<?php
$cfg = cfg();
$csrfToken = csrfToken();
?>
<!doctype html>
<html lang="pl">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title><?=htmlspecialchars($cfg['site_name'])?></title>
    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/glightbox/dist/css/glightbox.min.css" />
    <script src="https://cdn.jsdelivr.net/gh/mcstudios/glightbox/dist/js/glightbox.min.js"></script>
    <link rel="stylesheet" href="assets/style.css?v=5">
    <script>
        window.CSRF_TOKEN = <?=json_encode($csrfToken)?>;

        // Automatycznie dodaje token CSRF do żądań POST wykonywanych przez obecny kod i assets/script.js.
        const originalFetch = window.fetch;
        window.fetch = function(input, init) {
            init = init || {};
            const requestMethod = init.method || (input instanceof Request ? input.method : 'GET');
            const method = String(requestMethod).toUpperCase();
            const requestUrl = input instanceof Request ? input.url : String(input);
            const targetUrl = new URL(requestUrl, window.location.href);
            if (targetUrl.origin === window.location.origin && method !== 'GET' && method !== 'HEAD') {
                const headers = new Headers(init.headers || (input instanceof Request ? input.headers : {}));
                headers.set('X-CSRF-Token', window.CSRF_TOKEN);
                init.headers = headers;
            }
            return originalFetch(input, init);
        };

        const originalXhrOpen = XMLHttpRequest.prototype.open;
        const originalXhrSend = XMLHttpRequest.prototype.send;
        XMLHttpRequest.prototype.open = function(method, url) {
            this._csrfMethod = String(method || 'GET').toUpperCase();
            this._csrfUrl = new URL(String(url), window.location.href);
            return originalXhrOpen.apply(this, arguments);
        };
        XMLHttpRequest.prototype.send = function(body) {
            if (this._csrfUrl && this._csrfUrl.origin === window.location.origin && this._csrfMethod !== 'GET' && this._csrfMethod !== 'HEAD') {
                this.setRequestHeader('X-CSRF-Token', window.CSRF_TOKEN);
            }
            return originalXhrSend.call(this, body);
        };
    </script>
    <script src="assets/script.js?v=6" defer></script>
    <style>
        /* NAPRAWA WYSTAJĄCEJ WYSZUKIWARKI */
        .search-container, .search-container input {
            box-sizing: border-box !important;
        }
        .search-container {
            width: 100%;
        }
        #searchInput {
            width: 100% !important;
        }
    </style>
</head>
<body>
    <div class="top-bar">
        <a href="index.php" class="logo">☁️ <?=htmlspecialchars($cfg['site_name'])?></a>
        <div class="top-controls">
            <button id="btnToggleTheme" class="btn btn-gray">🌙 Motyw</button>
            <button id="btnToggleView" class="btn btn-gray">🔲 Widok</button>
            <form method="post" action="index.php" style="display:inline; margin-left:10px;">
                <input type="hidden" name="csrf_token" value="<?=htmlspecialchars($csrfToken, ENT_QUOTES)?>">
                <button type="submit" name="logout" value="1" class="btn btn-gray">🚪 Wyloguj</button>
            </form>
        </div>
    </div>

    <div class="search-container">
        <div style="position: relative;">
            <input type="text" id="searchInput" placeholder="&#128269; Szukaj plików (min. 3 znaki)..." autocomplete="off">
            <div id="searchResults" class="search-dropdown" style="display: none;"></div>
        </div>
    </div>
    
    <div class="content-box">
