAGNOSA  (?diag=1)  — cari tahu kenapa aksi gagal
   ========================================================= */
if (isset($_GET['diag'])) {
    header('Content-Type: text/plain; charset=utf-8');
    $dirRel  = cleanRelativePath((string)($_GET['path'] ?? ''));
    $dir     = fullPath($baseDir, $dirRel);
    if (!is_dir($dir)) $dir = $baseDir;

    $me    = function_exists('posix_geteuid') ? (posix_getpwuid(posix_geteuid())['name'] ?? '?') : get_current_user();
    $owner = function_exists('posix_getpwuid') ? (posix_getpwuid(fileowner($dir))['name'] ?? fileowner($dir)) : fileowner($dir);

    echo "=== DIAGNOSA PENGELOLA BERKAS ===\n\n";
    echo "PHP version    : " . PHP_VERSION . "\n";
    echo "PHP user       : $me\n";
    echo "Server API     : " . PHP_SAPI . "\n\n";
    echo "Direktori uji  : $dir\n";
    echo "Owner direktori: $owner\n";
    echo "Permission     : " . permOctal($dir) . " (" . permString($dir) . ")\n";
    echo "is_writable    : " . (is_writable($dir) ? "YA" : "TIDAK   <<< INI PENYEBABNYA") . "\n\n";
    echo "open_basedir       : " . (ini_get('open_basedir') ?: '(kosong)') . "\n";
    echo "disable_functions  : " . (ini_get('disable_functions') ?: '(kosong)') . "\n";
    echo "safe file_uploads  : " . (ini_get('file_uploads') ? 'ON' : 'OFF') . "\n";
    echo "upload_max_filesize: " . ini_get('upload_max_filesize') . "\n";
    echo "post_max_size      : " . ini_get('post_max_size') . "\n";
    echo "max_file_uploads   : " . ini_get('max_file_uploads') . "\n\n";
    foreach (['mkdir','rmdir','unlink','chmod','rename','file_put_contents','move_uploaded_file'] as $f) {
        printf("fungsi %-20s: %s\n", $f, fnDisabled($f) ? 'DIBLOKIR <<<' : 'tersedia');
    }
    echo "\nsession.save_path  : " . (session_save_path() ?: sys_get_temp_dir()) . "\n";
    echo "session id         : " . session_id() . "  (harus SAMA tiap refresh)\n\n";

    echo "--- TES NYATA ---\n";
    $t = $dir . '/__tes_' . uniqid() . '.tmp';
    [$ok, $e] = tryOp(fn() => @file_put_contents($t, 'x') !== false);
    echo "tulis file  : " . ($ok ? 'OK' : "GAGAL -> $e") . "\n";
    @unlink($t);

    $d = $dir . '/__tes_' . uniqid();
    [$ok2, $e2] = tryOp(fn() => @mkdir($d));
    echo "buat folder : " . ($ok2 ? 'OK' : "GAGAL -> $e2") . "\n";
    if ($ok2) {
        [$ok3, $e3] = tryOp(fn() => @chmod($d, 0755));
        echo "chmod       : " . ($ok3 ? 'OK' : "GAGAL -> $e3") . "\n";
        [$ok4, $e4] = tryOp(fn() => @rmdir($d));
        echo "hapus       : " . ($ok4 ? 'OK' : "GAGAL -> $e4") . "\n";
    }
    echo "\nSelesai. Kembali: ?path=" . urlencode($dirRel) . "\n";
    exit;
}

/* =========================================================
   PATH AKTIF
   ========================================================= */
$currentRel  = cleanRelativePath(trim((string)($_GET['path'] ?? '')));
$currentPath = fullPath($baseDir, $currentRel);
if (!is_dir($currentPath) || !isInsideBase($baseDir, $currentPath)) {
    $currentRel  = '';
    $currentPath = $baseDir;
}

$message = '';
$error   = '';

/* =========================================================
   AKSI POST
   ========================================================= */
if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') !== 'login') {

    if (!checkCsrf()) {
        // FIX: dulu tidak redirect & pesan hilang. Sekarang ditampilkan.
        $error = 'Token keamanan tidak valid / sesi kedaluwarsa. Muat ulang halaman lalu ulangi.';
    } else {
        $action    = (string)($_POST['action'] ?? '');
        $targetRel = cleanRelativePath((string)($_POST['path'] ?? $currentRel));
        $targetDir = fullPath($baseDir, $targetRel);

        if (!is_dir($targetDir) || !isInsideBase($baseDir, $targetDir)) {
            $targetDir = $baseDir;
            $targetRel = '';
        }

        /* ---------- BUAT FOLDER ---------- */
        if ($action === 'create_folder') {
            $name = basename(trim((string)($_POST['folder_name'] ?? '')));
            $new  = $targetDir . DIRECTORY_SEPARATOR . $name;

            if ($name === '' || $name === '.' || $name === '..') {
                $error = 'Nama folder tidak valid.';
            } elseif (fnDisabled('mkdir')) {
                $error = 'Fungsi mkdir() diblokir oleh hosting (disable_functions).';
            } elseif (!isInsideBase($baseDir, $new)) {
                $error = 'Path berada di luar direktori dasar.';
            } elseif (file_exists($new)) {
                $error = "\"$name\" sudah ada.";
            } elseif (($w = whyNotWritable($targetDir)) !== '') {
                $error = $w;
            } else {
                [$ok, $e] = tryOp(fn() => @mkdir($new, 0755));
                $ok ? $message = "Folder \"$name\" berhasil dibuat."
                    : $error   = "Gagal membuat folder: $e";
            }
        }

