<?php
// Streams an mp4 with HTTP Range support so the player can seek.
// The file is looked up by database ID only — the client never supplies a
// filesystem path, which rules out path traversal.
require_once __DIR__ . '/includes/auth.php';
require_once __DIR__ . '/includes/functions.php';

$userId = currentUserId();
if ($userId === null) {
    http_response_code(403);
    exit('Forbidden');
}

$video = getVideo((int)($_GET['id'] ?? 0));
if (!$video) {
    http_response_code(404);
    exit('Not found');
}

$file = realpath(rtrim(VIDEOS_ROOT, '/') . '/' . $video['path']);
$root = realpath(VIDEOS_ROOT);
if ($file === false || $root === false || !str_starts_with($file, $root . DIRECTORY_SEPARATOR) || !is_file($file)) {
    http_response_code(404);
    exit('File missing — rescan the library');
}

$size  = filesize($file);
$start = 0;
$end   = $size - 1;

if (isset($_SERVER['HTTP_RANGE']) && preg_match('/bytes=(\d*)-(\d*)/', $_SERVER['HTTP_RANGE'], $m)) {
    if ($m[1] !== '') {
        $start = (int)$m[1];
        if ($m[2] !== '') $end = min((int)$m[2], $size - 1);
    } elseif ($m[2] !== '') {           // suffix range: last N bytes
        $start = max(0, $size - (int)$m[2]);
    }
    if ($start > $end || $start >= $size) {
        http_response_code(416);
        header("Content-Range: bytes */$size");
        exit;
    }
    http_response_code(206);
    header("Content-Range: bytes $start-$end/$size");
} else {
    http_response_code(200);
}

session_write_close();               // don't block other requests from this user
ignore_user_abort(false);
set_time_limit(0);

// The bytes must reach the socket as they are read: an output buffer
// (php.ini's output_buffering=4096 is common) holds them back, and transparent
// compression would change the length Content-Range and Content-Length promise.
while (ob_get_level() > 0) {
    ob_end_clean();
}
ini_set('zlib.output_compression', '0');

header('Content-Type: video/mp4');
header('Accept-Ranges: bytes');
header('Content-Length: ' . ($end - $start + 1));
header('Cache-Control: private, max-age=3600');

if ($_SERVER['REQUEST_METHOD'] === 'HEAD') {
    exit;
}

$fp = fopen($file, 'rb');
fseek($fp, $start);
$remaining = $end - $start + 1;
while ($remaining > 0 && !feof($fp) && !connection_aborted()) {
    $chunk = fread($fp, min(1024 * 512, $remaining));
    if ($chunk === false) break;
    echo $chunk;
    flush();
    $remaining -= strlen($chunk);
}
fclose($fp);