import { NextResponse } from "next/server";
import { writeFile } from "node:fs/promises";
import { randomBytes } from "node:crypto";
import path from "node:path";
import { auth } from "@/auth";
import { prisma } from "@/lib/prisma";
import { avatarDir, extForMime, isImageMime, MAX_AVATAR_BYTES } from "@/lib/upload";

export async function POST(req: Request) {
  const session = await auth();
  if (!session?.user) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  const form = await req.formData();
  const file = form.get("file");
  if (!(file instanceof File)) {
    return NextResponse.json({ error: "Keine Datei." }, { status: 400 });
  }
  if (!isImageMime(file.type)) {
    return NextResponse.json({ error: "Nur Bilder erlaubt." }, { status: 400 });
  }
  if (file.size > MAX_AVATAR_BYTES) {
    return NextResponse.json({ error: "Bild zu groß (max. 4 MB)." }, { status: 400 });
  }

  const buf = Buffer.from(await file.arrayBuffer());
  const name = `u-${session.user.id}-${randomBytes(4).toString("hex")}.${extForMime(file.type)}`;
  const dir = await avatarDir();
  await writeFile(path.join(dir, name), buf);

  const url = `/uploads/avatars/${name}`;
  await prisma.user.update({
    where: { id: session.user.id },
    data: { avatarUrl: url },
  });

  return NextResponse.json({ url });
}