        /* ---------- BUAT FILE ---------- */
        elseif ($action === 'create_file') {
            $name = basename(trim((string)($_POST['file_name'] ?? '')));
            $new  = $targetDir . DIRECTORY_SEPARATOR . $name;

            if ($name === '' || $name === '.' || $name === '..') {
                $error = 'Nama file tidak valid.';
            } elseif (fnDisabled('file_put_contents')) {
                $error = 'Fungsi file_put_contents() diblokir oleh hosting.';
            } elseif (!isInsideBase($baseDir, $new)) {
                $error = 'Path berada di luar direktori dasar.';
            } elseif (file_exists($new)) {
                $error = "\"$name\" sudah ada.";
            } elseif (($w = whyNotWritable($targetDir)) !== '') {
                $error = $w;
            } else {
                [$ok, $e] = tryOp(fn() => @file_put_contents($new, '') !== false);
                $ok ? $message = "File \"$name\" berhasil dibuat."
                    : $error   = "Gagal membuat file: $e";
            }
        }

        /* ---------- UPLOAD ---------- */
        elseif ($action === 'upload') {
            if (!isset($_FILES['upload_file'])) {
                $error = 'Tidak ada file terkirim. Kemungkinan melebihi post_max_size ('
                       . ini_get('post_max_size') . ').';
            } elseif (($w = whyNotWritable($targetDir)) !== '') {
                $error = $w;
            } else {
                $f = $_FILES['upload_file'];
                $names = (array)$f['name'];
                $ok = 0; $problems = [];

                $uploadErrText = [
                    UPLOAD_ERR_INI_SIZE   => 'melebihi upload_max_filesize (' . ini_get('upload_max_filesize') . ')',
                    UPLOAD_ERR_FORM_SIZE  => 'melebihi batas form',
                    UPLOAD_ERR_PARTIAL    => 'terupload sebagian',
                    UPLOAD_ERR_NO_FILE    => 'tidak ada file',
                    UPLOAD_ERR_NO_TMP_DIR => 'folder temporer server tidak ada',
                    UPLOAD_ERR_CANT_WRITE => 'server gagal menulis ke disk',
                    UPLOAD_ERR_EXTENSION  => 'diblokir ekstensi PHP',
                ];

                foreach ($names as $i => $raw) {
                    $name = basename((string)$raw);
                    $code = (int)$f['error'][$i];

                    if ($code === UPLOAD_ERR_NO_FILE && count($names) === 1 && $name === '') {
                        $problems[] = 'Belum ada file yang dipilih';
                        continue;
                    }
                    if ($code !== UPLOAD_ERR_OK) {
                        $problems[] = "$name: " . ($uploadErrText[$code] ?? "kode error $code");
                        continue;
                    }
                    $dest = $targetDir . DIRECTORY_SEPARATOR . $name;
                    if (isProtected($name, $selfFile)) {
                        $problems[] = "$name: nama file terlindungi";
                    } elseif (!isInsideBase($baseDir, $dest)) {
                        $problems[] = "$name: path di luar direktori dasar";
                    } else {
                        [$mv, $e] = tryOp(fn() => @move_uploaded_file($f['tmp_name'][$i], $dest));
                        $mv ? $ok++ : $problems[] = "$name: $e";
                    }
                }
                if ($ok)        $message = "$ok file berhasil diupload.";
                if ($problems)  $error   = implode(' | ', $problems);
            }
        }

        /* ---------- RENAME ---------- */
        elseif ($action === 'rename') {
            $old = basename((string)($_POST['old_name'] ?? ''));
            $new = basename(trim((string)($_POST['new_name'] ?? '')));

            // FIX: dulu input kosong salah dilaporkan sebagai "file terlindungi"
            if ($old === '' || $new === '') {
                $error = 'Nama lama/baru tidak boleh kosong.';
            } elseif (isProtected($old, $selfFile) || isProtected($new, $selfFile)) {
                $error = 'File terlindungi tidak bisa di-rename.';
            } elseif (fnDisabled('rename')) {
                $error = 'Fungsi rename() diblokir oleh hosting.';
            } else {
                $oldPath = $targetDir . DIRECTORY_SEPARATOR . $old;
                $newPath = $targetDir . DIRECTORY_SEPARATOR . $new;

                if (!file_exists($oldPath)) {
                    $error = "\"$old\" tidak ditemukan.";
                } elseif (file_exists($newPath)) {
                    $error = "\"$new\" sudah ada.";
                } elseif (!isInsideBase($baseDir, $oldPath) || !isInsideBase($baseDir, $newPath)) {
                    $error = 'Path berada di luar direktori dasar.';
                } elseif (($w = whyNotWritable($targetDir)) !== '') {
                    $error = $w;
                } else {
                    [$ok, $e] = tryOp(fn() => @rename($oldPath, $newPath));
                    $ok ? $message = "\"$old\" diubah menjadi \"$new\"."
                        : $error   = "Rename gagal: $e";
                }
            }
        }

        /* ---------- DELETE ---------- */
        elseif ($action === 'delete') {
            $name = basename((string)($_POST['name'] ?? ''));
            $path = $targetDir . DIRECTORY_SEPARATOR . $name;

