import { NextRequest, NextResponse } from "next/server";
import { readFile } from "fs/promises";
import { connectDB } from "@/lib/db";
import { QmSubmission } from "@/models/QmSubmission";
import { isAdminSession, hasPermission } from "@/lib/adminAuth";
import { getSessionClientId } from "@/lib/auth";
import { qmAttachmentUploadPath } from "@/lib/uploads";

export async function GET(_req: NextRequest, { params }: { params: Promise<{ submissionId: string; filename: string }> }) {
  if (!(await isAdminSession())) return new NextResponse("Unauthorized", { status: 401 });

  const { submissionId, filename } = await params;
  const clientId = await getSessionClientId();

  await connectDB();
  const submission = await QmSubmission.findById(submissionId).lean();
  if (!submission || submission.attachmentStoredName !== filename) {
    return new NextResponse("Not found", { status: 404 });
  }
  const canReview = await hasPermission(submission.target);
  if (String(submission.submittedBy) !== clientId && !canReview) {
    return new NextResponse("Unauthorized", { status: 401 });
  }

  try {
    const buffer = await readFile(qmAttachmentUploadPath(submissionId, filename));
    return new NextResponse(new Uint8Array(buffer), {
      headers: {
        "Cache-Control": "private, max-age=0, no-store",
        "Content-Disposition": `inline; filename="${encodeURIComponent(submission.attachmentFilename || filename)}"`,
      },
    });
  } catch {
    return new NextResponse("Not found", { status: 404 });
  }
}