Add read-only Hermes document links

public/files.php

@@ -0,0 +1,67 @@
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/../modules/shared/db.php';
+require_once __DIR__ . '/../modules/shared/auth/service.php';
+
+$requestMethod = strtoupper((string) ($_SERVER['REQUEST_METHOD'] ?? 'GET'));
+if ($requestMethod !== 'GET') {
+    http_response_code(405);
+    header('Allow: GET');
+    echo 'Methode nicht erlaubt.';
+    exit;
+}
+
+$env = expand_env_values(parse_env_file(__DIR__ . '/../.env'));
+$pdo = connect_database($env);
+auth_bootstrap_session();
+auth_require_user($pdo);
+
+$documentRoot = rtrim(env_value('HERMES_DOCUMENT_ROOT', $env), DIRECTORY_SEPARATOR);
+if ($documentRoot === '' || !str_starts_with($documentRoot, DIRECTORY_SEPARATOR)) {
+    http_response_code(500);
+    echo 'Dokumentablage ist nicht konfiguriert.';
+    exit;
+}
+
+$resolvedRoot = realpath($documentRoot);
+$relativePath = (string) ($_GET['path'] ?? '');
+
+if ($resolvedRoot === false || !is_dir($resolvedRoot) || $relativePath === '' || str_contains($relativePath, "\0") || str_contains($relativePath, '\\') || str_starts_with($relativePath, '/')) {
+    http_response_code(404);
+    echo 'Dokument nicht gefunden.';
+    exit;
+}
+
+$segments = explode('/', $relativePath);
+foreach ($segments as $segment) {
+    if ($segment === '' || $segment === '.' || $segment === '..') {
+        http_response_code(404);
+        echo 'Dokument nicht gefunden.';
+        exit;
+    }
+}
+
+$resolvedFile = realpath($resolvedRoot . DIRECTORY_SEPARATOR . $relativePath);
+$rootPrefix = $resolvedRoot . DIRECTORY_SEPARATOR;
+if ($resolvedFile === false || !is_file($resolvedFile) || !is_readable($resolvedFile) || !str_starts_with($resolvedFile, $rootPrefix)) {
+    http_response_code(404);
+    echo 'Dokument nicht gefunden.';
+    exit;
+}
+
+$fileSize = filesize($resolvedFile);
+$mimeType = mime_content_type($resolvedFile);
+if ($fileSize === false || $mimeType === false) {
+    http_response_code(500);
+    echo 'Dokument konnte nicht bereitgestellt werden.';
+    exit;
+}
+
+$downloadName = basename($resolvedFile);
+header('Content-Type: ' . $mimeType);
+header('Content-Length: ' . (string) $fileSize);
+header("Content-Disposition: attachment; filename*=UTF-8''" . rawurlencode($downloadName));
+header('Cache-Control: private, no-store');
+header('X-Content-Type-Options: nosniff');
+readfile($resolvedFile);