<?php
// Self-bootstrapping download handler. Assumed location:
//   <host>/shared/platform-tools/api/backup_download.php

$repo_root = dirname(__DIR__, 3);
require_once $repo_root . '/config/db.php';
require_once $repo_root . '/config/functions.php';
require_once $repo_root . '/config/functions_backup.php';
require_sysadmin();

$filename = $_GET['file'] ?? '';

if (!backup_filename_is_safe($filename)) {
    http_response_code(400);
    exit('Ficheiro inválido.');
}

$dir      = backup_dir();
$filepath = $dir . DIRECTORY_SEPARATOR . $filename;
$real     = realpath($filepath);

if ($real === false || !str_starts_with($real, $dir . DIRECTORY_SEPARATOR)) {
    http_response_code(403);
    exit('Acesso negado.');
}

if (!is_file($real)) {
    http_response_code(404);
    exit('Ficheiro não encontrado.');
}

$size = filesize($real);

header('Content-Type: application/zip');
header('Content-Disposition: attachment; filename="' . $filename . '"');
header('Content-Length: ' . $size);
header('Cache-Control: no-store, no-cache, must-revalidate');
header('Pragma: no-cache');

if (ob_get_level()) ob_end_clean();

readfile($real);
exit;