<?php
declare(strict_types=1);
if (!defined('CALIBER_AUTH_LOAD')) { define('CALIBER_AUTH_LOAD', true); }
require_once __DIR__ . '/private/auth.php';
caliber_start();
$path = caliber_path();
if (!caliber_protected_path($path)) { http_response_code(404); exit; }
if (!in_array($_SERVER['REQUEST_METHOD'], ['GET', 'HEAD'], true)) {
    header('Allow: GET, HEAD'); http_response_code(405); exit;
}
if (!caliber_logged_in()) { caliber_redirect('/?login=expired#login'); }
session_write_close(); // Release the session before parallel image requests.
if (str_ends_with($path, '/')) { $path .= 'index.html'; }
$file = realpath(__DIR__ . $path);
$root = realpath(__DIR__) . DIRECTORY_SEPARATOR;
if ($file === false || !str_starts_with($file, $root) || !is_file($file)) { http_response_code(404); exit; }
$mime = ['html'=>'text/html; charset=utf-8', 'webp'=>'image/webp'];
$type = $mime[strtolower(pathinfo($file, PATHINFO_EXTENSION))] ?? null;
if ($type === null) { http_response_code(404); exit; }
header('Content-Type: ' . $type);
if ($_SERVER['REQUEST_METHOD'] === 'GET') { readfile($file); }