import { readFile } from "node:fs/promises";
import path from "node:path";
import { NextResponse } from "next/server";
import { getDbPool } from "@/db";
import { getSession } from "@/lib/auth";
import { canOperateCapital, clientPermission, isClientSession, resolveInspectionTenant } from "@/lib/authorization";

export const runtime = "nodejs";

const contentTypes: Record<string, string> = { ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png", ".webp": "image/webp" };

export async function GET(request: Request, { params }: { params: Promise<{ externalId: string; photoId: string }> }) {
  try {
    const session = await getSession();
    if (!session) return NextResponse.json({ error: "Faça login para abrir a foto." }, { status: 401 });
    if (!canOperateCapital(session) && !(isClientSession(session) && await clientPermission(session, "can_view_photos"))) return NextResponse.json({ error: "Seu perfil não tem permissão para visualizar fotos." }, { status: 403 });
    const { externalId, photoId } = await params;
    const tenantId = await resolveInspectionTenant(session, new URL(request.url).searchParams.get("tenantId"));
    if (!tenantId) return NextResponse.json({ error: "Cliente da vistoria não encontrado ou inativo." }, { status: 404 });
    const db = getDbPool();
    const [rows] = await db.execute(
      `SELECT p.storage_key FROM inspection_photos p
       INNER JOIN inspections i ON i.id = p.inspection_id
       WHERE p.id = ? AND i.external_id = ? AND i.tenant_id = ? LIMIT 1`,
      [photoId, externalId, tenantId],
    );
    const photo = (rows as { storage_key: string }[])[0];
    if (!photo) return NextResponse.json({ error: "Foto não encontrada." }, { status: 404 });
    const storageRoot = process.env.STORAGE_PATH || "/app/storage";
    const filePath = path.resolve(storageRoot, photo.storage_key);
    if (!filePath.startsWith(`${path.resolve(storageRoot)}${path.sep}`)) return NextResponse.json({ error: "Arquivo inválido." }, { status: 400 });
    const file = await readFile(filePath);
    return new NextResponse(file, { headers: { "Content-Type": contentTypes[path.extname(filePath).toLowerCase()] || "application/octet-stream", "Cache-Control": "private, max-age=3600" } });
  } catch (error) {
    console.error("Erro ao abrir foto da vistoria", error);
    return NextResponse.json({ error: "Não foi possível abrir a foto." }, { status: 404 });
  }
}