            // FIX: dulu gagal senyap saat file tidak ada / di luar base
            if ($name === '') {
                $error = 'Nama target kosong.';
            } elseif (isProtected($name, $selfFile)) {
                $error = 'File terlindungi tidak bisa dihapus.';
            } elseif (!file_exists($path) && !is_link($path)) {
                $error = "\"$name\" tidak ditemukan (mungkin sudah terhapus).";
            } elseif (!isInsideBase($baseDir, $path)) {
                $error = 'Path berada di luar direktori dasar.';
            } elseif (($w = whyNotWritable($targetDir)) !== '') {
                // penting: hapus butuh izin tulis pada DIREKTORI INDUK, bukan pada file
                $error = $w;
            } elseif (is_dir($path) && fnDisabled('rmdir')) {
                $error = 'Fungsi rmdir() diblokir oleh hosting.';
            } elseif (!is_dir($path) && fnDisabled('unlink')) {
                $error = 'Fungsi unlink() diblokir oleh hosting.';
            } else {
                if (is_dir($path)) {
                    [$ok, $e] = tryOp(fn() => rrmdir($path));
                    $ok ? $message = "Folder \"$name\" dihapus."
                        : $error   = "Gagal menghapus folder: " . ($e ?: 'isi folder tidak bisa dihapus (cek permission di dalamnya)');
                } else {
                    [$ok, $e] = tryOp(fn() => @unlink($path));
                    $ok ? $message = "File \"$name\" dihapus."
                        : $error   = "Gagal menghapus file: $e";
                }
            }
        }

        /* ---------- CHMOD ---------- */
        elseif ($action === 'chmod') {
            $name = basename((string)($_POST['name'] ?? ''));
            $mode = trim((string)($_POST['mode'] ?? ''));
            $path = $targetDir . DIRECTORY_SEPARATOR . $name;

            if ($name === '') {
                $error = 'Nama target kosong.';
            } elseif (!preg_match('/^[0-7]{3,4}$/', $mode)) {
                $error = 'Format permission tidak valid (contoh: 644, 755).';
            } elseif (fnDisabled('chmod')) {
                $error = 'Fungsi chmod() diblokir oleh hosting.';
            } elseif (!file_exists($path)) {
                $error = "\"$name\" tidak ditemukan.";
            } elseif (!isInsideBase($baseDir, $path)) {
                $error = 'Path berada di luar direktori dasar.';
            } else {
                [$ok, $e] = tryOp(fn() => @chmod($path, intval($mode, 8)));
                if ($ok) {
                    $message = "Permission \"$name\" diubah ke $mode.";
                } else {
                    // penyebab paling umum: file dimiliki user lain (upload via FTP/cPanel)
                    $owner = function_exists('posix_getpwuid') ? (posix_getpwuid(fileowner($path))['name'] ?? fileowner($path)) : fileowner($path);
                    $me    = function_exists('posix_geteuid')  ? (posix_getpwuid(posix_geteuid())['name'] ?? '?') : get_current_user();
                    $error = "Gagal chmod: $e. chmod hanya berhasil bila PHP adalah pemilik file — "
                           . "pemilik \"$name\" adalah \"$owner\", PHP berjalan sebagai \"$me\".";
                }
            }
        }

        /* ---------- SIMPAN EDITOR ---------- */
        elseif ($action === 'save_file') {
            $fileRel  = cleanRelativePath((string)($_POST['file_rel'] ?? ''));
            $filePath = fullPath($baseDir, $fileRel);

            if ($fileRel === '' || !is_file($filePath)) {
                $error = 'File tidak ditemukan.';
            } elseif (isProtected(basename($filePath), $selfFile)) {
                $error = 'File terlindungi tidak bisa diedit.';
            } elseif (!isInsideBase($baseDir, $filePath)) {
                $error = 'Path berada di luar direktori dasar.';
            } elseif (!is_writable($filePath)) {
                $error = 'File tidak writable (perm ' . permOctal($filePath) . '). Ubah ke 644 lalu coba lagi.';
            } else {
                $content = (string)($_POST['content'] ?? '');
                [$ok, $e] = tryOp(fn() => @file_put_contents($filePath, $content) !== false);
                $ok ? $message = 'File berhasil disimpan.'
                    : $error   = "Gagal menyimpan: $e";
            }
            $targetRel = dirname($fileRel);
            if ($targetRel === '.') $targetRel = '';
        }

        // Pola PRG: redirect hanya kalau CSRF valid
        header('Location: ?path=' . urlencode($targetRel)
            . '&msg=' . urlencode($message) . '&err=' . urlencode($error));
        exit;
    }
}

/* =========================================================
   DOWNLOAD
   ========================================================= */
if (isset($_GET['download'])) {
    $fileRel  = cleanRelativePath((string)$_GET['download']);
    $filePath = fullPath($baseDir, $fileRel);
    if (is_file($filePath) && isInsideBase($baseDir, $filePath) && !isProtected(basename($filePath), $selfFile)) {
        while (ob_get_level()) ob_end_clean();
        header('Content-Description: File Transfer');
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($filePath) . '"');
        header('Content-Length: ' . filesize($filePath));
        header('X-Content-Type-Options: nosniff');
        readfile($filePath);
        exit;
    }
    header('Location: ?err=' . urlencode('File tidak bisa diunduh (tidak ada atau terlindungi).'));
    exit;
}

/* =========================================================
   MUAT EDITOR
   ========================================================= */
$editFileRel  = isset($_GET['edit']) ? cleanRelativePath((string)$_GET['edit']) : '';
$editFilePath = $editFileRel ? fullPath($baseDir, $editFileRel) : '';
$editContent  = '';
$editReadonly = false;

if ($editFileRel) {
    if (!is_file($editFilePath) || !isInsideBase($baseDir, $editFilePath)) {
        $error = 'File tidak ditemukan.';
        $editFileRel = '';
    } elseif (isProtected(basename($editFilePath), $selfFile)) {
        $error = 'File terlindungi tidak bisa diedit.';
        $editFileRel = '';
    } elseif (filesize($editFilePath) > $MAX_EDIT_BYTES) {
        $error = 'File terlalu besar untuk editor (> ' . formatBytes($MAX_EDIT_BYTES) . ').';
        $editFileRel = '';
    } else {
        $editContent  = (string)(@file_get_contents($editFilePath) ?: '');
        $editReadonly = !is_writable($editFilePath);
        $currentRel   = dirname($editFileRel);
        if ($currentRel === '.') $currentRel = '';
        $currentPath  = fullPath($baseDir, $currentRel);
    }
}

