<?php

/**
 * Serves an attachment. The attachments/ folder itself is closed by
 * .htaccess — this is the only way to read a file, and it requires a
 * logged-in session.
 *
 * scope = equipment | maintenance | intervention | signature
 */

if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

if (empty($_SESSION['iduserlogin'])) {
    http_response_code(401);
    exit('Non autorizzato.');
}

require_once __DIR__ . '/../include/functions.php';

$scope = (string)($_GET['scope'] ?? 'equipment');
$id = (int)($_GET['id'] ?? 0);

if ($id <= 0) {
    http_response_code(400);
    exit('ID non valido.');
}

$tables = [
    'equipment'    => 'inv_equipment_files',
    'maintenance'  => 'maint_maintenance_files',
    'intervention' => 'maint_intervention_files',
];

$pdo = mnt_pdo();

if ($scope === 'signature') {
    $stmt = $pdo->prepare("SELECT signature_path AS stored_name, 'firma.png' AS original_name, 'image/png' AS mime_type FROM maint_interventions WHERE id = ?");
    $stmt->execute([$id]);
} elseif (isset($tables[$scope])) {
    $stmt = $pdo->prepare("SELECT stored_name, original_name, mime_type FROM {$tables[$scope]} WHERE id = ?");
    $stmt->execute([$id]);
} else {
    http_response_code(400);
    exit('Scope non valido.');
}

$file = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$file || empty($file['stored_name'])) {
    http_response_code(404);
    exit('File non trovato.');
}

// basename() keeps a crafted stored_name from escaping the folder
$path = __DIR__ . '/../attachments/' . basename((string)$file['stored_name']);

if (!is_file($path)) {
    http_response_code(404);
    exit('File non presente sul server.');
}

$mimeType = $file['mime_type'] ?: 'application/octet-stream';
$disposition = isset($_GET['download']) ? 'attachment' : 'inline';

header('Content-Type: ' . $mimeType);
header('Content-Length: ' . filesize($path));
header('Content-Disposition: ' . $disposition . '; filename="' . rawurlencode((string)$file['original_name']) . '"');
header('X-Content-Type-Options: nosniff');

readfile($path);