1. download-cv.php

Purpose: client enters their email address.

Flow:

Client enters email
System checks if email exists in clients
System checks if client has active files in client_files
System sends OTP
Redirects to download-verify.php

This page should query:

SELECT c.id, c.email
FROM clients c
WHERE c.email = ?
  AND c.deleted_at IS NULL
  AND c.is_active = 1
LIMIT 1

Then confirm the client has downloadable files:

SELECT COUNT(*)
FROM client_files
WHERE client_id = ?
  AND is_active = 1
  AND deleted_at IS NULL

Then create OTP in:

client_file_access_otps
2. download-verify.php

Purpose: client enters the OTP.

Flow:

Client enters OTP
System checks OTP is valid, not expired, not used
System creates a secure download session
System marks OTP as used
Redirects to download-files.php

This page should create a record in:

client_download_sessions

Then store only a safe session token in PHP session, for example:

$_SESSION['client_download_session_token'] = $token;
3. download-files.php

Purpose: show the client their available files.

Flow:

Check valid download session
Fetch client files
Group files by order/package/type
Show download buttons

This page should query from:

client_files
client_orders
order_packages

Example display:

Order: SC-2026-0001

Default Package
- Resume PDF
- Resume DOCX
- Cover Letter PDF
- Cover Letter DOCX

Each download button should link to:

/download-file.php?file=FILE_UUID

Do not expose raw storage paths.

4. download-file.php

Purpose: securely stream the private file.

This is the most sensitive page.

Flow:

Check valid download session
Check requested file belongs to the verified client
Check file is active and not deleted
Build private storage path
Stream file using headers
Increment download_count
Insert client_download_logs record

It should not use public paths like this old code:

$_SERVER['DOCUMENT_ROOT'] . '/uploads/clients/' . $file['file_path'];

That old approach is public-folder based and belongs to the old system.

The new path should be based on your private folder:

/home/nyvaqpsm/private_student_cycle/client_files/

Local XAMPP equivalent:

C:/xampp/htdocs/private_student_cycle/client_files/

The DB stores relative paths like:

order_1/client_1_order_1_20260711_random.pdf

So download-file.php builds the final path safely.

5. download-logout.php

Purpose: destroy the client download session.

Flow:

Mark download session revoked or expired
Unset PHP session token
Redirect to download-cv.php

This is useful when clients are using shared devices.