/* =========================================================
   LISTING
   ========================================================= */
$items   = array_diff(scandir($currentPath) ?: [], ['.','..']);
$folders = [];
$files   = [];

foreach ($items as $item) {
    $itemPath = $currentPath . DIRECTORY_SEPARATOR . $item;
    $itemRel  = ltrim(($currentRel ? $currentRel . '/' : '') . $item, '/');
    $row = [
        'name'   => $item,
        'rel'    => $itemRel,
        'is_dir' => is_dir($itemPath),
        'size'   => is_file($itemPath) ? (int)filesize($itemPath) : 0,
        'mtime'  => @filemtime($itemPath) ?: time(),
        'perm'   => permString($itemPath),
        'octal'  => permOctal($itemPath),
        'w'      => is_writable($itemPath),
        'ext'    => is_file($itemPath) ? strtolower(pathinfo($item, PATHINFO_EXTENSION)) : 'folder',
    ];
    $row['is_dir'] ? ($folders[] = $row) : ($files[] = $row);
}

usort($folders, fn($a, $b) => strcasecmp($a['name'], $b['name']));
usort($files,   fn($a, $b) => strcasecmp($a['name'], $b['name']));

/* FIX UTAMA: flash dibaca dari variabel lokal DAN query string */
$flashMsg = $message !== '' ? $message : (string)($_GET['msg'] ?? '');
$flashErr = $error   !== '' ? $error   : (string)($_GET['err'] ?? '');

$dirWritable = is_writable($currentPath);

function iconClass(string $ext, bool $isDir): string {
    if ($isDir) return 'fa-folder icon-folder';
    return match ($ext) {
        'php','js','html','css','json','py','ts','sh'  => 'fa-file-code icon-code',
        'jpg','jpeg','png','gif','webp','svg','ico'    => 'fa-file-image icon-image',
        'zip','rar','tar','gz','7z'                    => 'fa-file-zipper icon-zip',
        'pdf'                                          => 'fa-file-pdf icon-pdf',
        'txt','md','log'                               => 'fa-file-lines icon-file',
        default                                        => 'fa-file icon-file',
    };
}

