<?php
require_once __DIR__ . '/../lib/auth.php';
require_login();

$current = current_user();

if (is_admin() && isset($_GET['user_id'])) {
    $target_id = (int)$_GET['user_id'];
} else {
    $target_id = (int)$current['id'];
}

$stmt = db()->prepare('SELECT * FROM einsatzanweisung WHERE user_id = ?');
$stmt->execute([$target_id]);
$ea = $stmt->fetch();

if (!$ea || $ea['filename'] === '') {
    http_response_code(404);
    echo 'Keine Datei gefunden.';
    exit;
}

$path = dirname(__DIR__) . '/uploads/' . basename($ea['filename']);
if (!is_file($path)) {
    http_response_code(404);
    echo 'Datei nicht gefunden.';
    exit;
}

$display      = $ea['original_name'];
$safe_display = addslashes($display);
$safe_encoded = rawurlencode($display);

header('Content-Type: application/pdf');
header('Content-Disposition: attachment; filename="' . $safe_display . '"; filename*=UTF-8\'\'' . $safe_encoded);
header('Content-Length: ' . filesize($path));
header('X-Content-Type-Options: nosniff');
header('Cache-Control: private, no-store');
readfile($path);
exit;