<?php
/**
 * Dedicated admin file viewer — lets a backoffice user open files whose owning
 * thesis is marked 'Interdit' (access_type_id=3).
 *
 * Security:
 *   - Auth-gated by AdminAuth::requireLogin() → only an authenticated admin
 *     session (cookie scoped to /admin) can reach the handler below.
 *   - Delegates to MediaController::handle(adminBypass: true), which bypasses
 *     ONLY the Interdit visibility gate. The strict path-whitelist, realpath()
 *     storage jail and MIME allow-list remain fully enforced, so an admin
 *     cannot read arbitrary files on the server.
 *
 * Usage: /admin/media.php?path=tfe/2025/2025-001/rapport.pdf
 */
require_once __DIR__ . '/../../bootstrap.php';
require_once __DIR__ . '/../../src/AdminAuth.php';

AdminAuth::requireLogin();

require_once APP_ROOT . '/src/Controllers/MediaController.php';

$controller = new MediaController();
$controller->handle(adminBypass: true);