$crumbs = [];
$acc = '';
foreach (array_filter(explode('/', $currentRel)) as $seg) {
    $acc = $acc ? $acc . '/' . $seg : $seg;
    $crumbs[] = ['name' => $seg, 'rel' => $acc];
}
?>
<!DOCTYPE html>
<html lang="id" data-theme="dark">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Pengelola Berkas PHP — Premium</title>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css">
<style>
:root{
    --bg:#050914; --panel:rgba(9,15,30,.86); --panel2:rgba(34,211,238,.04);
    --border:rgba(34,211,238,.28); --line:#22d3ee;
    --text:#e2f4f8; --muted:#7d97a8;
    --accent:#22d3ee; --accent2:#06b6d4; --ok:#34d399; --danger:#f43f5e; --warn:#fbbf24;
    --radius:18px;
    --glow:0 0 0 1px rgba(34,211,238,.35), 0 0 18px rgba(34,211,238,.18);
    --glow-strong:0 0 0 1px rgba(34,211,238,.6), 0 0 26px rgba(34,211,238,.35);
}
[data-theme="light"]{
    --bg:#eef6f9; --panel:rgba(255,255,255,.94); --panel2:rgba(6,182,212,.05);
    --border:rgba(6,182,212,.35); --line:#0891b2;
    --text:#062b33; --muted:#5a7683;
    --glow:0 0 0 1px rgba(8,145,178,.28), 0 0 14px rgba(8,145,178,.12);
    --glow-strong:0 0 0 1px rgba(8,145,178,.5), 0 0 22px rgba(8,145,178,.25);
}
*{box-sizing:border-box;margin:0;padding:0}
body{font-family:'Inter',sans-serif;
    background:radial-gradient(circle at 15% -10%, rgba(34,211,238,.14), transparent 34%),
               radial-gradient(circle at 100% 110%, rgba(6,182,212,.12), transparent 34%), var(--bg);
    color:var(--text); min-height:100vh; padding:22px}
.wrap{max-width:1440px;margin:0 auto;display:flex;flex-direction:column;gap:18px}
.panel{background:var(--panel);border:1px solid var(--border);border-radius:var(--radius);
    box-shadow:var(--glow);backdrop-filter:blur(16px);overflow:hidden}
.topbar{padding:20px 22px;display:flex;justify-content:space-between;gap:16px;flex-wrap:wrap;align-items:center;border-bottom:1px solid var(--border)}
.title h1{font-size:26px;font-weight:800;letter-spacing:.3px;background:linear-gradient(90deg,var(--accent),#7dd3fc);
    -webkit-background-clip:text;background-clip:text;color:transparent}
.title .sub{margin-top:4px;color:var(--muted);font-size:12px}
.crumbs{display:flex;gap:6px;flex-wrap:wrap;align-items:center;margin-top:10px;font-size:13px}
.crumbs a{color:var(--accent);text-decoration:none;padding:3px 8px;border:1px solid var(--border);border-radius:8px;background:var(--panel2)}
.crumbs span{color:var(--muted)}
.btn-row,.toolbar{display:flex;gap:10px;flex-wrap:wrap;align-items:center}
.btn{border:1px solid var(--border);background:var(--panel2);color:var(--text);padding:10px 14px;border-radius:12px;
    cursor:pointer;text-decoration:none;display:inline-flex;align-items:center;gap:8px;min-height:42px;font-size:14px;transition:.18s}
.btn:hover{box-shadow:var(--glow-strong);border-color:var(--line)}
.btn.primary{background:linear-gradient(135deg,var(--accent),var(--accent2));border:none;color:#04121a;font-weight:700}
.btn.danger{color:#fff;background:rgba(244,63,94,.18);border-color:rgba(244,63,94,.4)}
.btn.sm{min-height:36px;padding:7px 11px;font-size:13px}
.flash{padding:14px 18px;border-radius:14px;font-size:14px;margin:16px 22px 0;line-height:1.6;word-break:break-word}
.flash.ok{background:rgba(52,211,153,.12);border:1px solid rgba(52,211,153,.35);color:#6ee7b7}
.flash.err{background:rgba(244,63,94,.12);border:1px solid rgba(244,63,94,.35);color:#fda4af}
.flash.warn{background:rgba(251,191,36,.1);border:1px solid rgba(251,191,36,.35);color:#fcd34d}
.flash a{color:inherit;font-weight:700}
.grid{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:12px;padding:18px 22px}
.card{background:var(--panel2);border:1px solid var(--border);border-radius:16px;padding:16px}
.card span{display:block;color:var(--muted);font-size:12px;margin-bottom:6px;text-transform:uppercase;letter-spacing:.6px}
.card strong{font-size:24px;font-weight:800}
.forms{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:12px;padding:0 22px 18px}
.form-box{background:var(--panel2);border:1px solid var(--border);border-radius:16px;padding:16px}
.form-box h3{font-size:14px;margin-bottom:12px;display:flex;align-items:center;gap:8px;color:var(--accent)}
input[type="text"],input[type="file"],textarea{width:100%;background:rgba(0,0,0,.28);border:1px solid var(--border);
    color:var(--text);border-radius:12px;padding:10px 12px;outline:none;font-family:'Inter',sans-serif;transition:.18s}
input:focus,textarea:focus{border-color:var(--line);box-shadow:var(--glow-strong)}
textarea{min-height:420px;resize:vertical;font-family:'JetBrains Mono',monospace;font-size:13px;line-height:1.6}
.dropzone{border:1.5px dashed var(--border);border-radius:12px;padding:16px;text-align:center;color:var(--muted);cursor:pointer;transition:.2s}
.dropzone.drag{border-color:var(--line);background:var(--panel2);box-shadow:var(--glow-strong);color:var(--accent)}
.dropzone .files{margin-top:8px;font-size:12px;color:var(--accent)}
.searchbar{padding:14px 22px;border-top:1px solid var(--border);display:flex;gap:12px;align-items:center;flex-wrap:wrap}
.searchbar input{max-width:340px}
.table-wrap{overflow:auto}
table{width:100%;border-collapse:collapse}
th,td{padding:13px 18px;text-align:left;font-size:14px;border-top:1px solid var(--border)}
th{color:var(--accent);background:var(--panel2);text-transform:uppercase;font-size:11px;letter-spacing:.8px;position:sticky;top:0}
tr:hover td{background:rgba(34,211,238,.05);box-shadow:inset 3px 0 0 var(--line)}
.file-name{display:flex;align-items:center;gap:10px;font-weight:600}
.file-name a{color:var(--text);text-decoration:none}
.file-name a:hover{color:var(--accent)}
.icon-folder{color:var(--warn)}.icon-code{color:var(--accent)}.icon-image{color:#c084fc}
.icon-zip{color:#fb923c}.icon-pdf{color:#f87171}.icon-file{color:var(--muted)}
.badge{padding:5px 10px;border-radius:999px;background:var(--panel2);border:1px solid var(--border);font-size:11px;color:var(--muted);font-weight:600}
.perm{font-family:'JetBrains Mono',monospace;font-size:12px;color:var(--accent);cursor:pointer;
    border:1px solid var(--border);border-radius:8px;padding:4px 8px;background:var(--panel2)}
.perm.ro{color:var(--warn);border-color:rgba(251,191,36,.4)}
.perm:hover{box-shadow:var(--glow-strong)}
.actions{display:flex;gap:6px;flex-wrap:wrap}
.muted{color:var(--muted)}
.modal-bg{position:fixed;inset:0;background:rgba(2,6,15,.72);backdrop-filter:blur(4px);display:none;
    align-items:center;justify-content:center;z-index:50;padding:20px}
.modal-bg.open{display:flex}
.modal{background:var(--panel);border:1px solid var(--line);border-radius:18px;box-shadow:var(--glow-strong);width:100%;max-width:420px;padding:22px}
.modal h3{font-size:17px;margin-bottom:6px;color:var(--accent)}
.modal p{color:var(--muted);font-size:13px;margin-bottom:14px;word-break:break-all}
.modal .row{display:flex;gap:10px;margin-top:16px;justify-content:flex-end}
.chip{display:inline-flex;gap:6px;flex-wrap:wrap;margin-top:10px}
.chip button{border:1px solid var(--border);background:var(--panel2);color:var(--text);border-radius:8px;
    padding:6px 10px;cursor:pointer;font-family:'JetBrains Mono',monospace;font-size:12px}
.chip button:hover{box-shadow:var(--glow);border-color:var(--line)}
.editor{padding:20px 22px}
@media (max-width:1100px){.forms{grid-template-columns:1fr}.grid{grid-template-columns:repeat(2,1fr)}}
@media (max-width:720px){.grid{grid-template-columns:1fr}body{padding:12px}
    th:nth-child(3),td:nth-child(3),th:nth-child(4),td:nth-child(4){display:none}}
</style>
</head>
<body>
<div class="wrap">
<section class="panel">
    <div class="topbar">
        <div class="title">
            <h1><i class="fa-solid fa-folder-tree"></i> Pengelola Berkas PHP</h1>
            <div class="sub">Premium Edition · Cyan Glow · Permission Manager</div>
            <div class="crumbs">
                <a href="?path="><i class="fa-solid fa-house"></i></a>
                <?php foreach ($crumbs as $c): ?>
                    <span>/</span>
                    <a href="?path=<?= urlencode($c['rel']) ?>"><?= htmlspecialchars($c['name']) ?></a>
                <?php endforeach; ?>
            </div>
        </div>
        <div class="btn-row">
            <a class="btn" href="?path=<?= urlencode($currentRel) ?>"><i class="fa-solid fa-rotate"></i> Refresh</a>
            <a class="btn" href="?diag=1&path=<?= urlencode($currentRel) ?>" target="_blank"><i class="fa-solid fa-stethoscope"></i> Diagnosa</a>
            <button class="btn" type="button" onclick="toggleTheme()"><i class="fa-solid fa-circle-half-stroke"></i> Theme</button>
            <?php if ($currentRel !== ''): $parent = dirname($currentRel); if ($parent === '.') $parent=''; ?>
                <a class="btn" href="?path=<?= urlencode($parent) ?>"><i class="fa-solid fa-arrow-left"></i> Naik</a>
            <?php endif; ?>
            <?php if ($AUTH['enabled']): ?>
                <a class="btn danger" href="?logout=1"><i class="fa-solid fa-right-from-bracket"></i> Keluar</a>
            <?php endif; ?>
        </div>
    </div>

