import { getSessionUser } from "@/lib/auth";
import { getMailboxDrawerSharedPayload } from "@/lib/mailbox-file-drawer";

export const runtime = "nodejs";
export const dynamic = "force-dynamic";

function contentDisposition(filename: string, inline: boolean) {
  const safeAscii = filename.replace(/[^\x20-\x7e]+/g, "_").replace(/["\\]/g, "_") || "file";
  return `${inline ? "inline" : "attachment"}; filename="${safeAscii}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
}

export async function GET(
  request: Request,
  context: { params: Promise<{ token: string }> },
) {
  const user = await getSessionUser();
  const { token } = await context.params;
  const payload = await getMailboxDrawerSharedPayload({
    requesterEmail: user?.email ?? null,
    token,
  });
  if (!payload) return Response.json({ error: "not-found" }, { status: 404 });

  const requestedInline = new URL(request.url).searchParams.get("mode") !== "download";
  const canInline = payload.mimeType.toLowerCase().startsWith("image/") || payload.mimeType === "application/pdf";
  return new Response(new Uint8Array(payload.body), {
    headers: {
      "Cache-Control": "private, no-store, max-age=0",
      "Content-Disposition": contentDisposition(payload.filename, requestedInline && canInline),
      "Content-Length": String(payload.body.length),
      "Content-Security-Policy": "default-src 'none'; sandbox",
      "Content-Type": payload.mimeType,
      "Referrer-Policy": "no-referrer",
      "X-Content-Type-Options": "nosniff",
    },
  });
}