import { createReadStream } from "fs";
import { stat } from "fs/promises";
import { NextResponse } from "next/server";
import { Readable } from "stream";
import { getAnexoAutorizado } from "@/lib/anexo-service";
import { db } from "@/lib/db";
import { assertSameOrigin } from "@/lib/request-security";
import { removeStoredFile } from "@/lib/storage";

export const runtime = "nodejs";

function safeFileName(name: string) {
  return name.replace(/["\r\n]/g, "_");
}

export async function GET(_request: Request, { params }: { params: { id: string } }) {
  const anexo = await getAnexoAutorizado(params.id);

  if (!anexo) {
    return NextResponse.json({ message: "Anexo nao encontrado." }, { status: 404 });
  }

  try {
    const fileStat = await stat(anexo.caminho);
    const stream = Readable.toWeb(createReadStream(anexo.caminho)) as ReadableStream;

    return new Response(stream, {
      headers: {
        "Content-Type": anexo.mime,
        "Content-Length": String(fileStat.size),
        "Content-Disposition": `attachment; filename="${safeFileName(anexo.nomeOriginal)}"`,
        "X-Content-Type-Options": "nosniff"
      }
    });
  } catch {
    return NextResponse.json({ message: "Arquivo nao encontrado no armazenamento." }, { status: 404 });
  }
}

export async function DELETE(request: Request, { params }: { params: { id: string } }) {
  const originError = assertSameOrigin(request);
  if (originError) return originError;

  const anexo = await getAnexoAutorizado(params.id);

  if (!anexo) {
    return NextResponse.json({ message: "Anexo nao encontrado." }, { status: 404 });
  }

  if (anexo.briefing.status !== "RASCUNHO") {
    return NextResponse.json(
      { message: "Briefing enviado nao aceita remocao de anexos." },
      { status: 409 }
    );
  }

  await db.anexo.delete({
    where: { id: anexo.id }
  });
  await removeStoredFile(anexo.caminho);

  return NextResponse.json({ ok: true });
}