<?php
require_once __DIR__ . '/../includes/db.php';
require_once __DIR__ . '/../includes/auth.php';

auth_check();

$id = (int)($_GET['id'] ?? 0);
if (!$id) { http_response_code(400); exit('bad request'); }

$st = db()->prepare('SELECT file_name, path FROM files WHERE id = ?');
$st->execute([$id]);
$row = $st->fetch();

if (!$row || !file_exists($row['path'])) {
    http_response_code(404);
    exit('Fichier introuvable.');
}

$ext  = strtolower(pathinfo($row['file_name'], PATHINFO_EXTENSION));
$mime = match($ext) {
    'pdf'  => 'application/pdf',
    'jpg', 'jpeg' => 'image/jpeg',
    'png'  => 'image/png',
    'csv'  => 'text/csv',
    'xlsx' => 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
    'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
    default => 'application/octet-stream',
};

header('Content-Type: ' . $mime);
header('Content-Disposition: attachment; filename="' . addslashes($row['file_name']) . '"');
header('Content-Length: ' . filesize($row['path']));
readfile($row['path']);