import { NextRequest, NextResponse } from 'next/server';
import { readFile } from 'fs/promises';
import { join } from 'path';
import { verifySigningToken } from '@/lib/signing/token';
import { db } from '@/lib/db';
import { documents } from '@/lib/db/schema';
import { eq } from 'drizzle-orm';

// Public route — authenticated by signing token, no agent auth required
export async function GET(
  _req: NextRequest,
  { params }: { params: Promise<{ token: string }> }
) {
  const { token } = await params;

  // Validate JWT (no usedAt check — client may still be viewing while session is active)
  let payload: { documentId: string; jti: string; exp: number };
  try {
    payload = await verifySigningToken(token);
  } catch {
    return NextResponse.json({ error: 'Invalid or expired token' }, { status: 401 });
  }

  // Fetch preparedFilePath
  const doc = await db.query.documents.findFirst({
    where: eq(documents.id, payload.documentId),
    columns: { preparedFilePath: true },
  });

  if (!doc?.preparedFilePath) {
    return NextResponse.json({ error: 'Document not found' }, { status: 404 });
  }

  // Path traversal guard — preparedFilePath is stored as relative path (e.g. clients/{id}/{uuid}.pdf)
  const normalizedPath = doc.preparedFilePath.replace(/^\/+/, '');
  if (normalizedPath.includes('..')) {
    return NextResponse.json({ error: 'Invalid file path' }, { status: 400 });
  }

  const absolutePath = join(process.cwd(), 'uploads', normalizedPath);

  try {
    const fileBuffer = await readFile(absolutePath);
    return new NextResponse(fileBuffer, {
      status: 200,
      headers: {
        'Content-Type': 'application/pdf',
        'Content-Disposition': 'inline',
        'Cache-Control': 'private, no-store',
      },
    });
  } catch {
    return NextResponse.json({ error: 'File not found' }, { status: 404 });
  }
}
