<?php
declare(strict_types=1);
require_once __DIR__ . '/inc/lib.php';
site_require_access();

$type = ($_GET['type'] ?? '') === 'theme' ? 'theme' : (($_GET['type'] ?? '') === 'plugin' ? 'plugin' : '');
$slug = (string) ($_GET['slug'] ?? '');
$item = $type !== '' && site_valid_slug($slug) ? site_item($type, $slug) : null;
$version = null;
if ($item) {
    $wanted = (string) ($_GET['version'] ?? '');
    foreach ($item['versions'] as $v) if ($wanted === '' ? $v === $item['versions'][0] : $v['version'] === $wanted) { $version = $v; break; }
}
$path = $version ? site_storage() . '/packages/' . $version['file'] : '';
if (!$version || !is_file($path)) {
    http_response_code(404);
    header('Content-Type: text/plain; charset=utf-8');
    exit('Paket nicht gefunden.');
}
site_db()->prepare('UPDATE versions SET downloads = downloads + 1 WHERE id = ?')->execute([$version['id']]);

while (ob_get_level() > 0) @ob_end_clean();
header('Content-Type: application/zip');
header('Content-Disposition: attachment; filename="' . $slug . '-' . $version['version'] . '.zip"');
header('Content-Length: ' . filesize($path));
header('X-Content-Type-Options: nosniff');
header('X-DeskHub-SHA256: ' . $version['sha256']);
readfile($path);