<?php
#ini_set('display_errors', 1);
#ini_set('display_startup_errors', 1);
#error_reporting(E_ALL);

require_once("includes/config.inc.php");



if( isset( $_GET['token'] ) && $_GET['token'] == "YIz8HqUPWQ7cwcVHE57O" ) {

    //$oDB = new MysqliDb( MYSQL_HOST, MYSQL_USER, MYSQL_PASS, MYSQL_DB );
    global $oPDF;
    global $oData;


    // Worktime-ZIP-Download – per PHP gestreamt, da nginx das direkte Ausliefern
    // von .zip-Dateien aus time/ verbietet. Zusätzlich: erneuter Download eines
    // archivierten Laufs (&archive=<name>) sowie das PDF-Job-Archiv (type=worktimepdf).
    if( isset( $_GET['type'] ) && ( $_GET['type'] == 'worktime' || $_GET['type'] == 'worktimepdf' ) ) {

        $dlName = 'Zeitnachweise.zip';

        if( $_GET['type'] == 'worktimepdf' ) {
            // PDF-Job-Archiv: time/pdf/<job>/timesheets_pdf.zip
            $job  = isset( $_GET['job'] ) ? basename( (string) $_GET['job'] ) : '';
            if( ! preg_match( '/^[a-f0-9]{32}$/', $job ) ) { header('HTTP/1.1 400 Bad Request'); echo 'Ungültiger Job.'; exit; }
            $base = realpath( PATH_SYSTEM . '/time/pdf' );
            $real = realpath( PATH_SYSTEM . '/time/pdf/' . $job . '/timesheets_pdf.zip' );
            $dlName = 'Zeitnachweise_PDF.zip';
        } elseif( isset( $_GET['archive'] ) && $_GET['archive'] !== '' ) {
            // Archivierter Lauf (erneuter Download)
            $an = basename( (string) $_GET['archive'] );
            if( ! preg_match( '/^[A-Za-z0-9._-]+\.zip$/', $an ) ) { header('HTTP/1.1 400 Bad Request'); echo 'Ungültiger Dateiname.'; exit; }
            $base = realpath( PATH_SYSTEM . '/time/processed/archive' );
            $real = realpath( PATH_SYSTEM . '/time/processed/archive/' . $an );
            $dlName = $an;
        } else {
            // Zuletzt erzeugtes ZIP
            $base = realpath( PATH_SYSTEM . '/time/processed' );
            $real = realpath( PATH_SYSTEM . '/time/processed/processed_files.zip' );
        }

        if( $real === false || $base === false || strpos( $real, $base ) !== 0 || !is_file( $real ) ) {
            header('HTTP/1.1 404 Not Found');
            echo 'ZIP nicht gefunden. Bitte zuerst die Zeitnachweise erstellen.';
            exit;
        }

        while( ob_get_level() ) { ob_end_clean(); }

        header('Content-Description: File Transfer');
        header('Content-Type: application/zip');
        header('X-Content-Type-Options: nosniff');
        header('Content-Length: ' . filesize( $real ));
        header('Content-Disposition: attachment; filename="' . $dlName . '"');
        // Nicht cachen – die Zeitnachweise werden bei jedem Vorgang neu erzeugt, es darf
        // niemals ein altes ZIP/PDF (gleicher Job) aus dem Browser-Cache geliefert werden.
        header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
        header('Pragma: no-cache');
        header('Expires: 0');

        $fh = fopen( $real, 'rb' );
        if( $fh === false ) { header('HTTP/1.1 500 Internal Server Error'); exit; }
        fpassthru( $fh );
        fclose( $fh );
        exit;
    }


    if( isset( $_GET['invoice'] ) ) {

        $bookingID = $_GET['invoice'];
        $data = $oData->dataset( $bookingID );


