<?php
require_once __DIR__ . '/../includes/bootstrap.php';
auth_require_admin();
$id = (int)($_GET['id'] ?? 0);
$row = $pdo->prepare("SELECT file_path, mime FROM kyc_documents WHERE id=?");
$row->execute([$id]);
$f = $row->fetch(PDO::FETCH_ASSOC) ?: exit('Not found');

$full = realpath(__DIR__ . '/../uploads/' . $f['file_path']);
$root = realpath(__DIR__ . '/../uploads');
if (!$full || !str_starts_with($full, $root)) exit('Denied');

header('Content-Type: '.$f['mime']);
header('Content-Disposition: inline; filename="'.basename($full).'"');
readfile($full);