    <?php if ($flashMsg): ?>
        <div class="flash ok"><i class="fa-solid fa-circle-check"></i> <?= htmlspecialchars($flashMsg) ?></div>
    <?php endif; ?>
    <?php if ($flashErr): ?>
        <div class="flash err"><i class="fa-solid fa-circle-exclamation"></i> <?= htmlspecialchars($flashErr) ?>
            &nbsp;<a href="?diag=1&path=<?= urlencode($currentRel) ?>" target="_blank">Jalankan diagnosa →</a></div>
    <?php endif; ?>
    <?php if (!$dirWritable): ?>
        <div class="flash warn"><i class="fa-solid fa-triangle-exclamation"></i>
            Direktori ini <b>tidak writable</b> (perm <?= permOctal($currentPath) ?>). Buat/hapus/upload akan selalu gagal sampai izinnya diperbaiki.
            &nbsp;<a href="?diag=1&path=<?= urlencode($currentRel) ?>" target="_blank">Lihat detail →</a></div>
    <?php endif; ?>

    <div class="grid">
        <div class="card"><span>Total Folder</span><strong><?= count($folders) ?></strong></div>
        <div class="card"><span>Total File</span><strong><?= count($files) ?></strong></div>
        <div class="card"><span>Status Tulis</span>
            <strong style="font-size:18px;color:<?= $dirWritable ? 'var(--ok)' : 'var(--danger)' ?>">
                <?= $dirWritable ? 'Writable' : 'Read-only' ?></strong></div>
        <div class="card"><span>Path Aktif</span><strong style="font-size:15px;word-break:break-all">/<?= htmlspecialchars($currentRel) ?></strong></div>
    </div>

    <div class="forms">
        <div class="form-box">
            <h3><i class="fa-solid fa-folder-plus"></i> Buat Folder</h3>
            <form method="post">
                <input type="hidden" name="csrf" value="<?= $csrf ?>">
                <input type="hidden" name="action" value="create_folder">
                <input type="hidden" name="path" value="<?= htmlspecialchars($currentRel) ?>">
                <input type="text" name="folder_name" placeholder="nama-folder" required>
                <div style="margin-top:10px"><button class="btn primary" type="submit"><i class="fa-solid fa-plus"></i> Create</button></div>
            </form>
        </div>
        <div class="form-box">
            <h3><i class="fa-solid fa-file-circle-plus"></i> Buat File</h3>
            <form method="post">
                <input type="hidden" name="csrf" value="<?= $csrf ?>">
                <input type="hidden" name="action" value="create_file">
                <input type="hidden" name="path" value="<?= htmlspecialchars($currentRel) ?>">
                <input type="text" name="file_name" placeholder="index.php" required>
                <div style="margin-top:10px"><button class="btn primary" type="submit"><i class="fa-solid fa-plus"></i> Create</button></div>
            </form>
        </div>
        <div class="form-box">
            <h3><i class="fa-solid fa-cloud-arrow-up"></i> Upload File</h3>
            <form method="post" enctype="multipart/form-data" id="uploadForm">
                <input type="hidden" name="csrf" value="<?= $csrf ?>">
                <input type="hidden" name="action" value="upload">
                <input type="hidden" name="path" value="<?= htmlspecialchars($currentRel) ?>">
                <div class="dropzone" id="dropzone">
                    <i class="fa-solid fa-cloud-arrow-up" style="font-size:22px"></i>
                    <div>Tarik &amp; lepas file di sini, atau klik untuk pilih</div>
                    <div class="files" id="fileList"></div>
                    <input type="file" name="upload_file[]" id="fileInput" multiple style="display:none">
                </div>
                <div style="margin-top:10px;display:flex;gap:10px;align-items:center;flex-wrap:wrap">
                    <button class="btn primary" type="submit"><i class="fa-solid fa-upload"></i> Upload</button>
                    <span class="muted" style="font-size:12px">Maks <?= htmlspecialchars(ini_get('upload_max_filesize')) ?>/file</span>
                </div>
            </form>
        </div>
    </div>

    <div class="searchbar">
        <i class="fa-solid fa-magnifying-glass muted"></i>
        <input type="text" id="search" placeholder="Cari file / folder di direktori ini...">
    </div>

