<?php

declare(strict_types=1);

$path = ltrim((string) ($_GET['path'] ?? ''), '/');
if ($path === '' || str_contains($path, '..') || !str_starts_with($path, 'assets/vendor/')) {
    http_response_code(404);
    echo 'Asset not found';
    exit;
}

$base = realpath(dirname(__DIR__, 2) . '/feca_mailshots_plugin');
$file = $base === false ? false : realpath($base . '/' . $path);
if ($base === false || $file === false || !str_starts_with($file, $base . DIRECTORY_SEPARATOR) || !is_file($file)) {
    http_response_code(404);
    echo 'Asset not found';
    exit;
}

$ext = strtolower(pathinfo($file, PATHINFO_EXTENSION));
$types = [
    'css' => 'text/css; charset=utf-8',
    'js' => 'application/javascript; charset=utf-8',
];
header('Content-Type: ' . ($types[$ext] ?? 'application/octet-stream'));
readfile($file);