        // Ausgabemodus: 'D' = Download (Attachment), sonst 'I' = inline anzeigen.
        $dest = ( isset( $_GET['download'] ) && $_GET['download'] == 1 ) ? 'D' : 'I';

        if( isset( $_GET['show'] ) && $_GET['show'] == 1 ) { // Dokument anzeigen
          if( isset( $_GET['type'] ) ) {
            switch( $_GET['type'] ) {
              case "card" :
				$bookingNo='';
				$oPDF->__construct('L','mm',array(85,54));
				foreach( $data->bookings as $key => $value ) {
					$bookingNo = explode('-', $value->booking_no);
					$bookingNo = $bookingNo[0] . '-' . $bookingNo[1];
					$oPDF->newCustomerCard($data->customer->customer_lastname . ', ' . $data->customer->customer_firstname, $value->booking_no, $value->booking_begin, $value->booking_end, $value->booking_event, array('booking_parkplatz' => $value->booking_parkplatz, 'booking_special' => $value->booking_special, 'booking_serial' => $value->booking_serial, 'kennzeichen' => $value->kennzeichen, 'invoice_payment' => $data->invoice->invoice_payment));
				}
				$oPDF->Output($dest, 'card_' . $bookingNo . '.pdf');
				break;
			  case "valet":
				$oPDF->createValetHandover( $data, FALSE, $dest );
				break;
              case "inv" :
                $oPDF->createInvoice( $data, FALSE, FALSE, FALSE, $dest );
                break;
              case "cng" :
                $oPDF->createInvoice( $data, FALSE, FALSE, TRUE, $dest );
                break;
              default :
                $oPDF->createBooking( $data, FALSE, $dest );
                break;
            }
          } else {
            $oPDF->createBooking( $data, FALSE, $dest );
          }

          //echo "Ausgabe";
        }
        else { // Dokument erstellen
          //$data = json_decode( json_encode( $data ) );
          $oPDF->createBooking( $data );

          echo "Buchungsbestätigung erstellt";
        }
    } else {

        $oDocuments = new documents( $_GET['date'] );

        switch( $_GET['type'] ) {
            case "cash":
                $oDocuments->createCash( FALSE );
                break;
            case "arrivals":
                $oDocuments->createList( FALSE );
                break;
            case "cards":
                $oDocuments->customerCards( $_GET['list'], FALSE );
                break;
            case "valetday":
                // Alle VALET-Anreisen (product_id 8/10) des Tages als ein PDF (Übergabeformulare).
                $vDate = isset($_GET['date']) ? $_GET['date'] : '';
                if ( ! preg_match( '/^\d{4}-\d{2}-\d{2}$/', $vDate ) ) { while ( ob_get_level() ) ob_end_clean(); http_response_code(400); echo 'bad date'; exit; }
                $vDest = ( isset($_GET['download']) && $_GET['download'] == 1 ) ? 'D' : 'I';
                $vList = ( new dayview() )->valetArrivals( $vDate );
                $oPDF->createValetHandoverDay( $vList, $vDate, $vDest );
                break;
            case "keycards":
                $_GET['outputKeyCards'] = TRUE;
                require_once( dirname(__DIR__) . "/web/includes/classes/pdf.dotted.class.php" );
                break;
			case "download":
				// ?type=download&file=<md5>&inline=1(optional)
				$md5 = isset($_GET['file']) ? strtolower($_GET['file']) : '';
				if (!preg_match('/^[a-f0-9]{32}$/', $md5)) {
					header('HTTP/1.1 400 Bad Request'); echo 'Ungültiger Parameter: file (md5 erwartet)'; exit;
				}

				// Datei-Metadaten aus DB holen (passt zu deinem Snippet)
				$row = $oData->rawQueryOne("
					SELECT file_path, file_name, file_type
					FROM pacim_files
					WHERE file_md5 = ?
					LIMIT 1
				", [$md5]);

				if (!$row || empty($row['file_path'])) {
					header('HTTP/1.1 404 Not Found'); echo 'Datei nicht gefunden'; exit;
				}

				// Whitelist der Basis-Ordner und erlaubte Dateitypen (anpassen!)
				$ALLOWED_BASE_DIRS = [
					realpath(PATH_DATAS . '/trash'),
				];
				$ALLOWED_EXTENSIONS = ['pdf','csv','xlsx','xls','png','jpg','jpeg','zip','txt','json','xml'];

