import { NextResponse } from "next/server";
import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
import {
  Attachment,
  AttachmentPartition
} from "@open-mercato/core/modules/attachments/data/entities";
import { checkAttachmentAccess, isSuperAdminAuth } from "@open-mercato/core/modules/attachments/lib/access";
import { z } from "zod";
import { attachmentsTag, attachmentErrorSchema } from "../../openapi.js";
import {
  buildAttachmentContentDisposition,
  canRenderInlineAttachment
} from "@open-mercato/core/modules/attachments/lib/security";
import { StorageDriverFactory } from "../../../lib/drivers/index.js";
const metadata = {
  GET: { requireAuth: false }
};
async function GET(req, context) {
  const { id } = await context.params;
  if (!id) {
    return NextResponse.json(
      { error: "Attachment id is required" },
      { status: 400 }
    );
  }
  const auth = await getAuthFromRequest(req);
  const { resolve } = await createRequestContainer();
  const em = resolve("em");
  const storageDriverFactory = resolve("storageDriverFactory") ?? new StorageDriverFactory(em);
  const findFilter = { id };
  if (auth && !isSuperAdminAuth(auth)) {
    if (auth.tenantId) findFilter.tenantId = auth.tenantId;
    if (auth.orgId) findFilter.organizationId = auth.orgId;
  }
  const attachment = await em.findOne(Attachment, findFilter);
  if (!attachment) {
    return NextResponse.json(
      { error: "Attachment not found" },
      { status: 404 }
    );
  }
  const partition = await em.findOne(AttachmentPartition, {
    code: attachment.partitionCode
  });
  if (!partition) {
    return NextResponse.json(
      { error: "Partition misconfigured" },
      { status: 500 }
    );
  }
  const access = checkAttachmentAccess(auth, attachment, partition);
  if (!access.ok) {
    const message = access.status === 401 ? "Unauthorized" : "Forbidden";
    return NextResponse.json({ error: message }, { status: access.status });
  }
  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {
    tenantId: attachment.tenantId ?? "",
    organizationId: attachment.organizationId ?? ""
  });
  let buffer;
  try {
    const result = await driver.read(attachment.partitionCode, attachment.storagePath);
    buffer = result.buffer;
  } catch {
    return NextResponse.json({ error: "File not available" }, { status: 404 });
  }
  const url = new URL(req.url);
  const forceDownload = url.searchParams.get("download") === "1";
  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);
  const headers = {
    "Cache-Control": partition.isPublic ? "public, max-age=86400" : "private, max-age=60",
    "Content-Security-Policy": "default-src 'none'; sandbox",
    "Content-Type": renderInline ? attachment.mimeType || "application/octet-stream" : "application/octet-stream",
    "Content-Disposition": buildAttachmentContentDisposition(
      attachment.fileName,
      renderInline ? "inline" : "attachment"
    ),
    "X-Content-Type-Options": "nosniff"
  };
  if (attachment.fileSize > 0) {
    headers["Content-Length"] = String(attachment.fileSize);
  }
  const responseBody = new Uint8Array(buffer);
  return new NextResponse(responseBody, { status: 200, headers });
}
const openApi = {
  tag: attachmentsTag,
  summary: "Download attachment file",
  methods: {
    GET: {
      summary: "Download or serve attachment file",
      description: "Returns the raw file content for an attachment. Path parameter: {id} - Attachment UUID. Query parameter: ?download=1 - Force file download with Content-Disposition header. Access control is enforced based on partition settings.",
      responses: [
        {
          status: 200,
          description: "File content with appropriate MIME type",
          schema: z.any().describe("Binary file content")
        }
      ],
      errors: [
        {
          status: 400,
          description: "Missing attachment ID",
          schema: attachmentErrorSchema
        },
        {
          status: 401,
          description: "Unauthorized - authentication required for private partitions",
          schema: attachmentErrorSchema
        },
        {
          status: 403,
          description: "Forbidden - insufficient permissions",
          schema: attachmentErrorSchema
        },
        {
          status: 404,
          description: "Attachment or file not found",
          schema: attachmentErrorSchema
        },
        {
          status: 500,
          description: "Partition misconfigured",
          schema: attachmentErrorSchema
        }
      ]
    }
  }
};
export {
  GET,
  metadata,
  openApi
};
//# sourceMappingURL=route.js.map
