<?php
declare(strict_types=1);
/** POLANA V18: serve private tips photo only to authorized manager/admin. */
require_once dirname(__DIR__).'/includes/functions.php';
require_tips_manager();
header('Cache-Control: private, no-store, max-age=0');
header('X-Content-Type-Options: nosniff');
header('X-Robots-Tag: noindex, nofollow');
$id=(int)($_GET['id']??0);
if($id<1){http_response_code(400);exit('Nieprawidłowy numer rozliczenia.');}
$row=tip_pool_by_id($id);
if(!$row||($row['source_type']??'')!=='photo'){http_response_code(404);exit('Nie znaleziono zdjęcia.');}
$relative=(string)($row['source_file']??'');
if(!preg_match('~^storage/tips-photos/[0-9]{4}/[0-9]{2}/[a-f0-9]{24}\.(?:jpg|png|webp)$~D',$relative)){
    http_response_code(404);exit('Zdjęcie jest niedostępne.');
}
$root=realpath(dirname(__DIR__).'/storage/tips-photos');
$file=realpath(dirname(__DIR__).'/'.$relative);
if(!$root||!$file||!str_starts_with($file,$root.DIRECTORY_SEPARATOR)||!is_file($file)){
    http_response_code(404);exit('Plik nie istnieje.');
}
$mime=(string)(new finfo(FILEINFO_MIME_TYPE))->file($file);
if(!in_array($mime,['image/jpeg','image/png','image/webp'],true)){
    http_response_code(415);exit('Nieprawidłowy format zdjęcia.');
}
header('Content-Type: '.$mime);
header('Content-Disposition: inline; filename="rozliczenie-'. $id .'.'.(['image/jpeg'=>'jpg','image/png'=>'png','image/webp'=>'webp'][$mime]).'"');
header('Content-Length: '.(string)filesize($file));
readfile($file);