Files for the the video https://youtu.be/6Yl6kAiPx4A

.htaccess

<IfModule mod_rewrite.c>
      <IfModule mod_negotiation.c>
           Options -MultiViews
       </IfModule>
    Options +FollowSymlinks -Indexes
    RewriteEngine On

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME) !-d

    RewriteRule ^ index.php [L]
</IfModule>

index.php

<?php
error_reporting(E_ALL);
ini_set('display_errors','On');
session_start();
require_once __DIR__.'/router.php';

$scriptUrl = '/';
$beforeIndexPosition = strpos($_SERVER['PHP_SELF'], '/index.php');

if (false !== $beforeIndexPosition && $beforeIndexPosition > 0) {
    $scriptUrl = substr($_SERVER['PHP_SELF'], 0, $beforeIndexPosition) . '/';
    $_SERVER['REQUEST_URI'] = '/'.str_replace(['/index.php', $scriptUrl], '', $_SERVER['REQUEST_URI']);
}
$privateFilesDir = __DIR__.'/private/';
$_SESSION['userId'] = 1;

router('/files/(.*)',function(string $path) use($privateFilesDir){
  if(!isset($_SESSION['userId'])){
    echo "Bitte vorher einloggen";
    return;
  }
  $filePath =$privateFilesDir.$path;
  if(!is_file($filePath)){
    echo "File not found";
    return;
  }
  $finfo = new finfo(FILEINFO_MIME_TYPE);
  $mimeType = $finfo->file($filePath);
  header('Content-Type: '.$mimeType);
  header('Content-Disposition: attachment; filename="'.basename($filePath).'"');
  header('Content-Length: ' . filesize($filePath));
  readfile($filePath);
});

router($_SERVER['REQUEST_URI']);

router.php

<?php
declare(strict_types=1);

function router($path = null, $action = null, $methods = 'POST|GET',bool $directRequestDisabled = false) {
    static $routes = [];

    if(!$path){
        return $routes;
    }
    if(strpos($path, '..') !== false){
        return;
    }

    if ($action) {
        return $routes['(' . $methods . ')_' . $path] = [$action,$directRequestDisabled];
    }
    $originalPath = str_replace('?'.$_SERVER['QUERY_STRING'], '', $path);
    $path = $_SERVER['REQUEST_METHOD'].'_'.$originalPath;
    foreach ($routes as $route => $data) {
        list($action,$currentDirectRequestIsDisabled) = $data;
        $regEx = "~^$route/?$~i";

        $matches = [];
        if (!preg_match($regEx, $path, $matches)) {
            continue;
        }
        if (!is_callable($action)) {
            return  'Route not found';
        }
        if($currentDirectRequestIsDisabled && isset($_SERVER['REQUEST_URI']) && $_SERVER['REQUEST_URI'] === $originalPath){
             return 'Route not found';
        }
        array_shift($matches);
        array_shift($matches);
        $response = $action(...$matches);
        return $response;
    }
    return  'Route not found';
}