<mvt:comment> Redirect to login if not authenticated </mvt:comment>
<mvt:if expr="NOT g.Customer_ID">
<mvt:assign name="g.redirect" value="miva_output_header( 'Location', g.secure_sessionurl $ 'Screen=LOGN' )" />
<mvt:exit />
</mvt:if>

<mvt:comment> Whitelist of allowed files - never trust raw user input for a path </mvt:comment>
<mvt:assign name="l.allowed_files:1" value="'2026/Pricelist_2026.pdf'" />
<mvt:assign name="l.allowed_count" value="1" />

<mvt:comment> Validate the requested file against the whitelist </mvt:comment>
<mvt:assign name="l.file_valid" value="0" />
<mvt:assign name="l.pos" value="1" />
<mvt:while expr="l.pos LE l.allowed_count">
<mvt:if expr="g.file EQ l.allowed_files[l.pos]">
<mvt:assign name="l.file_valid" value="1" />
</mvt:if>
<mvt:assign name="l.pos" value="l.pos + 1" />
</mvt:while>

<mvt:if expr="NOT l.file_valid">
<mvt:assign name="g.h" value="miva_output_header( 'HTTP/1.1', '403 Forbidden' )" />
<mvt:exit />
</mvt:if>

<mvt:comment> Read the PDF from the secured data directory </mvt:comment>
<mvt:assign name="l.filepath" value="'secured-docs/' $ g.file" />
<mvt:assign name="l.result" value="file_read( l.filepath, 'data', l.pdf_data )" />

<mvt:if expr="l.result EQ -1">
<mvt:assign name="g.h" value="miva_output_header( 'HTTP/1.1', '404 Not Found' )" />
<mvt:exit />
</mvt:if>

<mvt:comment> Stream the PDF to the browser </mvt:comment>
<mvt:assign name="g.h" value="miva_output_header( 'Content-Type', 'application/pdf' )" />
<mvt:assign name="g.h" value="miva_output_header( 'Content-Disposition', 'attachment; filename=&quot;' $ glosub( g.file, '/', '_' ) $ '&quot;' )" />
<mvt:assign name="g.h" value="miva_output_header( 'Cache-Control', 'no-cache, no-store, must-revalidate' )" />
<mvt:assign name="g.h" value="miva_output_header( 'Pragma', 'no-cache' )" />
<mvt:assign name="g.h" value="miva_output_header( 'Expires', '0' )" />
<mvt:eval expr="l.pdf_data" />