<?php
/** Auslieferung der App-Dateien – nur für angemeldete Mitarbeiter. */
require_once __DIR__ . '/../includes/bootstrap.php';
$staff = require_staff_login();

$platform = (string) ($_GET['platform'] ?? '');
if ($platform === 'minecraft' && !app_minecraft_enabled()) {
    http_response_code(404);
    exit('Diese App ist nicht hinterlegt.');
}
$info = app_publisher_info($platform);
if (!$info) {
    http_response_code(404);
    exit('Diese App ist nicht hinterlegt.');
}

session_write_close(); // lange Downloads sollen die Sitzung nicht blockieren
@set_time_limit(0);
while (ob_get_level() > 0) { @ob_end_clean(); }

header('Content-Type: ' . $info['mime']);
header('Content-Disposition: attachment; filename="' . $info['filename'] . '"');
header('Content-Length: ' . $info['size']);
header('X-Content-Type-Options: nosniff');
header('Cache-Control: private, no-store');
if (($info['source'] ?? '') === 'publisher') {
    session_write_close();
    @set_time_limit(0);
    $url = app_publisher_endpoint($platform, true);
    $headers = function_exists('catalog_access_headers') ? catalog_access_headers($url) : [];
    if (function_exists('curl_init')) {
        $ch = curl_init($url);
        curl_setopt_array($ch, [CURLOPT_FOLLOWLOCATION => false, CURLOPT_CONNECTTIMEOUT => 8, CURLOPT_TIMEOUT => 0, CURLOPT_HTTPHEADER => $headers, CURLOPT_RETURNTRANSFER => false, CURLOPT_WRITEFUNCTION => static function ($curl, $chunk) { echo $chunk; return strlen($chunk); }]);
        curl_exec($ch);
        curl_close($ch);
    } else {
        $context = stream_context_create(['http' => ['timeout' => 0, 'header' => implode("\r\n", $headers)]]);
        $remote = @fopen($url, 'rb', false, $context);
        if ($remote) { fpassthru($remote); fclose($remote); }
    }
} else {
    readfile($info['path']);
}