Initial SeConectai briefing system

app/api/anexos/[id]/route.ts

@@ -0,0 +1,63 @@
+import { createReadStream } from "fs";
+import { stat } from "fs/promises";
+import { NextResponse } from "next/server";
+import { Readable } from "stream";
+import { getAnexoAutorizado } from "@/lib/anexo-service";
+import { db } from "@/lib/db";
+import { assertSameOrigin } from "@/lib/request-security";
+import { removeStoredFile } from "@/lib/storage";
+
+export const runtime = "nodejs";
+
+function safeFileName(name: string) {
+  return name.replace(/["\r\n]/g, "_");
+}
+
+export async function GET(_request: Request, { params }: { params: { id: string } }) {
+  const anexo = await getAnexoAutorizado(params.id);
+
+  if (!anexo) {
+    return NextResponse.json({ message: "Anexo nao encontrado." }, { status: 404 });
+  }
+
+  try {
+    const fileStat = await stat(anexo.caminho);
+    const stream = Readable.toWeb(createReadStream(anexo.caminho)) as ReadableStream;
+
+    return new Response(stream, {
+      headers: {
+        "Content-Type": anexo.mime,
+        "Content-Length": String(fileStat.size),
+        "Content-Disposition": `attachment; filename="${safeFileName(anexo.nomeOriginal)}"`,
+        "X-Content-Type-Options": "nosniff"
+      }
+    });
+  } catch {
+    return NextResponse.json({ message: "Arquivo nao encontrado no armazenamento." }, { status: 404 });
+  }
+}
+
+export async function DELETE(request: Request, { params }: { params: { id: string } }) {
+  const originError = assertSameOrigin(request);
+  if (originError) return originError;
+
+  const anexo = await getAnexoAutorizado(params.id);
+
+  if (!anexo) {
+    return NextResponse.json({ message: "Anexo nao encontrado." }, { status: 404 });
+  }
+
+  if (anexo.briefing.status !== "RASCUNHO") {
+    return NextResponse.json(
+      { message: "Briefing enviado nao aceita remocao de anexos." },
+      { status: 409 }
+    );
+  }
+
+  await db.anexo.delete({
+    where: { id: anexo.id }
+  });
+  await removeStoredFile(anexo.caminho);
+
+  return NextResponse.json({ ok: true });
+}