import { readFile } from "node:fs/promises";
import path from "node:path";
import { NextResponse } from "next/server";
import { auth } from "@/auth";
import { prisma } from "@/lib/prisma";
import { chatDir, isSafeStoredName } from "@/lib/upload";

export async function GET(
  _req: Request,
  { params }: { params: Promise<{ id: string }> },
) {
  const session = await auth();
  if (!session?.user) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  const { id } = await params;
  const att = await prisma.messageAttachment.findUnique({
    where: { id },
    select: {
      storedName: true,
      mime: true,
      originalName: true,
      kind: true,
      message: { select: { channelId: true } },
    },
  });
  if (!att) {
    return NextResponse.json({ error: "Not found" }, { status: 404 });
  }

  // Zugriffsschutz: nur Kanalmitglieder dürfen die Datei laden.
  const member = await prisma.channelMember.findUnique({
    where: {
      channelId_userId: {
        channelId: att.message.channelId,
        userId: session.user.id,
      },
    },
    select: { channelId: true },
  });
  if (!member) {
    return NextResponse.json({ error: "Not found" }, { status: 404 });
  }

  if (!isSafeStoredName(att.storedName)) {
    return NextResponse.json({ error: "Bad request" }, { status: 400 });
  }

  let data: Buffer;
  try {
    data = await readFile(path.join(chatDir(att.message.channelId), att.storedName));
  } catch {
    return NextResponse.json({ error: "Not found" }, { status: 404 });
  }

  const safeName = att.originalName.replace(/["\r\n]/g, "");
  const disposition =
    att.kind === "FILE" ? `attachment; filename="${safeName}"` : "inline";

  return new Response(new Uint8Array(data), {
    headers: {
      "Content-Type": att.mime,
      "Content-Disposition": disposition,
      "Cache-Control": "private, max-age=86400",
    },
  });
}