    <div class="table-wrap">
        <table id="fileTable">
            <thead><tr>
                <th>Nama</th><th>Tipe</th><th>Ukuran</th><th>Modified</th><th>Permission</th><th>Aksi</th>
            </tr></thead>
            <tbody>
            <?php foreach ($folders as $item): ?>
                <tr data-name="<?= htmlspecialchars(strtolower($item['name'])) ?>">
                    <td><div class="file-name"><i class="fa-solid <?= iconClass($item['ext'], true) ?>"></i>
                        <a href="?path=<?= urlencode($item['rel']) ?>"><?= htmlspecialchars($item['name']) ?></a></div></td>
                    <td><span class="badge">Folder</span></td>
                    <td class="muted">-</td>
                    <td class="muted"><?= date('Y-m-d H:i', $item['mtime']) ?></td>
                    <td><span class="perm <?= $item['w'] ? '' : 'ro' ?>"
                        title="<?= $item['w'] ? 'Writable' : 'Tidak writable' ?>"
                        onclick="openChmod('<?= htmlspecialchars($item['name'], ENT_QUOTES) ?>','<?= $item['octal'] ?>')"><?= $item['perm'] ?> · <?= $item['octal'] ?></span></td>
                    <td><div class="actions">
                        <a class="btn sm" href="?path=<?= urlencode($item['rel']) ?>" title="Buka"><i class="fa-solid fa-folder-open"></i></a>
                        <button class="btn sm" type="button" title="Rename" onclick="openRename('<?= htmlspecialchars($item['name'], ENT_QUOTES) ?>')"><i class="fa-solid fa-pen"></i></button>
                        <form method="post" style="display:inline" onsubmit="return confirm('Hapus folder ini beserta seluruh isinya?')">
                            <input type="hidden" name="csrf" value="<?= $csrf ?>">
                            <input type="hidden" name="action" value="delete">
                            <input type="hidden" name="path" value="<?= htmlspecialchars($currentRel) ?>">
                            <input type="hidden" name="name" value="<?= htmlspecialchars($item['name']) ?>">
                            <button class="btn sm danger" type="submit" title="Hapus"><i class="fa-solid fa-trash"></i></button>
                        </form>
                    </div></td>
                </tr>
            <?php endforeach; ?>

            <?php foreach ($files as $item): $prot = isProtected($item['name'], $selfFile); ?>
                <tr data-name="<?= htmlspecialchars(strtolower($item['name'])) ?>">
                    <td><div class="file-name"><i class="fa-solid <?= iconClass($item['ext'], false) ?>"></i>
                        <span><?= htmlspecialchars($item['name']) ?></span>
                        <?php if ($prot): ?><span class="badge" style="color:var(--warn)"><i class="fa-solid fa-lock"></i></span><?php endif; ?></div></td>
                    <td><span class="badge"><?= htmlspecialchars(strtoupper($item['ext'] ?: 'FILE')) ?></span></td>
                    <td class="muted"><?= formatBytes($item['size']) ?></td>
                    <td class="muted"><?= date('Y-m-d H:i', $item['mtime']) ?></td>
                    <td><span class="perm <?= $item['w'] ? '' : 'ro' ?>"
                        title="<?= $item['w'] ? 'Writable' : 'Tidak writable' ?>"
                        onclick="openChmod('<?= htmlspecialchars($item['name'], ENT_QUOTES) ?>','<?= $item['octal'] ?>')"><?= $item['perm'] ?> · <?= $item['octal'] ?></span></td>
                    <td><div class="actions">
                        <?php if (!$prot): ?>
                        <a class="btn sm" href="?edit=<?= urlencode($item['rel']) ?>" title="Edit"><i class="fa-solid fa-pen-to-square"></i></a>
                        <a class="btn sm" href="?download=<?= urlencode($item['rel']) ?>" title="Download"><i class="fa-solid fa-download"></i></a>
                        <button class="btn sm" type="button" title="Rename" onclick="openRename('<?= htmlspecialchars($item['name'], ENT_QUOTES) ?>')"><i class="fa-solid fa-pen"></i></button>
                        <form method="post" style="display:inline" onsubmit="return confirm('Hapus file ini?')">
                            <input type="hidden" name="csrf" value="<?= $csrf ?>">
                            <input type="hidden" name="action" value="delete">
                            <input type="hidden" name="path" value="<?= htmlspecialchars($currentRel) ?>">
                            <input type="hidden" name="name" value="<?= htmlspecialchars($item['name']) ?>">
                            <button class="btn sm danger" type="submit" title="Hapus"><i class="fa-solid fa-trash"></i></button>
                        </form>
                        <?php else: ?>
                        <span class="muted" style="font-size:12px">Terlindungi</span>
                        <?php endif; ?>
                    </div></td>
                </tr>
            <?php endforeach; ?>

            <?php if (!$folders && !$files): ?>
                <tr><td colspan="6" class="muted" style="text-align:center;padding:30px">Folder ini masih kosong.</td></tr>
            <?php endif; ?>
            </tbody>
        </table>
    </div>
</section>

