import {
  Controller,
  Get,
  Param,
  ParseUUIDPipe,
  Query,
  Res,
} from "@nestjs/common";
import { ApiBearerAuth, ApiOperation, ApiQuery, ApiTags } from "@nestjs/swagger";
import { Response } from "express";

import { FilesService } from "./files.service";

@ApiTags("files")
@ApiBearerAuth()
@Controller("files")
export class FilesController {
  constructor(private readonly filesService: FilesService) {}

  @Get(":fileId")
  // Authenticated: no @Public, so the global JwtGuard applies. Unguessable file
  // UUIDs are obscurity, not authorization — raw byte streams must require auth.
  // Browser inline previews (<img>/<iframe>/<a>) that can't carry the Bearer
  // token should use a short-lived signed URL instead (FilesService.signUrl).
  // TODO: enforce ownership-by-resource here next (scope the file to the
  // caller's booking/company before streaming).
  @ApiOperation({
    summary: "Stream a file by ID",
    description:
      "Global endpoint — streams any uploaded file directly from MinIO by its UUID. " +
      "No resource context (e.g. booking ID) required. Serves inline by default so " +
      "the browser can preview it; pass ?download=1 to force a download.",
  })
  @ApiQuery({
    name: "download",
    required: false,
    description: "Set to 1/true to force a download instead of inline preview.",
  })
  async download(
    @Param("fileId", ParseUUIDPipe) fileId: string,
    @Query("download") download: string | undefined,
    @Res() res: Response,
  ) {
    const { stream, record } = await this.filesService.streamById(fileId);
    const forceDownload = download === "1" || download === "true";
    const disposition = forceDownload ? "attachment" : "inline";

    res.setHeader("Content-Type", record.mimeType);
    res.setHeader(
      "Content-Disposition",
      `${disposition}; filename="${record.name}"`,
    );
    // Allow the browser to cache the streamed bytes briefly for smoother
    // in-page previews (re-opening the viewer shouldn't re-hit MinIO).
    res.setHeader("Cache-Control", "private, max-age=300");
    stream.pipe(res);
  }
}