import { NextRequest, NextResponse } from "next/server";
import { join } from "path";
import { readFileSync, existsSync } from "fs";

export async function GET(request: NextRequest) {
  const { searchParams } = new URL(request.url);
  const file = searchParams.get("file");

  if (!file) {
    return new NextResponse("File not specified", { status: 400 });
  }

  // Prevent directory traversal
  const safeFile = file.replace(/\.\./g, "").replace(/\//g, "").replace(/\\/g, "");
  const filePath = join(process.cwd(), "public", "uploads", safeFile);

  if (!existsSync(filePath)) {
    return new NextResponse("File not found", { status: 404 });
  }

  try {
    const fileBuffer = readFileSync(filePath);

    // Determine content type
    let contentType = "application/octet-stream";
    const ext = safeFile.split('.').pop()?.toLowerCase();
    if (ext === "png") contentType = "image/png";
    else if (ext === "jpg" || ext === "jpeg") contentType = "image/jpeg";
    else if (ext === "webp") contentType = "image/webp";
    else if (ext === "svg") contentType = "image/svg+xml";

    return new NextResponse(fileBuffer, {
      headers: {
        "Content-Type": contentType,
        "Cache-Control": "public, max-age=31536000, immutable",
      },
    });
  } catch (error) {
    return new NextResponse("Error reading file", { status: 500 });
  }
}