<?php
require_once dirname(__DIR__, 2) . '/config/config.php';
require_once dirname(__DIR__, 2) . '/includes/functions.php';
startSecureSession();

if ($_SESSION['admin_role'] !== 'super_admin') {
    http_response_code(403);
    die('Unauthorized');
}

$dir  = $_GET['dir'] ?? '';
$file = $_GET['file'] ?? '';

$baseDir = realpath(ROOT_PATH);
$targetPath = realpath($baseDir . '/' . $dir . '/' . $file);

if ($targetPath && strpos($targetPath, $baseDir) === 0 && is_file($targetPath)) {
    echo file_get_contents($targetPath);
} else {
    http_response_code(404);
    echo 'File not found or access denied.';
}