				$filePathFromDb = isset($row['file_path']) ? trim($row['file_path']) : '';
				$fileNameFromDb = isset($row['file_name']) ? trim($row['file_name']) : '';

				if ($filePathFromDb === '') {
					header('HTTP/1.1 404 Not Found');
					echo 'Dateipfad fehlt.';
					exit;
				}

				// Wenn file_path schon komplette Datei ist
				if (is_file($filePathFromDb)) {
					$candidate = $filePathFromDb;
				} else {
					// Sonst file_path + file_name zusammensetzen
					$candidate = rtrim($filePathFromDb, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . ltrim($fileNameFromDb, DIRECTORY_SEPARATOR);
				}

				// Wenn relativer Pfad, an Basisordner hängen
				if ($candidate[0] !== '/') {
					$candidate = rtrim($allowedBaseDirs[0], DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . ltrim($candidate, DIRECTORY_SEPARATOR);
				}

				// Realpath + Existenz prüfen
				$real = realpath($candidate);
				if ($real === false || !is_file($real)) {
					header('HTTP/1.1 404 Not Found'); echo 'Datei existiert nicht'; exit;
				}

				// Erweiterung prüfen
				$ext = strtolower(pathinfo($real, PATHINFO_EXTENSION));
				if (!in_array($ext, $ALLOWED_EXTENSIONS, true)) {
					header('HTTP/1.1 403 Forbidden'); echo 'Dateityp nicht erlaubt'; exit;
				}

				// Sicherstellen, dass die Datei innerhalb der erlaubten Ordner liegt
				$allowed = false;
				foreach ($ALLOWED_BASE_DIRS as $base) {
					if ($base && strpos($real, $base) === 0) { $allowed = true; break; }
				}
				if (!$allowed) {
					header('HTTP/1.1 403 Forbidden'); echo 'Pfad nicht erlaubt'; exit;
				}

				// Dateiname/MIME/Inline
				$downloadName = !empty($row['file_name']) ? $row['file_name'] : basename($real);
				$inline       = (isset($_GET['inline']) && $_GET['inline'] === '1');

				// MIME bevorzugt via finfo ermitteln, DB-Wert als Fallback
				$mime = null;
				if (function_exists('finfo_open')) {
					$fi = finfo_open(FILEINFO_MIME_TYPE);
					if ($fi) { $mime = finfo_file($fi, $real); finfo_close($fi); }
				}
				if (!$mime) { $mime = !empty($row['file_type']) ? $row['file_type'] : 'application/octet-stream'; }

				// ETag/Cache
				$filesize = filesize($real);
				$filemtime = filemtime($real);
				$etag = sprintf('W/"%s-%d-%d"', $md5, $filesize, $filemtime);

				header('ETag: ' . $etag);
				if (isset($_SERVER['HTTP_IF_NONE_MATCH']) && trim($_SERVER['HTTP_IF_NONE_MATCH']) === $etag) {
					header('HTTP/1.1 304 Not Modified'); exit;
				}

				// Header
				header('Content-Description: File Transfer');
				header('Content-Type: ' . $mime);
				header('X-Content-Type-Options: nosniff');
				header('Content-Length: ' . $filesize);
				header('Content-Disposition: ' . ($inline ? 'inline' : 'attachment') . '; filename="' . basename($downloadName) . '"');
				header('Last-Modified: ' . gmdate('D, d M Y H:i:s', $filemtime) . ' GMT');
				header('Cache-Control: private, max-age=3600, must-revalidate');
				header('Pragma: public');

				// Ausgabepuffer leeren & streamen
				while (ob_get_level()) { ob_end_clean(); }
				$fh = fopen($real, 'rb');
				if ($fh === false) { header('HTTP/1.1 500 Internal Server Error'); echo 'Datei konnte nicht geöffnet werden'; exit; }
				fpassthru($fh);
				fclose($fh);
				exit;
				break;
            default:
                die('error');
                break;
        }





    }


    //echo "<pre>";
    //print_r( $data );
    //echo "</pre>";

} else {
    echo "Zugriff verweigert!";
}