<?php
require_once __DIR__ . '/auth.php';
require_login();
require_once __DIR__ . '/config.php';

$id = (int)($_GET['id'] ?? 0);
$st = $pdo->prepare('SELECT * FROM loan_terms WHERE id = ?');
$st->execute([$id]);
$t = $st->fetch();
if (!$t) { http_response_code(404); exit('Arquivo não encontrado'); }

$path = $UPLOAD_DIR . '/' . $t['filepath'];
if (!is_file($path)) { http_response_code(404); exit('Arquivo ausente'); }

header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . basename($t['filename_original']) . '"');
header('Content-Length: ' . filesize($path));
readfile($path);