<?php if ($editFileRel): ?>
<section class="panel">
    <div class="editor">
        <div style="display:flex;justify-content:space-between;gap:12px;flex-wrap:wrap;align-items:center;margin-bottom:14px">
            <div>
                <h2 style="font-size:19px;color:var(--accent)"><i class="fa-solid fa-code"></i> Editor File</h2>
                <div class="muted" style="font-family:'JetBrains Mono',monospace;margin-top:4px"><?= htmlspecialchars($editFileRel) ?></div>
            </div>
            <?php if ($editReadonly): ?>
                <span class="badge" style="color:var(--warn)"><i class="fa-solid fa-lock"></i> Read-only — chmod ke 644 dulu</span>
            <?php endif; ?>
        </div>
        <form method="post">
            <input type="hidden" name="csrf" value="<?= $csrf ?>">
            <input type="hidden" name="action" value="save_file">
            <input type="hidden" name="file_rel" value="<?= htmlspecialchars($editFileRel) ?>">
            <textarea name="content" spellcheck="false"><?= htmlspecialchars($editContent) ?></textarea>
            <div style="margin-top:12px;display:flex;gap:10px;flex-wrap:wrap">
                <button class="btn primary" type="submit" <?= $editReadonly ? 'disabled style="opacity:.5;cursor:not-allowed"' : '' ?>>
                    <i class="fa-solid fa-floppy-disk"></i> Simpan</button>
                <a class="btn" href="?path=<?= urlencode($currentRel) ?>"><i class="fa-solid fa-xmark"></i> Tutup Editor</a>
            </div>
        </form>
    </div>
</section>
<?php endif; ?>
</div>

<!-- Modal Rename -->
<div class="modal-bg" id="renameModal">
    <div class="modal">
        <h3><i class="fa-solid fa-pen"></i> Rename</h3>
        <p id="renameOld"></p>
        <form method="post">
            <input type="hidden" name="csrf" value="<?= $csrf ?>">
            <input type="hidden" name="action" value="rename">
            <input type="hidden" name="path" value="<?= htmlspecialchars($currentRel) ?>">
            <input type="hidden" name="old_name" id="renameOldInput">
            <input type="text" name="new_name" id="renameNewInput" placeholder="nama baru" required>
            <div class="row">
                <button class="btn" type="button" onclick="closeModal('renameModal')">Batal</button>
                <button class="btn primary" type="submit">Simpan</button>
            </div>
        </form>
    </div>
</div>

<!-- Modal Chmod -->
<div class="modal-bg" id="chmodModal">
    <div class="modal">
        <h3><i class="fa-solid fa-user-shield"></i> Ubah Permission</h3>
        <p id="chmodName"></p>
        <form method="post">
            <input type="hidden" name="csrf" value="<?= $csrf ?>">
            <input type="hidden" name="action" value="chmod">
            <input type="hidden" name="path" value="<?= htmlspecialchars($currentRel) ?>">
            <input type="hidden" name="name" id="chmodNameInput">
            <input type="text" name="mode" id="chmodModeInput" placeholder="644" pattern="[0-7]{3,4}" required>
            <div class="chip">
                <button type="button" onclick="setMode('644')">644</button>
                <button type="button" onclick="setMode('755')">755</button>
                <button type="button" onclick="setMode('775')">775</button>
                <button type="button" onclick="setMode('600')">600</button>
                <button type="button" onclick="setMode('444')">444</button>
            </div>
            <div class="row">
                <button class="btn" type="button" onclick="closeModal('chmodModal')">Batal</button>
                <button class="btn primary" type="submit">Terapkan</button>
            </div>
        </form>
    </div>
</div>

<script>
function toggleTheme(){
    const html=document.documentElement;
    const next=(html.getAttribute('data-theme')||'dark')==='dark'?'light':'dark';
    html.setAttribute('data-theme',next);
    document.cookie='fm_theme='+next+';path=/;max-age=31536000;samesite=lax';
}
(function(){const m=document.cookie.match(/fm_theme=(\w+)/);if(m)document.documentElement.setAttribute('data-theme',m[1]);})();

document.getElementById('search').addEventListener('input',function(){
    const q=this.value.toLowerCase();
    document.querySelectorAll('#fileTable tbody tr[data-name]').forEach(tr=>{
        tr.style.display=tr.dataset.name.includes(q)?'':'none';
    });
});

function openRename(name){
    document.getElementById('renameOld').textContent='File / folder: '+name;
    document.getElementById('renameOldInput').value=name;
    document.getElementById('renameNewInput').value=name;
    openModal('renameModal');
    setTimeout(()=>document.getElementById('renameNewInput').focus(),50);
}
function openChmod(name,octal){
    document.getElementById('chmodName').textContent='Target: '+name;
    document.getElementById('chmodNameInput').value=name;
    document.getElementById('chmodModeInput').value=octal;
    openModal('chmodModal');
}
function setMode(v){document.getElementById('chmodModeInput').value=v;}
function openModal(id){document.getElementById(id).classList.add('open');}
function closeModal(id){document.getElementById(id).classList.remove('open');}
document.querySelectorAll('.modal-bg').forEach(bg=>bg.addEventListener('click',e=>{if(e.target===bg)bg.classList.remove('open');}));
document.addEventListener('keydown',e=>{if(e.key==='Escape')document.querySelectorAll('.modal-bg.open').forEach(m=>m.classList.remove('open'));});

const dz=document.getElementById('dropzone'), fi=document.getElementById('fileInput'), fl=document.getElementById('fileList');
dz.addEventListener('click',()=>fi.click());
['dragenter','dragover'].forEach(ev=>dz.addEventListener(ev,e=>{e.preventDefault();dz.classList.add('drag');}));
['dragleave','drop'].forEach(ev=>dz.addEventListener(ev,e=>{e.preventDefault();dz.classList.remove('drag');}));
dz.addEventListener('drop',e=>{fi.files=e.dataTransfer.files;showFiles();});
fi.addEventListener('change',showFiles);
function showFiles(){fl.textContent=[...fi.files].map(f=>f.name).join(', ')||'';}

/* Cegah submit upload kosong */
document.getElementById('uploadForm').addEventListener('submit',e=>{
    if(!fi.files.length){e.preventDefault();alert('Pilih file dulu.');}
});
</script>
</body>
</html>