<?php
require_once dirname(__DIR__) . '/lib/boardroom-auth.php';

boardroom_session_start();

$indexRoot = boardroom_index_root();
$dataRoot = $indexRoot . DIRECTORY_SEPARATOR . 'data';
$sub = boardroom_norm_rel($_GET['p'] ?? '');

if ($sub === '') {
    http_response_code(400);
    exit('Bad request');
}

$rel = 'data/' . $sub;
$abs = $dataRoot . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, $sub);

if (!is_file($abs) || strpos(realpath($abs), realpath($dataRoot)) !== 0) {
    http_response_code(404);
    exit('Not found');
}

if (!boardroom_can_access($rel)) {
    http_response_code(403);
    header('Content-Type: text/html; charset=utf-8');
    echo '<p>Password Required — <a href="index.php?p=' . htmlspecialchars(rawurlencode(dirname($sub)), ENT_QUOTES) . '">ログイン</a></p>';
    exit;
}

$mime = mime_content_type($abs) ?: 'application/octet-stream';
header('Content-Type: ' . $mime);
header('Content-Length: ' . filesize($abs));
readfile($abs);
